GermanyGDPR Article 82, BDSG Sections 41-43, and BfDI and Landesdatenschutzbehörden Enforcement in Germany
Regulation (EU) 2016/679, Arts. 82-83; Bundesdatenschutzgesetz (BDSG) §§41-43
In force since .
An enforcement supervision rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, under General Data Protection Regulation (GDPR) Article 82.
These lines are LexLint's reading of the law's text. Also read by: Case C-300/21 UI v Österreichische Post AG, judgment of (Third Chamber) (recorded ).
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
BDSG Section 42 creates two federal criminal offences layered on top of the GDPR's purely administrative fines. Section 42(1): knowingly and without authorisation transmitting to a third party, or otherwise making accessible, not-generally-accessible personal data of a large number of people, done commercially, carries imprisonment of up to three years or a fine. Section 42(2): processing not-generally-accessible personal data without authorisation, or obtaining it by false pretences, done for payment or with intent to enrich oneself or another or to harm another, carries imprisonment of up to two years or a fine. Both offences are prosecuted only on complaint (Section 42(3)), and only the data subject, the controller, the Federal Commissioner for Data Protection and Freedom of Information (BfDI), or the competent supervisory authority may bring one.
Penalty structure
GDPR Article 83(5) sets the higher administrative-fine tier a German Land data protection authority applies, up to EUR 20,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher, for the gravest infringement categories. The narrower Article 83(4) tier, up to EUR 10,000,000 or 2 percent, applies instead to the controller and processor obligations in Articles 25 to 39. BDSG Section 43 layers a separate, much narrower national administrative fine on top of this EU-wide ceiling: mishandling a credit-information request under BDSG Section 30(1), or failing to properly or timely inform a consumer under Section 30(2) sentence 1, is a Germany-specific administrative offence (Ordnungswidrigkeit) carrying a fine of up to EUR 50,000, and Section 43(3) exempts public authorities and other public bodies from this fine entirely. Section 41 applies the Ordnungswidrigkeitengesetz's general administrative-offence procedure to GDPR Article 83(4) to (6) violations, with three of its provisions (Sections 17, 35 and 36 OWiG) disapplied.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Germany has a split structure. Under BDSG Section 40(1), the data protection authority of each of the 16 Laender supervises GDPR compliance by private-sector bodies (nichtoeffentliche Stellen) established or operating in that Land; there is no single national private-sector regulator. The Federal Commissioner for Data Protection and Freedom of Information (BfDI) instead supervises federal public bodies and specific federally regulated sectors (telecommunications and postal services) under separate provisions (BDSG Section 9 and Postgesetz Section 71). The Laender authorities and the BfDI coordinate through the Datenschutzkonferenz (DSK), a non-statutory conference, rather than a single hierarchical regulator.
Settledness
In its judgment of (VI ZR 10/24) on Article 82(1) of Regulation (EU) 2016/679, the Bundesgerichtshof said it would have no legal objection to compensation of around EUR 100 for the loss of control as such, in a case like the Facebook scraping case before it.
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0300
- Case citation
- Case C-300/21 UI v Österreichische Post AG, judgment of (Third Chamber)
- Open questions
- Which German rules on the extent of financial compensation apply to an award for non-material damage under Article 82(1), given that the Court of Justice in Case C-300/21 leaves that extent to the domestic rules of each Member State, subject to the principles of equivalence and effectiveness?
- Does the Bundesgerichtshof's assessment of about EUR 100 for loss of control alone, in the Facebook scraping facts of its judgment of (VI ZR 10/24), carry over to loss of control through a different kind of personal data or a different kind of incident under Article 82(1) of Regulation (EU) 2016/679?
What it makes you log
Logging duty
GDPR Article 82 gives a right to compensation and BDSG Sections 41 to 43 set procedure, offences and fines; none of them requires a log or record. Regulator powers to demand records sit in BDSG Section 40 and GDPR Article 58, outside the provisions this instrument cites.
- Kind
- None
- As of
What this law does
The Datenschutzkonferenz consists of the independent data protection authorities of the federation and the Laender. BDSG Section 42 adds criminal offenses, punishable by imprisonment of up to three years or a fine, for knowingly passing on or making available non-public personal data of a large number of people without authorization and on a commercial basis. Article 82 gives any person who has suffered material or non-material damage a right to compensation from the controller or processor.
In Case C-300/21, the CJEU held that Article 82(1) precludes a national rule or practice that makes compensation for non-material damage subject to the damage reaching a certain degree of seriousness.
In Case C-319/20 (Verbraucherzentrale Bundesverband v Meta Platforms Ireland), the CJEU held that Article 80(2) does not preclude national legislation allowing a consumer protection association to bring proceedings without a mandate from a data subject, on the basis of a breach of consumer protection law.
Under Section 4(1) of the Verbraucherrechtedurchsetzungsgesetz (VDuG), a qualified body's representative action is admissible only if it shows that the claims of at least 50 consumers may be affected by a redress action, or that the claims or legal relationships of at least 50 consumers may depend on the declaratory aims.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .