《德國聯(lián)邦數(shù)據(jù)保護(hù)法》2015最新修訂版-BDSG2015

1、Federal Data Protection Act (Act)Unofficial ContentsBDSGDate of issue: 20.12.1990Full Quote:Federal Data Protection Act in the version published on 14 January 2003 (Federal Law Gazette I, p. 66), last amended by Article 1 of the Law of 25 February 2015 (Federal Law Gazette I, p. 162) has been change

2、dWas standing:Revised by Bek v 14.1.2003 I. 66th. Last amended by Art. 1 G v. 02.25.2015 I 162For details on the status information you can find in the menu under Noticesfootnote(+ Text detection from: 1.6.1991 +) The G was 20.12.1990 I decided in 2954 as Article 1 of G v by the Bundestag with the c

3、onsent of the Bundesrat.; 10 para. 4 sentence 3 and 4, according to the first day of the twenty-fourth calendar month following promulgation in the rest of the first day of the sixth calendar month following promulgation. Art. 6 para. 2 sentence 1 u. 2 G v. 20.12.1990 I 2954 came into force. The G w

4、as announced on 29.12.1990.Unofficial ContentsSite first section General and common provisions 1Purpose and Scope of the Law 2Public and non-public bodies 3Other definitions 3aData reduction and data economy 4Admissibility of data collection, processing and use 4aconsent 4bTransfer of personal data

5、abroad and to supranational and intergovernmental bodies 4cExceptions 4dReporting obligation 4eContent of the reporting obligation 4fCommissioner for Data Protection 4gTasks of the Commissioner for Data Protection 5Data secrecy 6Rights of the person concerned 6aAutomated individual decisions 6bObser

6、vation of publicly accessible areas with optic-electronic devices 6cMobile personal storage and processing media 7Damages 8thCompensation in the case of automated data processing by public bodies 9Technical and organizational measures 9aPrivacy Audit 10Establishment of automated retrieval procedures

7、 11Collection, processing or use of personal data on behalfSecond Section Data processing by public bodies First subsection Legal basis of the data processing 12scope of application 13Data collection 14Data storage, and use -change 15Transfer of data to public bodies 16Transmission of data to privat

8、e parties 17(repealed) 18Implementation of data protection in the Federal Administration Second subsection Rights of the person concerned 19Information to the person concerned 19aNotification 20Rectification, erasure and blocking of data; Right of appeal 21Appeal to the Federal Commissioner for Data

9、 Protection and Freedom of Information Third subsection Federal Commissioner for Data Protection and Freedom of Information 22Election of the Federal Commissioner for Data Protection and Freedom of Information 23Legal status of the Federal Commissioner for Data Protection and Freedom of Information

10、24Monitoring by the Federal Commissioner for Data Protection and Freedom of Information 25Complaints by the Federal Commissioner for Data Protection and Freedom of Information 26Further duties of the Federal Commissioner for Data Protection and Freedom of InformationThird Section Data processing non

11、-public bodies and public service competitive companies First subsection Legal basis of the data processing 27scope of application 28Data collection and storage for its own business purposes 28aTransfer of data to credit bureaus 28bScoring 29Commercial data collection and storage for the sending 30C

12、ommercial data collection and storage for the sending anonymous 30aCommercial data collection and storage for the purpose of market or opinion research 31Special earmarking 32Data collection, processing and use for purposes of employment Second subsection Rights of the person concerned 33Notificatio

13、n of the person concerned 34Information to the person concerned 35Rectification, erasure and blocking of data Third subsection Authority 36 and 37(repealed) 38Authority 38aCode of conduct to promote the implementation of data protection provisionsSection Four Special provisions 39Limited use of pers

14、onal data subject to professional or special official secrecy 40Processing and use of personal data by research institutes 41Collection, processing and use of personal data by the media 42Data Protection Officer of Deutsche Welle 42aDisclosure in case of unlawful obtaining knowledge of dataSection F

15、ive Final Provisions 43Fines 44Criminal provisionsSection Six Transitional provisions 45Current uses 46Continued validity of definitions 47Transitional arrangements 48Federal Government ReportConditioning ( 9 sentence 1)Section One General and common provisionsUnofficial Contents 1 Purpose and Scope

16、 of the Law(1) The purpose of this Act is to protect individuals from that he is affected by the handling of their personal data in his personal rights.(2) This Act applies to the collection, processing and use of personal data by1.public bodies of the Federation,. 2public authorities of the countri

17、es to the extent the Notice is not governed by state law and provided that theya)Execute federal law orb)as organs of justice act and it does not concern administrative matters,. 3private parties, so far as they process the data using data processing systems, use or collect it or process, use or col

18、lect it, unless the collection, processing or use of the data are only for the data to or from non-automated files personal or family activities.(3) As far as other legislation of the Federal apply to personal data including their publication, they take precedence over the provisions of this Act. Th

19、e obligation to respect the legal confidentiality obligations or of professional or special official confidentiality not based on legal regulations remains unaffected.(4) The provisions of this Act take precedence over those of the Administrative Procedure Act, in so far as in determining the facts

20、personal data are processed.(5) This Act shall not apply unless a charge in another Member State of the European Union or in another signatory to the Agreement on the European Economic Area establishment situated site collects personal data in Germany, processes or uses, unless this is done by a est

21、ablishment domestically. This Act shall apply unless a responsible entity that is not situated in a Member State of the European Union or in another signatory to the Agreement on the European Economic Area, collects personal data in Germany, processes or uses. Insofar as the responsible entity under

22、 this Act is to be mentioned, also provide information on domestic-based representatives are to make. Sentences 2 and 3 do not apply if disks are used only for the purpose of transit through the country. 38 para. 1 sentence 1 remains unaffected.Unofficial Contents 2 Public and private parties(1) Pub

23、lic bodies of the Federation are the authorities, the administration of justice and other public-law institutions of the Federation, the federal corporations, institutions and foundations under public law as well as their associations irrespective of their legal form. As public bodies that emerged f

24、rom the special fund German Federal Post Office by law companies apply as long as they have an exclusive right under the Postal Act.(2) Public authorities of the country, the authorities, the administration of justice and other public law institutions of a Land, a municipality, an association of mun

25、icipalities and other supervision of the country under standing of legal entities of public law as well as their associations irrespective of their legal form.(3) private-law associations of public authorities of the federal and state governments, carry out the tasks of public administration, apply

26、notwithstanding the participation of non-public entities as public bodies of the Federation, if1.they operate over the range of a country or addition. 2the federal government is one of the absolute majority of the shares or the absolute majority of the votes entitled to.Otherwise, they are considere

27、d public bodies of the countries.(4) Non-public bodies, natural and legal persons, companies and other associations of persons of private law as they do not fall under paragraphs 1 to. 3 Takes a private body performs sovereign public administration duties, it is the extent of public authority within

28、 the meaning of this Act.Unofficial Contents 3 Other definitions(1) Personal data is specific information about personal or factual circumstances of an identified or identifiable natural person (data subject).(2) Automated processing is the collection, processing or use of personal data using data p

29、rocessing equipment. A non-automated file is not any automated collection of personal data which is similarly structured and which by its characteristics is available and can be evaluated.(3) data collection is the acquisition of data on the person concerned.(4) processing, the storage, modification

30、, transfer, blocking and deletion of personal data. Specifically, regardless of the procedures applied:1.Save capturing, recording or preservation of personal data on a disk for the purpose of their further processing or use,. 2Changing the content Remodel stored personal data,. 3Submitting the anno

31、unce stored or obtained by data processing of personal data to a third party in such a way thata)the data is passed to the third party orb)the third parties for inspection or held ready for retrieval data, or retrieves,. 4Lock to restrict the marking of stored personal data of their further processi

32、ng or use,. 5Delete the deletion of stored personal data.(5) Make each use of personal data to the extent it does not concern processing.(6) make anonymous the change of personal data is such that the details of personal or material circumstances can no longer or only be associated with a disproport

33、ionate investment of time, cost and labor of an identified or identifiable natural person.(6a) Pseudonymisation is to replace the name and other identification features of an indicator for the purpose preclude the determination of the person concerned or substantially more difficult.(7) Responsible

34、party is any person or body, collects personally identifiable information for yourself, processes or uses or this can make other commissioned.(8) receiver is a person or body to whom data. Third is any person or body other than the controller. Third parties are not the person or persons or bodies th

35、at collect, process or use within the country, in another Member State of the European Union or in another signatory to the Agreement on the European Economic Area personal data on behalf.(9) Special types of personal data are data concerning racial or ethnic origin, political opinions, religious or

36、 philosophical beliefs, trade union membership, health or sex life.(10) Mobile personal storage and processing media are media,1.which are issued to the person concerned,. 2on which personal data about the storage addition can be processed automatically by the issuing body or another body,. 3where t

37、he person concerned, this processing can influence only through the use of the medium.(11) employees are:1.Workers,. 2to their VET employees,. 3Participants at services for participation in working life as well as clarifications of professional qualification or testing work (in need of rehabilitatio

38、n and rehabilitation). 4in recognized workshops for the disabled employees,. 5after the Youth Volunteer Service Act employees,. 6Persons who are to be regarded as workers like people because of their economic dependence; These include the cottage industry workers and assimilated,. 7Applicants for an

39、 employment relationship and persons whose employment relationship has ended,8th.Officials, civil servants, judges of the Federal, soldiers and civilian service.Unofficial Contents 3a Data reduction and data economyThe collection, processing and use of personal data and the selection and design of d

40、ata processing systems shall be benchmarked against the goal, so to raise little personal data as possible to process or use. In particular, personal data must be anonymized or pseudonymized, to the extent possible on the intended use and does not require disproportionate in relation to the desired

41、level of protection effort.Unofficial Contents 4 Admissibility of data collection, processing and use(1) The collection, processing and use of personal data is permitted only if this law or another law permits or orders or the individual has consented.(2) Personal data shall be collected from the pe

42、rson concerned. Without his involvement, they may only be collected when1.a legal provision prescribes or peremptorily presupposes or. 2a)the administrative task to be fulfilled by their nature or the business purpose requires a survey of other persons or entities, orb)bringing the person concerned

43、would involve a disproportionate effortand there are no indications that overriding legitimate interests of the person concerned will be affected.(3) If personal data are collected from the data subject, so he is, unless he has already attained otherwise learned, over by the party responsible1.the i

44、dentity of the responsible body,. 2the purpose of the collection, processing or use, and. 3the categories of beneficiaries only if the data subject does not have the expected submission of these to the circumstances of the individual case,to teach. If personal data are collected from the party conce

45、rned, whether by law, the obligation to provide information, or is providing the information requirements for the granting of legal benefits, then it is the person, otherwise draw attention to the voluntary nature of his allegations. Unless the circumstances of the case required or upon request, he

46、must be informed of the law and the consequences of denial of information.Unofficial Contents 4a consent(1) The consent is effective only if it is based on the free decision of the person concerned. He is, so far as to indicate the intended purpose of the collection, processing or use, as well as to

47、 the circumstances of the case required or upon request, to the consequences of withholding consent. The consent must be in writing, unless a different form is appropriate due to special circumstances. If consent is in writing, together with other statements, it is particularly noteworthy.(2) In the

48、 area of scientific research, a special circumstance within the meaning of paragraph 1, sentence 3 is present even if the specific research purpose would be significantly affected by the writing. In this case the information pursuant to paragraph 1 sentence 2 and the reasons giving rise to substanti

49、al impairment of the defined purpose of research should be documented.(3) As far as special categories of personal data ( 3 para. 9) is collected, processed or used, the consent must also explicitly refer to this data.Unofficial Contents 4b Transfer of personal data abroad and to supranational or in

50、tergovernmental bodies(1) For the transfer of personal data to bodies1.in other Member States of the European Union,. 2other parties to the Agreement on the European Economic Area or. 3the institutions and bodies of the European Communitiesapply 15 para. 1, 16 para. 1 and 28 to 30a in accordance wit

51、h the rules applicable to such transmission laws and agreements, as far as the transmission in the context of activities carried out, in whole or in part within the scope of the law of the European Communities fall.Paragraph 1 in accordance with (2) applies to the transfer of personal data to bodies

52、 referred to in paragraph 1 that are not made in the context of activities which fall wholly or partly within the scope of the law of the European Communities, as well as to other foreign or supranational or government entities , The transmission shall, if the data subject has a legitimate interest

53、in excluding such transmission, particularly when the assessments mentioned in sentence 1 Set an adequate level of data protection is not guaranteed. Sentence 2 shall not apply if the transmission for its own account by a public authority of the federal exceeded for compelling reasons of defense or

54、the performance or intergovernmental commitments in the field of crisis management or conflict prevention or for humanitarian action is required.(3) The adequacy is assessed taking into account all the circumstances that are at a data transfer operation or set of data transfer is important; in parti

55、cular, the nature of the data, the purpose, the duration of the intended processing, the country of origin and country of final destination, the rules applicable to the beneficiary in question as well as the legal standards applicable to him professional rules and security measures are used.(4) In t

56、he cases of 16 para. 1 no. 2 the supplying body shall inform the person of the transmission of his data. This does not apply if it can be expected that he becomes aware of it in some other way, or if the disclosure would jeopardize public safety or otherwise be detrimental to the Federation or a Lan

57、d.(5) Responsibility for the permissibility of the transmission transmits the forwarding authority.(6) The body to which the data is transmitted is to draw attention to the purpose of the fulfillment of the data are disclosed.Unofficial Contents 4c Exceptions(1) Within the scope of activities which fall wholly or partly within the scope of the law of the European Communities, is a transfer of personal data to authorities other than in 4b, para. 1 points referred to, even if you have an adequate level of data prote