By Christoph Rittweger

This story was originally published in a Baker & McKenzie Data Protection Law “Client Alert” and is reprinted here with permission.

The German government has introduced two draft bills to the Bundesrat (Upper House of Parliament) to reform the German Federal Data Protection Act (FDPA—“Bundesdatenschutzgesetz”).

The readings in and the adoption of the bills by the Bundestag (Lower House of Parliament) are still outstanding. It is expected that the bills will come into effect in the first half of 2009.

In the meantime the German Minister of the Interior announced on February 18, 2009 that he will work on general guidelines on employee data protection which he plans to introduce into the FDPA before the general elections in fall 2009.

Background
The year 2008 was marked by various data protection affairs and security incidents which revealed that several companies had violated German data protection laws. Incidents included illegal monitoring of employees, loss of personal data, and illegal sales of consumer data. The impact on public perception was massive. Many people feel insecure about the safety of their personal data and companies have suffered a substantial loss of credibility.

What businesses/industries are concerned?
While the majority of revisions to the FDPA will apply to companies at large, some of the changes will have greater implications for the financial sector (including credit agencies) and direct marketing agencies.

What will be changed?
The following contains a list of major planned changes:

• The right of data subjects to be informed about the collection, processing and use of their personal data will be considerably expanded. In particular, additional information and access rights will be granted to data subjects with regard to scoring-procedures or data used by credit agencies.
• Companies can obtain a special data protection seal by regularly complying with data protection control procedures and implementing specific data privacy rules under a Statute on Data Protection Audits (“SDPA”). The adoption of the SDPA is intended to improve the transparency of data processing and consumer confidence.
• Rights and position of the data protection officers will be strengthened. The data protection officer’s protection against dismissal will be extended and data controllers shall pay for the data protection officer’s continuing training and education. Companies in Germany have to appoint a data protection officer, for example, if they engage more than 9 persons in the automated processing of personal data or more than 19 persons in case of non-automated processing.
• Repeal of the so-called “list privilege.” The existing broad permission to transfer and use personal data for the trading in addresses, advertising and market or opinion research will be reduced to only a few exceptions. The transfer and use of data for the above purposes will generally only be admissible with the data subjects’ consent which will have a huge impact on direct marketing activities in Germany.
• Introduction of security breach notification obligations. Data controllers shall be subject to extensive notification obligations in case of unlawful transfers to or unauthorized access of personal data by third persons (similar to existing security breach notification laws in the US). The obligations only apply to specific categories of data (“sensitive data”, professional secrets, data relating to criminal actions, bank account/credit card information, and certain telecommunication data). In case of a security breach, data controllers will have to notify the data protection authorities and will have to inform every person concerned (or, alternatively, publish nationwide announcements in newspapers).
• Applicable fines will be raised/ skimming off excess profits. The maximum fines will be increased from Euro 25,000 to Euro 50,000 and from Euro 250,000 to Euro 300,000 respectively. Furthermore, data protection authorities shall have the right to impose even higher fines if the benefits from violating data protection laws exceed the fines generally admissible (i.e. skimming off excess profits).
• Data transfers to credit agencies will be restricted. Data transfers to credit agencies with regard to outstanding debts will only be admissible in certain cases (e.g. the relevant monetary claims must be non-appealable or explicitly accepted or a specific procedure of asserting monetary claims with information to the data subject of the envisaged transfer must be followed; further exceptions apply).
• Technical requirements and additional access and information rights will be introduced with respect to credit scoring in order to make any credit scoring procedures more transparent.

Summary
The envisaged changes to the FDPA will have considerable impact on the daily activities of all companies doing business in Germany. In view of the continuing news on privacy-related incidents and data security breaches it seems probable that the bills will pass through the political decision process without major changes during the first half of 2009. Additionally, the introduction of general guidelines for the handling of employee data within the FDPA is equally expected to pass Parliament before the general elections in fall 2009. What these guidelines will look like is unclear at this point in time.

For more information contact Christoph Rittweger, lead author, at Christoph.rittweger@bakernet.com.