Adaptation of data protection

Bundestag passes mock exoneration and devalues data protection and civil rights

In this article you will learn:

• The most important facts about the adapted data protection law by the Bundestag on 26.06.2019
• Why the new regulation on the obligation to appoint a data protection officer from 20 employees upwards does not relieve the burden, but rather increases it
• Which civil rights were cut by the Bundestag

Shortly before the summer break, the Bundestag decides, in a cloak-and-dagger operation, to adapt 154 different laws. The so-called "Second Act for the Adaptation of Data Protection Law to Regulation (EU) 2016/679 and for the Implementation of Directive (EU) 2016/680 (Second Data Protection Adaptation and Implementation Act EU - 2nd DSAnpUG-EU)" makes many far-reaching cuts without any real discussion within the parliamentary groups, but above all in public.

Data Protection Officer's appointment obligation increased to 20 employees

An important adjustment for the data protection industry concerns the obligation of the Data Protection Officer (DPO) to appoint a data protection officer. In the future, the appointment of a company or external data protection officer will generally only become mandatory for companies with 20 or more employees.

Many professional and interest associations, such as the Pharmacy Associationas well as relevant media, such as the South German Online, celebrate this change as a relief from data protection.

From the point of view of experienced data protection officers, however, the decision does a disservice to the companies concerned, as the requirements for implementing data protection have not changed in principle despite the modified ordering obligation.

Because in the future, too, it will apply:

• To draw up the list of processing activities and, in doing so, to examine all relevant processes in the company for data flow, data types, data categories and legality and, in the case of high risks, to conduct data protection impact assessments.
• To create a clean contractual situation for data processing with business partners and third party organisations, such as contract processing agreements, joint controls, EU standard contract clauses or corporate binding rules.
• To critically examine data security, to implement necessary technical and organizational measures and to document this implementation in a sustainable manner.
• To create an ideally DIN 66399-compliant deletion concept for all relevant types of data and to implement this in the form of deletion rules in the organization.
• Establish the rights of data subjects, such as the information duties, disclosure obligations or deletion requests

If the legislator had really wanted to do something to ease the burden on small organisations, one would have Recital 13 of the GDPR to take seriously. There it is described in sentence 3:

"In order to take account of the specific situation of micro, small and medium-sized enterprises, this Regulation provides for a derogation from the requirement to keep a register of establishments employing fewer than 250 persons".

However, it is not clear how this simplification for micro-enterprises or SMEs could be achieved without limiting data protection rights derived from the fundamental right to informational self-determination. One possibility would be to standardize data protection requirements as far as possible on an industry-specific basis and thus to work in conformity with the law and effectively from the outset.

Financial relief versus increasing legal uncertainty

Financial aspects seemed to have played a major role in the Bundestag's decision, because it is clear that the involvement of an external data protection officer costs money.

However, this is countered by the fact that employees without specialist knowledge, who often have to implement data protection alongside their day-to-day business, are overwhelmed by the content.

An increase in the limit for the obligation to appoint a data protection officer therefore inevitably leads to a reduction in the level of data protection, increases legal uncertainty and thus increases the risk of warnings and fines for companies.