Since 25 May 2018, the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) has covered those areas where the General Data Protection Regulation (EU) 2016/679 gives the European Union member states leeway for their own provisions. The Federal Data Protection Act also implements key parts of Directive (EU) 2016/680, which contains provisions on data processing for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties.

The Federal Data Protection Act applies to government agencies at federal and state level (unless other state law applies) and to private entities. The Act is made up of four parts:

Part 1: Common provisions

The common provisions in Part 1 apply to data processing regardless of whether it is for the purposes covered by the General Data Protection Regulation or by Directive (EU) 2016/680, or for purposes not covered by either, such as data processing for national security purposes.

Part 1 contains the general legal framework for data processing (including video surveillance) and provisions on data protection officials for government agencies; on the office, tasks and powers of the Federal Commissioner for Data Protection and Freedom of Information; and on German representation on the European Data Protection Board.

Part 2: Implementing provisions

Part 2 contains implementing provisions on processing for purposes in accordance with the GDPR, including

• processing of special categories of personal data,
• further processing,
• data transfers,
• special processing situations.

Part 2 also contains provisions on the rights of data subjects and on fines for data protection violations.

Part 3: Implementing provisions on processing for purposes in accordance with Directive (EU) 2016/680

Part 3 implements Directive (EU) 2016/680 on data processing by law enforcement and judicial authorities where it has not already been implemented in specialised law. In addition to general provisions on data processing, this part also contains provisions on the rights of data subjects, on obligations of controllers and on data transfers to countries outside of the EU.

Part 4: Special provisions

Part 4 of the Federal Data Protection Act contains special provisions on data processing which is not covered by the GDPR or Directive (EU) 2016/680.

 

to the top