Abstract

Data protection by public bodies

When considering the high number of enactments of security statutes and prevailing ubiquitous computing by public bodies, commentators may be inclined to suggest an Orwellian perspective on public surveillance. However this appears to be nothing more than an unfounded exaggerated concern at best.

The elaborate German constitutional law – substantiated by acts of federal and state parliaments – provides a sound legal basis for adequate standards of data privacy by public bodies. Nevertheless, data privacy law in Germany appears to have certain inadequacies. The drafting of statutes, particularly within the genre of specific laws, shows a lack of systematic research which is much-needed in order to raise the quality level of legislation. In contrast, the constitutional foundation of data protection law tends towards an unnecessarily high level of complexity that is supported by a large number of scientific publications. Nevertheless, there is no need to reshape the basic structures, like the scope of protection or the definition of interference with respect to constitutional data protection law.

Another challenge lies within the coordination of German data protection law and the European Union. This matter surfaced recently, when the Federal Constitutional Court of Germany quashed the German implementation of Directive 2006/24/EC (“data retention“) by means of para 113a German Telecommunications Act, thus creating a potentially undesirable situation. Subsequently to the Constitutional Court's ruling, the directive is currently not implemented, which means that Germany faces legal actions for its failure to fulfil its Treaty obligations (under Article 258 TFEU). Yet the quashed law violated the guarantee of the secrecy of correspondence (Art. 10 German Basic Law). Furthermore, the courts in Karlsruhe, Luxembourg, and Strasbourg partially disagree on the weighting of values, as the ECJ's judgement on the disclosure of state aids in the agricultural sector only recently demonstrated.

Yet arguably the most significant menace to data protection law in Germany is the insatiable appetite of private businesses to hold and use data.