Data Protection Laws and Freedom of Expression: Germany
Constitutional/Primary Law Background - see also ECHR and EU Charter
Article 5(1) of the contemporary German Constitution (rev. 2014) protections the right of persons to freely express and disseminate opinions and to inform without hindrance from generally accessible sources. The freedom of the press and reporting via broadcasts and films is guaranteed and censorship is prohibited. Limits are permitted in Article 5(2) in the provisions of general laws, in the protection of the young and in the right to personal honour. Article 5(3) separately establishes freedom of the arts, sciences, research and teaching. Article 10 protects the privacy of correspondence, posts and telecommunications, subject to restrictions under law. Article 13 protects the inviolability of the home, with searches permitted only via the judicial or, in cases of urgency, other legal authorities. There is no express right to privacy or to data protection. Article 2 sets out a general right to the free development of personality (so long as this does not violate the rights of others or offend against the constitutional order or the moral law) which has been interpreted broadly. However, there is no express right to privacy or to data protection as such.
The Weimar Constitution of 1919 provided for the first express protection of the right to freely express opinion (for German citizens only) and general prohibition of censorship (s. 118), of freedom of art, science and their teaching (s. 142) and, subject to legal exceptions, of the inviolability of the home/residence (s. 115) and of the secrecy of communications (s. 117).
First-Generation Statutory Law
|
The first data protection law was adopted on 27 January 1977 after an initial draft was introduced at the West German Bundestag as early as 1971/72 by members of the Socialist Party SPD. The legislation was significantly reformed in late 1990 and came into force in 1991.
Special Expression Derogation
In 1977, Germany granted press, radio and film bodies processing exclusively for their own journalistic purposes a complete exemption from the law, aside from the need to adopt any appropriate technical or organisational security measures (Bundesdatenschutzgesetz 1977, s. 1(3)). Reform of law in 1991 generally carried forward these provisions (Federal Data Protection Act 1991, s. 41(1)). However, it was specified that the processing/use of personal data for the publication of “address, telephone, classified or similar directories” would only fall within this provision “if a journalistic – editorial activity is connected with such publication” (Ibid, s. 41(1)). Further special provisions also resulted in broadcasters subject to federal law being subject to highly qualified versions of the accuracy principle and right of subject access (s. 41(2)-(4)). It was also indicated that a data protection officer internal to the broadcasting organisation should take the place of the Data Protection Authority in regulating all issues concerning data protection compliance (Ibid, s. 42). No derogation was provided for the exercise of special expression outside of the media context during the first-generation period. Regulation of the Press and Broadcasting is principally a matter for the States (or Länder) in Germany. In this context, it should be noted that the first Interstate Broadcasting Treaty was adopted in 1987. Data protection in relation to billing and connection data were included from 1994 (see s. 28). However, journalistic processing was left unregulated in this Treaty during the first-generation period (a full list of amendments to the Treaty over time is provided by the Institute fűr Urheber- under Medienrecht).
Broad Expression Derogation
No special provision adopted.
Personal Exemption
There was no explicit provision. However, from 1991 the law only applied to private entities insofar as they process or use the data in or from files for business, professional or commercial purposes (Federal Data Protection Act 1991, s. 1(2)(3)). The original 1997 stated that personal data which was not intended for communication to third parties and not processed by automatic methods would be exempt from all but the need to adopt technical and organisational security measures (Bundesdatenschutzgesetz 1977, s. 1 (2)). The amending law in 1991 carried forward this provision but made any knowledge facilitation processing subject to the conditions specified below (Federal Data Protection Act 1991, s. 1(3)(2)).
Knowledge Facilitation Framework
The 1977 legislation restricted the blocking of data where processing was indispensable for scientific purposes (Bundesdatenschutzgesetz 1977, para. 14(2)). More far-reaching provisions regarding knowledge facilitation were introduced in 1991 (Federal Data Protection Act 1991,s. 40). A scientific derogation from the compatibility principle was permitted where scientific interests significantly outweighed the data subject’s interests and the purpose of the research could not be achieved without disproportionate effort in case of compliance (Ibid, s. 14(2)(9) and s. 28(1)(4)). The same test applied for derogations for scientific purposes from the sensitive data rules. Exemptions were also granted from the proactive indirect transparency rule and the legitimating ground condition where compliance would require disproportionate effort (Ibid, s. 40). It was generally stressed personal data collected or stored for scientific research purposes could only be processed or used for such purposes (Ibid, s. 40(1)), that personal data should be depersonalised as soon as the research purpose permitted this, that attribution information should be stored separately from other data in the interim and that such data should only be combined to the extent required by the research purpose (Ibid, s. 40(3)). It was further stated that any communication of personal data other than to public bodies for scientific research purposes would only be permitted subject to an undertaking to comply with these conditions (Ibid, s. 40(2)). Finally, these special provisions stated that bodies conducting scientific research could only publish personal data where the data subject had consented to this or where it was indispensable for presenting findings on contemporary events (Ibid, s. 40(4)).
|
Parliamentary Debates
Special Expression Derogation – Discussion in 1970s
The deliberations on this legislation spanned several years and most of the parliamentary debate focused the implications for data protection on the public sphere. Parliamentary State Secretary of the Ministry of the Interior, Mr Baum, justifying the draft legislation, observed that ‘computers are necessary to facilitate administrative work, but there are extreme opinions on automation […] the draft law presented a Magna Carta of data protection and its scope was therefore deliberately wide so as to cover everything’.[1] MP Dr. Wernitz, of the socialist SPD party, observed that the draft accorded a special status to the Press in relation to the freedom of the press. He maintained that it might be useful to define more precisely what is meant by the notion ‘Press’ in either this legislative process or through the adoption of another legislative act, addressing more specifically the problems raised by the media in the context of data protection.[2]
In the Upper House’s Committee on Citizenship/Registration and Data Protection, the word ‘exclusive’ was added to the phrase ‘for publishing purposes’ in paragraph 2 upon request of the Bavarian member. This was aimed at mitigating the danger of circumvention of the data protection provisions by an unwarrantedly broad definition of what constitute ‘publishing purposes’.[3] In the Parliament’s Domestic Affairs Committee Working Group on Data Protection, MP Schweinoch suggested that the exemption of the Press should be dealt with in a special law. MP Gerster (CDU/CSU) agreed.[4] Parliamentary State Secretary Baum countered that a deletion of the Press exemption would be out of question as the ‘operability’ of the press in light of the data protection provisions proposed was in danger. Nonetheless, MP Gerster continued to criticise the formulation and considered it would protect the illegal collection of documents intended for publication. He argued that the publication of illegally collected data identifying individuals should constituted a breach of privacy rights. In its current formulation, the second sentence would encourage and privilege such an illegal collection of data, which would severely harm those affected.[5] Similarly, Member Haenschke of the SPD voiced his concern that second sentence would create a freedom that would be exploited by internal corporate newspapers or publications within organisations.[6]
The Parliamentary State Secretary subsequently suggested addressing such concerns by clearly defining the notion of ‘Press’. Member Haenschke observed that ‘freedom of the press’ could not mean that there are no individual rights when the press freedom was implicated. It should rather be possible to hold the Press accountable for the protection of an individual’s data. The Chairman of the Committee, Member Schäfer, pointed out that the maintenance of comprehensive data archives by some bodies of the Press would constitute a grave danger for the protection of individual rights. Member Gerster later proposed that while the data protection law would not generally apply to the Press, the law should at least make protective provisions for cases in which personally identifiable data stored by third parties which are used by or leaked to bodies of the Press to be excluded from the protections of the press freedom.[7]
Special Expression – Discussion in 1990s:
Pursuant to the commentary on the proposed new law, instead of the previous paragraph 1(3), a new provision was to be inserted, which, however, did not to result in material change for companies and auxiliary enterprises of the press and film industry as well as auxiliary enterprises of the broadcasting industry with regard to the processing or use of personal data. As before, the privilege only applied to data which were processed or used exclusively for their own journalistic and editorial purposes. However, if the data was also processed or used for other purposes, for example for passing on to third parties in press or broadcasting archives, it was not subject to the media privilege and therefore not subject to the journalistic exemption. The second sentence of the clause was supposed to make clear that pure address, telephone, branch or comparable directories were not opinion-forming journalistic and editorial use of personal data and therefore the so-called media privilege could not be applied to them.[8] Special provisions were included in this time which resulted in certain broadcasters being subject to highly qualified versions of the accuracy principle and right of subject access. However, no record of parliamentary discussion of these have been located. This may reflect the reality that this regime was essentially the result of principally interstate negotiations in which the federal level of government was not a principal actor. These negotiations resulted in the adoption of the first Interstate Treaty on Broadcasting which included similar provisions here on 31 August 1991.
Personal Exemption
In the original debates of the 1970s, the ‘generous’ exemption of non-automatic data processing for strictly private purposes from the provisions of the proposed law was mentioned in the debate. According to MP Gerster (CDU/CSU, Mainz), there was a danger in the non-public sphere ‘of pooling of data from different companies, of private investigators that collected and transmitted data, even false data, behind the back of the citizens. The citizen would not be informed pursuant to the proposed law and could therefore not defend himself’.[9] However, the debate did otherwise not seem to pick up on the exemption for processing for strictly private purposes. Rather, the provisions seem to address the processing of personal data by both natural and legal persons for their ‘own aims’ (see third section, paragraphs 22 et seq. on the processing of data by non-public bodies (‘Stellen’) for their own purposes).[10]
Knowledge Facilitation Framework
In 1990 in a meeting of the Subcommittee on Judicial Affairs a state delegate proposed the addition of a paragraph clarifying under which conditions documents stemming from legal proceedings and public prosecutions could be used for scientific purposes and this was accepted by a majority of the state delegates.[11] This proposal fed into the special provisions on knowledge facilitation which were adopted in section 40 of the amending law of 1991. These provisions inter alia set out general conditions for the admissibility of data processing or use for scientific research.[12] The terms ‘for scientific research work’, ‘for certain purposes of scientific research’ and ‘for certain research work’ used in the preamble were to constitute different levels of concretisation of the hierarchically understood purpose. In section 2 of the proposed paragraph, the comprehensive term ‘for scientific research’ was used, since it defined the entire scope of the regulation. Sections 1 and 3 of the proposed paragraph, which regulated the admissibility of the original processing or use for scientific research, contained a more concrete description, namely ‘for certain purposes of scientific research’, in order to take into account the principle of purpose limitation. The term ‘for specific research work’, which is also used, specifies this even further for cases in which the processing or use of the data for scientific research involved a change of purpose compared to the original purpose of storage without the consent of the data subject. This term therefore represented the lowest level and thus the narrowest purpose limitation.[13] These distinctions were, however, not carried forward and were thus not adopted.
Second-Generation Statutory Law
|
Germany new version of the Federal Data Protection Act (BDSG) formally implementing Directive 95/46 on 14 January 2003. A version of the Interstate Treaty on Broadcasting and Telemedia in force during this second-generation period is available here.
Special Expression Derogation
The German law stated that carried forward previous provisions exempting the the media from compliance with all the substantive data protection provisions in relation to their journalistic, editorial or literary purposes but also stated that they should be required to comply with organization and technical security measures and also be enabled to submit facilitating codes of conduct to supervisory authorities (Federal Data Protection Act (BDSG) 2003, s. 41(1)). However, under the Interstate Treaty on Broadcasting and Telemedia it was provided that broadcasting would be subject to a qualified version of the accuracy requirement found in the data quality principles and also subject access. The Treaty also established that the press would be similarly regulated when providing telemedia i.e. online services unless they subjected themselves to self-regulation under the Press Council’s Press Code and Complaints Procedure (Interstate Treaty on Broadcasting and Telemedia, art. 57). The new law carried forward the provisions on broadcasters subject to the federal law which were first adopted in the legal reform of 1990/91. However, rather than speaking abstracting of broadcasters under federal law, the new spoke specifically of Deutsche Welle, the German equivalent of the BBC World Service (Federal Data Protection Act (BDSG) 2003, ss. 41(2)-(3) and 42). Federal law did not set out any special expression derogations outside of the media context.
Broad Expression Derogation
No special provision.
Personal Exemption
Data collected, processed or used solely for personal or domestic activities was excluded from the scope of application of the Data Protection Act (Ibid, s. 1(2)).
Knowledge Facilitation Framework
German law exempted scientific research from compatibility and storage limitation principle if ‘necessary in the interest of a research institution for the purpose of scientific research, where the scientific interest in carrying out the research project significantly outweighs the data subject’s interest in ruling out the possibility of collection, and the purpose of the research cannot be achieved in any other way or would require disproportionate effort’ (Ibid, s. 28(2)(3)). The processing of sensitive data even without consent was allowed for scientific research if necessary so long as the scientific interest in carryout the project significantly outweighs the data subject's interest in ruling this out and achieving the purpose in any other way would at least required a disproportionate effort (Ibid, s. 13). No derogation was provided from the proactive direct and reactive transparency (subject access) rules. No exemption was granted from the export and the notification of processing conditions. Special provisions were enforced regarding the legitimating ground condition. Special restrictions also applied to market and opinion research. German law’s disproportionate effort limitation on the proactive indirect transparency rule was unusually limited to the purposes of scientific research (Ibid, s. 33(5)).
|
Parliamentary Debates
Special Expression Derogation
The German government explained the new media exemption as follows. The media exception
was designed as framework legislation within which the German Länder have to legislate. The scope of data protection has been extended with regard to ‘the rules of conduct for the promotion of application of data protection’ and partly with regard to responsibility and liability. At the same time, the scope of the media exemption had been extended. The processing of personal data for literary purposes was also covered.[14]
During the first reading in the Bundestag, Beatrix Philipp (CDU/CSU) expressed relief that an earlier mistrial draft from October 1999 (which however had apparently not reached Parliament) had been changed. That draft bill would have meant that the press would have ‘to wear a muzzle’ because a data protection officer would have been needed within every editorial board ensuring that personal data is handled appropriately. The important freedom of the press would have thus been close to being abolished.[15] Similarly, Jörg van Essen (FDP) welcomed the change pointing out that the ‘the original intention of the government cannot be found in the bill anymore which would have approached the freedom of the press in a completely insensitive way by putting journalist under the control of an internal data protection officer’.[16]
In the second reading, Dr. Edzard Schmidt-Jortzig (FDP) stated that the FDP would appreciate that the leeway left to the national legislator by the EU directive had been used with regard to the media.[17]
The Internal Affairs Committee (‘Innenausschuss’) suggested only minor changes with regard to the wording of the media exemption in its report for the Parliament, e.g. changing ‘processing (Verarbeitung)’ to ‘gathering (Erhebung)’.[18]
Personal Exemption
No relevant debates.
Knowledge Facilitation Framework
No relevant debates.
Third-Generation Statutory Law
|
Germany adopted a new Federal Data Protection Act which implemented the GDPR on 30 June 2017. The Interstate Treaty on Broadcasting and Telemedia was updated on 1 May 2019.
Special Expression Derogation
Under the Interstate Treaty for Broadcasting and Telemedia, Germany generally exempts the journalistic media from compliance with all of substantive data protection principles (para. 12). However, as regards the data accuracy principle it is established that if a data subject’s ‘Persönlichkeitsrechte’ (personal rights) are negatively affected by a broadcaster’s reporting, they can demand either its ‘Berichtigung’ (correction) or the addition of their ‘eigenen Darstellung von angemessenem Umfang’ (own statement of appropriate length) (para. 12(3)). The same legal requirements are placed on the Press when providing telemedia/online services but not when these actors agree to be subject to self-regulation by the German Press Council. These requirements are similarly of limited scope and applicability and also entirely ex post in nature (para. 23(2)). Journalism is, moreover, categorically excluded from the proactive transparency rules but certain minimal duties relating to reactive transparency (subject access) are set out. In sum, German law provides that where either a broadcaster or a Press operator providing telemedia/online services negatively affects a data subject’s ‘Persönlichkeitsrecht’ (personal rights), they may make a subject access request. However, information may be denied not only if it would enable conclusions to be drawn on either the persons involved in the preparation, production or dissemination or the editorial guarantor of contributions, documentations and communications but also if enabling exploration of the information would prejudice the journalistic task. Finally, the Press can avoid even these limited legally enforceable duties by agreeing to be subject to self-regulation by the German Press Council. In relation to the institutional media, the Interstate Treaty for Broadcasting and Telemedia explicitly establishes the priority of the special expression derogation over the Knowledge Facilitation Framework. As regards non-journalistic purposes of expression, federal law does not provide for any specific derogations. However, at least some of the Länder have adopted broader laws at local level. For example, the law of both Brandenburg (Brandenburgisches Datenshutzgesetz (BbgDSG) s 29) and Mecklenburg-Vorpommern (Mecklenburg-Vorpommern: Landesdatenshutzgesetz—DSG M-V, s 12) set out an exemption for not only journalistic but also artistic and literary expression. In contrast, the exemption within the law of the Rhineland-Palatinate (Landesmediengesetz (LMG) Rheinland-Pfalz, s 13) and Schleswig-Holstein (Landespressegesetz Schleswig-Holstein, s 10 and Staatsvertrag über das Medienrecht in Hamburg und Schleswig-Holstein, s 37) would appear to be confined only to the media.
Broad Expression Derogation
No special provision adopted.
Personal Exemption – see GDPR, art. 2(2)(c)
Knowledge Facilitation Framework – see also GPDR, art. 5(1)(b) (compatibility), art. 5(1)(e) (time limits) and art. 89(1) (appropriate safeguards)
The processing of special data as defined in article 9(1) GDPR is permissible for scientific and historical research as well as statistical purposes without the consent of the data subject where the interests of the controller substantially outweigh the data subject’s interests and appropriate measures are taken to safeguard these interests, including anonymization where and as soon as processing allows for it (unless this conflicts with the interests of the data subject). In the interim, information enablling attribution must be stored separately and combination only take place to the extend required for the research or statistical purpose. The Act specifically provides that personal data (special or otherwise) may (only) be published for these purposes with consent or if doing so is indispensable for the presentation of reserach findings on contemporary events (s. 27(4)). Arts. 15-16, 18 and 21 of the GDPR may be limited for scientific and historical research as well as statistical purposes if these rights render impossible or seriously impair achievement of these purposes and such limits are necessary to achieve these purposes (Federal Data Protection Act (BDSG), s. 27). Art. 15 does not apply if it is necessary for these purposes and compliance would involve disproportionate efforts. As regards public interest archiving, derogations are set out from Art 15 (subject to a unreasonable administrative effort threshold), Art 16 (subject to data subject being able to add own account to the files where disputes accuracy), Arts 18, 20 and 21 (so long as this is necessary and such rights would at least seriously impair achievement of the purposes) and Art 9 (subject to taking suitable and specific safeguarding measures, an indicative list being provided in s. 22(2))) (s. 28).
|
Parliamentary Debates
Special Expression Derogation
In the report and recommendation of the Committee for Interior and Home Affairs, the Committee asked the Federal Government to make a proposal for the implementation of Article 85 GDPR, which emphasized the need to balance privacy rights and freedom of expression without generally prioritizing one over the other. This balance, according to the Committee, should be based on and guided by German case law. It moreover called for an examination of ‘how the scope of possible restrictions on the applicability of Chapters II to IV of the GDPR in data processing to the exercise of the freedom of expression must be adjusted to minimise the risk of prior intimidation of publishers’.[19] The conservative CDU/CSU faction noted that action was required concerning the so-called media privilege ‘regarding bloggers’ but that action by the Federal Government was prevented from taking immediate action due to the priority of state law in the area of media regulation. The SPD faction went further in arguing that the mandate set out in Article 85 of the GDPR should be regulated at federal level in order to ensure that bloggers, photographers and freelance journalists were not (unduly) restricted as a result of data protection claims. The action called on the federal government to submit such a proposal to the Bundestag promptly.[20]In the parliamentary debates, the special expression derogation was not discussed in any detail. Saskia Esken of the SPD merely observed that there is a substantial legal insecurity as to the regulation of non-traditional media and that the Federal Government needed to urgently act in this regard. Dr Johannes Fechner (SPD) echoed this statement.[21]
Broad Exemption Derogation
No debates.
Knowledge Facilitation Framework
No debates.
[1] Bundestag, Parliamentary State Secretary of the Ministry of Interior, First Reading (Vol 85, Sessions 62-71, 1973) 4018-19 (translation).
[2] Ibid.
[3] Upper House, Committee on Citizenship/Registration and Data Protection (14 June 1973).
[4] Parliament, Domestic Affairs Committee (24 September 1975).
[5] Ibid.
[6] Ibid.
[7] Ibid.
[8] Deutscher Bundestag, Beschlussempfehlung und Bericht des Innenausschusses (4. Ausschuss) (29 May 1990) Drucksache 11/7235 http://dipbt.bundestag.de/dip21/btd/11/072/1107235.pdf (last accessed 4 March 2020).
[9] Deutscher Bundestag, ‘Niederschrift über die Sitzung des Innenausschusses am 24 September 1975’.
[10] Ibid.
[11] ‘Niederschrift über die Sitzung des Unterausschusses des Rechtsausschusses am Mittwoch, 18 Januar 1989’, it is unclear what happened to the proposal.
[12] Deutscher Bundestag, Beschlussempfehlung und Bericht des Innenausschusses (4. Ausschuss) (29 May 1990) Drucksache 11/7235 http://dipbt.bundestag.de/dip21/btd/11/072/1107235.pdf (last accessed 4 March 2020).
[13] Deutscher Bundestag, Beschlussempfehlung und Bericht des Innenausschusses (4. Ausschuss) (29 May 1990) Drucksache 11/7235 http://dipbt.bundestag.de/dip21/btd/11/072/1107235.pdf (last accessed 4 March 2020).
[14] Gesetzentwurf Bundesregierung (18 August 2000) BR-Drucksache 461/00, p. 73 http://dipbt.bundestag.de/doc/brd/2000/D461+00.pdf (last accessed 12 March 2021).
[15] 14th Deutscher Bundestag (27 October 2000) 128. Sitzung, p. 12391 http://dipbt.bundestag.de/doc/btp/14/14128.pdf#P.12370 (last accessed 12 March 2021).
[16] Ibid, p. 12393.
[17] 14th Deutscher Bundestag (6 April 2001) 165. Sitzung, p. 16184 http://dipbt.bundestag.de/doc/btp/14/14165.pdf#P.16166 (last accessed 12 March 2021).
[18] Beschlussempfehlung und Bericht Innenausschuss (4 April 2001) Durcksache 14/5793, p. 34 http://dipbt.bundestag.de/doc/btd/14/057/1405793.pdf (last accessed 12 March 2021).
[19] Deutscher Bundestag, ‘Beschlussempfehlung und Bericht des Ausschusses für Inneres und Heimat (4. Ausschuss) zu dem Gesetzentwurf der Bundesregierung’ (Drucksache 19/11181, 26 June 2019), p. 17 http://dipbt.bundestag.de/doc/btd/19/111/1911181.pdf (last accessed 28 August 2020).
[20]Ibid, pp. 24-25.
[21] Ibid.
Twitter
Email