GermanyFederal Data Protection Act, Transfers by Law Enforcement Bodies to Third Countries and International Organizations
Bundesdatenschutzgesetz (BDSG), §§ 78 bis 81
In force since .
A cross border transfer rule binding government bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- If you are a public body responsible for preventing, investigating or prosecuting criminal or administrative offenses, transmit personal data to a body in a third country or an international organization competent for those purposes only if the European Commission has adopted an adequacy decision, and refrain where the recipient's handling is not sufficiently secured or overriding interests of the data subject conflict (BDSG Section 78, paragraphs 1 and 2).
- Where there is no adequacy decision, transmit only if a legally binding instrument provides appropriate safeguards or you conclude from all circumstances that they exist, document the transmissions based on your own assessment (time, recipient, reason, data), and inform the Federal Commissioner of them at least annually (Section 79, paragraphs 1 to 3).
- Where there is neither an adequacy decision nor appropriate safeguards, transmit only in the cases Section 80, paragraph 1 lists, and refrain if the data subject's fundamental rights outweigh the public interest (Section 80, paragraphs 1 and 2).
- Transmit directly to a body in a third country that is not competent for those purposes only in a particular individual case, where strictly necessary and the conditions of Section 81, paragraph 1 are met, inform the competent bodies without delay, and bind the recipient to use the data only for the purpose of transmission (Section 81, paragraphs 1, 2 and 4).
These lines are LexLint's reading of the law's text.
What record it asks for
Who may demand the log
Regulator
Logging duty
The controller must document each transmission it bases on its own assessment of safeguards, recording the time, the recipient, the reason and the data transmitted, and must make the documentation available to the Federal Commissioner on request.
- Kind
- Explicit
- As of
- Provision
- BDSG Section 79, paragraph 2
- Trigger
- personal_data_processing
What this law does
Part 3 of the Act applies to public bodies responsible for preventing, investigating, detecting, prosecuting or punishing criminal or administrative offenses when they process data for those tasks. Such a body may transmit personal data to bodies in third countries or to international organizations competent for those purposes if the European Commission has adopted an adequacy decision under Directive (EU) 2016/680.
Even with an adequacy decision the transmission must not take place if, in the individual case, handling of the data by the recipient that is appropriate under data protection law and respects fundamental human rights is not sufficiently secured, or overriding interests of the data subject conflict.
Without an adequacy decision, transmission is also permitted where a legally binding instrument provides appropriate safeguards or the controller concludes from all circumstances that appropriate safeguards exist. The controller must document transmissions based on its own assessment of safeguards, recording the time, the recipient's identity, the reason and the data transmitted.
The controller must inform the Federal Commissioner at least annually of transmissions based on its own assessment of safeguards. Without an adequacy decision or safeguards, transmission is permitted only in the listed cases, such as protecting a person's vital interests or averting a present and substantial threat to a state's public security. The controller must refrain from such a transmission if the data subject's fundamental rights outweigh the public interest in it.
A controller may transmit data directly to a body in a third country that is not competent for those purposes only in a particular individual case, where strictly necessary and on the three conditions the paragraph lists.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .