After the coalition committee announced a plan to streamline data protection and relieve the burden on smaller companies at the beginning of July, the first concrete step is now being taken by the federal states. On Friday, at Hamburg’s request, the Federal Council decided to submit a bill to reform the Federal Data Protection Act (BDSG) to the Bundestag. In doing so, it takes up the goal of noticeably simplifying data protection procedures in Germany and bundling the fragmented supervisory structures.
Read more after the ad
The states are thus reacting to a well-known problem of the digital economy: the structure characterized by federalism ensures a high level of local industry expertise. However, it sometimes leads to double checks and inconsistent application of the law for nationwide systems, cross-border research projects and corporations. This needs to change in order to create legal certainty for data-driven innovations.
The core of the outlined amendment is the legal institutionalization of the Data Protection Conference (DSK), in which the Federal Commissioner and the supervisory authorities of the federal states have joined forces. Until now, the committee has often suffered from lengthy consensus-building. In the future, the DSK should be given the explicit authority to make binding majority decisions. If there is no agreement on a common position in proceedings under the General Data Protection Regulation (GDPR), a simple majority should decide.
According to the plan, each state and the federal government each receive one vote. These resolutions are primarily intended to clarify questions of fundamental importance, such as the interpretation of the GDPR or the evaluation of new technologies. In order to preserve the federal independence of the state authorities, these resolutions bind the members among themselves, but do not have any direct external binding effect and do not establish any enforceable rights for third parties. The Federal Council wants to leave the precise design of its working methods to the DSK’s autonomy in the rules of procedure, which should enable more flexible and practical solutions without constant changes to the law.
Central contact not only for companies
A national one-stop shop is intended to provide considerable relief in practice. According to the draft, a central contact person would be established for affiliated companies within the meaning of the Stock Corporation Act as well as for cross-border scientific, historical or statistical research projects. In the future, companies and research institutions could apply through a joint notification to pool responsibility with a single supervisory authority. The selection should be based on clear, objective criteria: the authority of the federal state in which the person responsible with the highest domestic annual turnover is based is responsible.
If those involved have no turnover, which is often the case with non-profit organizations or government institutes, the deciding factor is the number of employees who are specifically involved in data processing. Access should be made unbureaucratic for those affected, as the report can be submitted to any responsible authority. This should inform the other parties immediately.
In order to speed up the process, the federal states set a strict deadline: If the lead authority has not determined the bundling within one month of receiving the complete documents, the authority applied for is automatically considered responsible.
Read more after the ad
It’s the Federal Council’s turn
This model should be supplemented by the one-for-all principle (EfA), which is known from administrative digitalization. Once a data protection authority has examined and evaluated a system or procedure used by a controller, this judgment would be binding for all other supervisory authorities. The prerequisite is that the system is used by other responsible parties without significant changes in their respective areas of responsibility. This is intended to prevent software that is considered data protection compliant in one federal state from having to undergo another lengthy review in another.
The Federal Council is promoting the project and the economy can expect a significant reduction in annual compliance costs in the medium term by eliminating these multiple votes. There would be no immediate additional costs or changes in effort for citizens and public administration. Now the ball is in the court of the federal government and the Bundestag. The latter must discuss the draft “within a reasonable period of time”.
Read also
(NO)
