GermanyBundesdatenschutzgesetz (BDSG), Section 30(2) to (5), (8) and (9), Consumer Credit Databases
Bundesdatenschutzgesetz (BDSG), § 30 Abs. 2 bis 5, 8 und 9
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- This law takes effect on (Article 16(1) of the Act of ), so the duties below do not bind before that day.
- If you run a credit information database (an Auskunftei) that commercially collects, stores or alters consumers' personal data in order to pass it on, answer information requests on general consumer loans only from lenders that are supervised by the competent financial authority and guarantee full compliance with Regulation (EU) 2016/679 (section 30(2)).
- Make sure your database holds at least consumers' payment arrears on loans, the kind of loan and the identity of the lender; tell the consumer within 30 days of entering an arrears record, and tell them of their rights under Regulation (EU) 2016/679 (section 30(3)).
- Keep procedures that ensure the information in your database is current and accurate, and procedures that make it easier for consumers to complain about the content of your databases, including the data that third parties can obtain from them (section 30(4) and (8)).
- If you lend or arrange general consumer loans, do not process special categories of personal data under General Data Protection Regulation (GDPR) Article 9(1), or personal data from social networks, that may be contained in those databases (section 30(5)).
- These duties also bind providers and intermediaries of the corresponding financing aids under section 506 of the Bürgerliches Gesetzbuch (section 30(9)).
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
What record it asks for
Logging duty
Section 30(2) to (5), (8) and (9) set disclosure, content, accuracy, notice and complaint duties; none requires anyone to keep or produce a log or record.
- Kind
- None
- As of
What this law does
Article 3, point 2, of the Act of replaces paragraph 2 of section 30 of the Bundesdatenschutzgesetz with new paragraphs 2 to 9, and the Act takes effect on . The Act of was issued in Federal Law Gazette part I number 139 on .
Section 30(1) of the Bundesdatenschutzgesetz, which the Act leaves unchanged, applies to a body that commercially collects, stores or alters personal data usable for assessing the creditworthiness of consumers, in order to transmit it. Under the new paragraph 2, such a body may answer only the information requests of lenders of general consumer loans that are supervised by the competent financial authority and guarantee full compliance with Regulation (EU) 2016/679.
Under the new paragraph 3, the databases of such a body that hold information on general consumer loan agreements must hold at least information on consumers' payment arrears, the kind of loan and the identity of the lender. The operating body must also inform the consumer of an entry of arrears in a database within 30 days of the entry, and of the consumer's rights under Regulation (EU) 2016/679.
Under the new paragraph 4, such a body must have procedures to ensure that the information in its database is current and accurate. Under the new paragraph 5, lenders and credit intermediaries of general consumer loans may not process special categories of personal data, or personal data from social networks, that may be contained in those databases.
Under the new paragraph 8, such a body must have procedures that make it easier for consumers to complain about the content of its databases, including the data that third parties can obtain from them. Under the new paragraph 9, paragraphs 1 to 8 also apply to the providers and intermediaries of the corresponding financing aids under section 506 of the Bürgerliches Gesetzbuch.
When LexLint raises it
When your app profile says your app is a lender or processes personal data.
Back to the example · Lint your app
Page updated .