GermanySocial Code Book V, Genome Sequencing Model Project: Pseudonymized Data Access and Ban on Establishing a Personal Reference
Fünftes Buch Sozialgesetzbuch (SGB V), § 64e Abs. 11a und 11b
In force since .
A de-identification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- If you are the platform operator, provide pseudonymized individual records only for processing under your control, only to persons bound to secrecy or committed to it beforehand, and only with measures that prevent the data from being copied (SGB V Section 64e, paragraph 11a).
- If you use data made accessible under the genome sequencing model project, use it only for the purposes for which it was made accessible and do not pass it to third parties unless the platform operator approves (Section 64e, paragraph 11b, sentence 1).
- Take care not to establish a reference to persons or care providers when you process the data, and report a reference established by accident to the platform operator without delay (Section 64e, paragraph 11b, sentences 4 and 5).
- Do not intentionally process the data to establish a personal reference, to identify care providers or to gain knowledge of third parties' trade secrets, except for the case identification by the trust centre that paragraph 9c names (Section 64e, paragraph 11b, sentences 6 and 7).
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Passing the data on to third parties contrary to Section 64e(11b) sentence 1 number 2 is punishable under Section 399(1) number 1 by imprisonment of up to one year or a fine, and under Section 399(2) by imprisonment of up to two years or a fine where the offender acts for payment or to enrich or harm another; Section 399(3) makes the offense prosecutable only on complaint. Section 399(1) number 2 punishes processing contrary to Section 64e(11b) sentence 5, which is the duty to report an unintended reference to persons or care providers; the ban on intentionally processing the data to establish a personal reference is sentence 6, which number 2 does not name.
What record it asks for
Logging duty
The provisions state no duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
The platform operator provides pseudonymized individual records only for processing under its own control, only to persons bound to secrecy, and only with measures that prevent copying of the data. A user of the data may use it only for the purposes for which it was made accessible and may not pass it to third parties unless the platform operator approves. The user must take care not to establish a reference to persons or care providers when processing the data.
A reference to persons or care providers that is established by accident must be reported to the platform operator without delay. Intentionally processing the data to establish a personal reference, to identify care providers or to gain knowledge of third parties' trade secrets is prohibited. The prohibition does not apply to the case identification by the trust centre that paragraph 9c sentence 7 number 1 names.
Passing the data on to third parties contrary to paragraph 11b sentence 1 number 2 is punishable by imprisonment of up to one year or a fine.
When LexLint raises it
When your app profile says your app handles health records, processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .