Information Technology- Germany

In August 2006 the German legislature enacted the First Act on the Reduction of Bureaucratic Obstacles, which amends the Federal Data Protection Act. Under the amended act, companies are obliged to appoint a data protection officer if at least 10 people handle the automatic processing of personal data on behalf of the employer (under the old law, five persons were sufficient to trigger this requirement). Where personal data is processed manually rather than automatically (ie, using hard-copy archives), the threshold has been set at 20 people. However, anyone who is assigned data processing tasks on a temporary basis and external entities which are commissioned to handle personal data do not count towards this threshold.

Entities which previously had to appoint a data protection officer but do not trigger the new threshold can, in principle, withdraw the appointment. However, in case of an internal data protection officer, the feasibility of such withdrawal must also be verified from a labour law perspective, taking into consideration any relevant provisions of the employment contract.

Furthermore, the new provisions of the act entitle any data protection officer to obtain advice on specific data protection issues from the Data Protection Authority. In practice, this may well support the data protection officer's understanding of a company's options. However, at the same time, companies must be careful to ensure that the data protection officer does not share premature or incorrect information with the authority.

International Law Office