German BDSG Requirements

German BDSG Requirements

German-specific data protection requirements under the Bundesdatenschutzgesetz (BDSG) and state laws.

Table of Contents

• BDSG Overview
• DPO Requirements
• Employment Data
• Video Surveillance
• Credit Scoring
• State Data Protection Laws
• German Supervisory Authorities

BDSG Overview

The Bundesdatenschutzgesetz (BDSG) supplements the GDPR with German-specific provisions under the opening clauses.

Key BDSG Additions to GDPR

BDSG Structure

• Part 1 (§§ 1-21): Common provisions
• Part 2 (§§ 22-44): Implementation of GDPR
• Part 3 (§§ 45-84): Implementation of Law Enforcement Directive
• Part 4 (§§ 85-91): Special provisions

DPO Requirements

Mandatory DPO Appointment (§ 38 BDSG)

A Data Protection Officer must be appointed when:

1. At least 20 employees are constantly engaged in automated processing of personal data

2. Processing requires DPIA under Art. 35 GDPR (regardless of employee count)

3. Business purpose involves personal data transfer or market research (regardless of employee count)

DPO Qualifications

Required qualifications:

• Professional knowledge of data protection law and practices
• Ability to fulfill tasks under Art. 39 GDPR
• No conflict of interest with other duties

Recommended qualifications:

• Certification (e.g., TÜV, DEKRA, GDD)
• Legal or IT background
• Understanding of business processes

DPO Independence (§ 38(2) BDSG)

• Cannot be dismissed for performing DPO duties
• Protection extends 1 year after end of appointment
• Entitled to resources and training
• Reports to highest management level

Employment Data

§ 26 BDSG - Processing of Employee Data

Lawful processing for employment purposes:

1. Establishment of employment (recruitment)

   • CV processing
   • Reference checks
   • Background verification (limited scope)

2. Performance of employment contract

   • Payroll processing
   • Working time recording
   • Performance evaluation

3. Termination of employment

   • Exit interviews
   • Reference provision
   • Legal claims handling

Consent in Employment Context

Special requirements:

• Consent must be voluntary (difficult in employment relationship)
• Power imbalance must be considered
• Written or electronic form required
• Employee must receive copy

When consent may be valid:

• Additional voluntary benefits
• Photo publication (with genuine choice)
• Optional surveys

Employee Monitoring

Permitted (with justification):

• Email/internet monitoring (with policy and proportionality)
• GPS tracking of company vehicles (business use)
• CCTV in certain areas (not changing rooms, toilets)
• Time and attendance systems

Prohibited:

• Covert monitoring (except criminal investigation)
• Keystroke logging without notice
• Private communication interception

Works Council Rights

Under Betriebsverfassungsgesetz (BetrVG):

• Co-determination on technical monitoring systems (§ 87(1) No. 6)
• Information rights on data processing
• Must be consulted before implementation

Video Surveillance

§ 4 BDSG - Video Surveillance of Public Areas

Permitted for:

1. Public authorities - for their tasks
2. Private entities - for:
   • Protection of property
   • Exercising domiciliary rights
   • Legitimate purposes (documented)

Requirements:

• Signage indicating surveillance
• Retention limited to purpose
• Regular review of necessity
• Access limited to authorized personnel

Technical Requirements

Signs must include:

• Fact of surveillance
• Controller identity
• Contact for rights exercise

Data retention:

• Delete when no longer necessary
• Typically maximum 72 hours
• Longer retention requires specific justification

Balancing Test Documentation

Document for each camera:

• Purpose served
• Alternatives considered
• Privacy impact
• Proportionality assessment
• Technical safeguards

Credit Scoring

§ 31 BDSG - Credit Information

Requirements for scoring:

• Scientifically recognized mathematical procedure
• Core elements must be explainable
• Not solely based on address data

Data subject rights:

• Information about score calculation (general logic)
• Factors that influenced score
• Right to explanation of decision

Creditworthiness Assessment

Permitted data sources:

• Payment history with data subject consent
• Public registers (Schuldnerverzeichnis)
• Credit reference agencies (Auskunfteien)

Prohibited practices:

• Social media profile analysis for credit decisions
• Using health data
• Processing special categories for scoring

Credit Reference Agencies (Auskunfteien)

Major agencies:

• SCHUFA Holding AG
• Creditreform
• infoscore Consumer Data GmbH
• Bürgel

Data subject rights with agencies:

• Free self-disclosure once per year
• Correction of inaccurate data
• Deletion after statutory periods

State Data Protection Laws

Landesdatenschutzgesetze (LDSG)

Each German state has its own data protection law for public bodies:

Public vs Private Sector

Public sector (Länder laws apply):

• State government agencies
• State universities
• State healthcare facilities
• Municipalities

Private sector (BDSG applies):

• Private companies
• Associations
• Private healthcare providers
• Federal public bodies

German Supervisory Authorities

Federal Level

BfDI - Bundesbeauftragte für den Datenschutz und die Informationsfreiheit

• Responsible for federal public bodies
• Responsible for telecommunications and postal services
• Representative in EDPB

State Level Authorities

Competence:

• Private sector entities headquartered in the state
• State public bodies

Determining Competent Authority

For private sector:

1. Identify main establishment location
2. That state's DPA is lead authority
3. Cross-border processing involves cooperation procedure

Fines and Enforcement

BDSG fine provisions (§ 41):

• Up to €50,000 for certain violations (supplement to GDPR)
• GDPR fines up to €20 million / 4% turnover apply

German enforcement characteristics:

• Generally cooperative approach first
• Written warnings common
• Fines increasing since GDPR
• Public naming of violators

Compliance Checklist for Germany

BDSG-Specific Requirements

• DPO appointed if 20+ employees process personal data
• DPO registered with supervisory authority
• Employee data processing documented under § 26
• Works council consultation completed (if applicable)
• Video surveillance signage in place
• Scoring procedures documented (if applicable)

Documentation Requirements

• Records of processing activities (German language)
• Employee data processing policies
• Video surveillance assessment
• Works council agreements

Supervisory Authority Engagement

• Competent authority identified
• DPO notification submitted
• Breach notification procedures in German
• Response procedures for authority inquiries

Key Differences from GDPR-Only Compliance