Data protection

Data protection refers to the protection of natural persons with regard to the processing of their personal data. Under Article 1(2) of the General Data Protection Regulation (GDPR), the Regulation protects the fundamental rights and freedoms of natural persons, in particular their right to the protection of personal data. The right to informational self-determination, derived from Article 2(1) in conjunction with Article 1(1) of the German Basic Law (Grundgesetz – GG), also provides an important constitutional foundation. Data protection is intended to ensure that personal information is processed only in accordance with the requirements laid down by law.

What does data protection mean and why is it important?

Data protection safeguards every individual's right, in principle, to decide for themselves how their personal data is disclosed and used. In Germany, this right to informational self-determination was shaped in particular by the Federal Constitutional Court's 1983 Census Act judgment.

As digitalisation continues to advance, data protection is becoming increasingly important. Companies, public authorities and other organisations process large volumes of personal data every day. This includes, for example, customer information, employee data and information about user behaviour on websites.

Data protection is intended to prevent such information from being processed without an adequate legal basis or used for purposes other than those intended. At the same time, it establishes the legal framework within which personal data may be processed lawfully.

Data protection should not be confused with data security. While data protection concerns the lawful handling of personal data, data security focuses in particular on protecting it against loss, manipulation and unauthorised access. The two areas are closely interconnected.

What data is protected by data protection law?

Data protection primarily concerns personal data. Under Article 4(1) GDPR, personal data means any information relating to an identified or identifiable natural person.

Examples include:

• Identification data: Name, address or date of birth.
• Contact details: Telephone number or personal email address.
• Employee data: Employee number, salary information or application documents.
• Online identifiers: IP addresses or cookie identifiers, insofar as they make it possible to identify an individual.
• Health data: Information about an individual's physical or mental health.

Additional safeguards apply to certain particularly sensitive types of personal data. These include, in particular, the special categories of personal data under Article 9 GDPR, such as health data, biometric data used for the purpose of uniquely identifying a person, and information about religious beliefs.

The decisive factor is whether information can be attributed to a natural person, either directly or indirectly. Fully anonymised data, where identification is no longer possible according to the applicable criteria, does not generally fall within the scope of the GDPR.

What principles govern data protection?

The core principles governing the processing of personal data are set out in Article 5 GDPR. They form the basis for the lawful handling of personal information.

The most important data protection principles include:

• Lawfulness, fairness and transparency: Personal data must be processed on an appropriate legal basis. Processing must be fair and transparent to data subjects.
• Purpose limitation: Personal data may only be collected for specified, explicit and legitimate purposes. Subsequent processing for other purposes is permissible only under the conditions laid down by law.
• Data minimisation: Only personal data that is adequate, relevant and necessary for the relevant purpose may be processed.
• Accuracy: Personal data must be accurate and, where necessary, kept up to date.
• Storage limitation: Personal data must generally not be stored in an identifiable form for longer than is necessary for the relevant processing purposes.
• Integrity and confidentiality: Personal data must be protected by appropriate measures against unauthorised or unlawful processing and against accidental loss, destruction or damage.

The principle of accountability under Article 5(2) GDPR also applies. Controllers must not only ensure compliance with the data protection principles but also be able to demonstrate it.

Another important principle is the so-called prohibition with permission subject to a legal basis (Verbot mit Erlaubnisvorbehalt). Under this principle, the processing of personal data is permissible only if an appropriate legal basis exists. This may arise, for example, from consent, the necessity of processing for the performance of a contract or legitimate interests under Article 6 GDPR.

What data protection obligations do companies have?

Companies must ensure that the processing of personal data complies with the statutory requirements. The specific measures required depend in particular on the nature, scope and risks of the processing in question.

The key data protection obligations include:

• Legal basis: Every processing activity involving personal data must have an appropriate legal basis.
• Information obligations: Data subjects must be informed about the processing of their personal data in accordance with Articles 13 and 14 GDPR.
• Data subject rights: Subject to the statutory requirements, data subjects have rights including access, rectification, erasure and restriction of processing of their personal data. Rights to data portability and to object may also apply.
• Technical and organisational measures: Personal data must be protected by appropriate security measures in accordance with Article 32 GDPR.
• Documentation: Companies must be able to demonstrate their data protection measures and, where required by law, maintain a record of processing activities.
• Processing on behalf of a controller: Where external service providers process personal data on behalf of a controller, a contract under Article 28 GDPR is generally required.
• Personal data breaches: In the event of a personal data breach, the statutory notification obligations and, where applicable, the obligations to communicate the breach to affected individuals must be assessed.

In addition, companies may be required under the relevant statutory conditions to appoint a data protection officer or carry out a data protection impact assessment.

Compliance with these obligations is not relevant only to large corporations. Small and medium-sized enterprises must also comply with data protection requirements as soon as they process personal data within the scope of the GDPR.

Practical example: Data protection when processing customer data

A medium-sized company operates an online shop. To process orders, it collects its customers' names, delivery addresses, email addresses and payment information.

This data is required to process orders, dispatch goods and fulfil the company's contractual obligations towards its customers. To the extent that processing is necessary for these purposes, it may be based on Article 6(1)(b) GDPR.

The company also wishes to use customer data for personalised advertising campaigns. As this purpose goes beyond the original fulfilment of the contract, the company must separately assess whether an appropriate legal basis exists. Depending on the advertising activity, further statutory requirements may also apply.

The company informs its customers about the processing of their data, restricts access to authorised employees and establishes appropriate deletion periods. It also ensures that customers can exercise their statutory data protection rights.

legal data assessment: Companies should not reduce data protection to privacy notices or technical security measures. The decisive factor is that every processing activity involving personal data has an appropriate legal basis and complies with the statutory data protection principles. A structured data protection framework, with clearly defined responsibilities, documented processing activities and regular reviews, helps reduce legal risks and ensure the ongoing protection of personal data.

Legal bases

In particular, Articles 1, 4(1) and 4(2), 5, 6, 9, 12 to 22, 24, 25, 28, 30, 32 to 35 and 37 GDPR, as well as the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG). At constitutional level, Articles 1(1) and 2(1) GG and Articles 7 and 8 of the Charter of Fundamental Rights of the European Union are also relevant.