Status

The German Government passed an implementation act dated 30 June 2017. The Act is scheduled to become effective on 25 May 2018; however, one provision (introducing a right for data protection authorities to challenge the validity of decisions of the European Commission in a German court) took effect when the Act was published (see our blog post for further details).

Further legislation at the state and federal levels (and some sector-specific laws, e.g., for postal services) will be required to finalise the implementation. Please note that state laws only concern the public sector.

Approach

The Act concentrates mainly on public law issues, but also introduces some specific rules on legal grounds, purpose limitation, notice requirements, HR data, credit reporting, and DPO requirements for the private sector (see our blog post for further details).

The Coordination Group of the State and Federal Data Protection Authorities (Düsseldorfer Kreis) has published a first decision on the validity of consent clauses under the GDPR. The Group assumes that consent clauses valid under present law will likely be valid under the GDPR as well, despite the lack of a grandfathering clause for existing consent clauses under the GDPR. The Bavarian Data Protection Authorities have already published a collection of short guidelines on the application of the GDPR (including a model processor agreement) and other State Data Protection Authorities have since followed suit.

The Bavarian Authority sent questionnaires regarding progress on meeting GDPR compliance targets to companies in Bavaria with a deadline of 25 May 2018. The Federal Conference of Data Protection Authorities has also published a number of short guidance papers regarding the GDPR.

Local Contact

Ulrich Wuermeling and
Joachim Grittmann 
Latham & Watkins