Germany: focus on the HR impact of the European General Data Protection Regulation (GDPR) and the new Federal Law on data protection in German companies (Part One)

A longstanding tradition. Germany has a long history in terms of data protection. Created in 1977 the Federal law on data protection (Bundesdatenschutzgesetz – BDSG) has seen several rewrites, most notably in 2009 after a series of scandals over employee spying rocked well-known companies (c.f. article No. 080275). At that time the scandals relaunched a debate on the need to formulate a data protection law attuned to the world of work, something that trade unions had been calling for throughout the 1980s. However since the EU was already involved in delivering data protection regulations, the German legislator opted to wait until this was completed. On 25 May 2016 the new General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) officially came into effect with a two-year additional delay for companies to assess their own data protection systems and get them fit to comply with the EU regulation (c.f. articles No. 9700 and No. 9422). Christian Kuß recalls that ‘This is a European law that applies directly across all the EU Members States, in contrast with the Directive that it will be replacing.”