BDSG-NEW VS BDSG-OLD

Video Surveillance of Publicly Accessible Areas

For private persons and companies, the two alternatives for permissibility remain the
“protection of domiciliary rights“ and the “realization of legitimate interests for specified
purposes.” What is new is that Section 4 of the 2018 BDSG explicitly states that the
protection of life, health, or freedom of individuals in large public facilities and vehicles of
any kind constitutes a particularly important interest in video surveillance. Such facilities
include, among others, sports, assembly and entertainment venues, shopping malls, parking
lots as well as facilities for rail, ship, and bus traffic. There are also more detailed rules on
public surveillance notices. In particular, Section 4 clarifies that this notice must be
recognizable at the earliest possible moment; i.e., before the individual enters the area
covered by video surveillance.

With regard to the notification of video surveillance that was already necessary previously,
and included the name and contact information of the controller, it has now been clarified in
addition that this notification must be visible at the earliest possible opportunity, i.e., it is
best for the notification to be located before the entrance to the area covered by video
surveillance.

Processing in the context of employment

The German federal government regulated employee data protection in Section 26 BDSG-
new. In this process, it noticeably focused on the previous regulations of Section 32 Federal
Data The scope of application of Section 26 BDSG-new is widely formulated and in addition
to traditional employees expressly also includes temporary employees, home workers,
trainees, as well as civil servants, judges, and soldiers. The scope of application expressly
includes applicants. As previously, the requirements also apply to non-automated forms of
processing, such as human resources files kept in paper form. Participation rights of work
councils are not limited by Section 26 BDSG-new.

Data Protection Officers and Accreditation of Certification Bodies

Accordingly, it is mandatory of a data protection officer to be appointed, as was already the
case in Federal Data Protection Act-2003 – if the company in general permanently employs at
least ten people in the automated processing of personal data.

With regard to the position of the data protection officer in non-public bodies, Section 38(2)
BDSG-new refers in some cases to the provisions on data protection officers in public bodies,
in particular to the special requirements for dismissal and termination, particular secrecy and
the data protection officers’ right to refuse to give evidence. The essentials of these
characteristics of the role of the data protection officer are already known from Sections 4g, f
Federal Data Protection Act-2003.

ADDITIONAL NATIONAL SANCTIONS TO THOSE PROVIDED IN THE GDPR. The new BDSG
includes:

1. fines of up to EUR 50,000 for breaches in the area of consumer credit;

2. criminal penalties with up to three years of imprisonment or criminal fines in

case of certain intentional unlawful data processing activities.

RESTRICTION TO THE RIGHTS OF DATA SUBJECTS IN FAVOUR OF MORE BUSINESS-

FRIENDLY RULES (SECTIONS 32 TO 35).

1. The right of data subjects to be informed if the controller intends to further

2. process personal data for a purpose other than that for which the personal data
was collected (Art. 13 GDPR), may be limited if data is stored in an analogue
manner, the further processing is compatible with the original purpose and
communication with the data subject does not take place digitally;

3. Obligations to provide information on the part of the data controller may be

restricted in the case of confidentiality obligations (for instance, professional
secrecy);

4. Access rights of data subjects (Art. 15 GDPR) may be limited if personal data
is only kept in accordance with legal retention periods and it would require an
unreasonable effort to be provided;

5. The right to request erasure and the obligation to erase do not apply if erasure
requires an unreasonably high effort due to the specific type of storage.