On January 31, 2023, the German Data Protection Conference (DSK) - the joint body of independent German federal and state data protection authorities (collectively, the German DPAs) - issued a decision on extraterritorial access by public authorities from third countries outside the EEA (only available in German here).

Valentino Halim, Senior Associate from WilmerHale, unpacks the main provisions of the DSK decision, giving insight into its scope and implications.

In the summer of 2022, the German data protection authorities (collectively, 'the German DPAs') initiated a coordinated audit campaign of the standard contracts of major web hosts. For the campaign, they have developed a checklist for auditing data processing agreements. For companies, this provides valuable guidance for concluding data processing agreements in practice, even outside of ongoing audit procedures.

Valentino Halim, Senior Associate from Wilmer Hale, unpacks the audit campaign of the German DPAs, with a particular focus on the checklist for examining data processing agreements, its scope, limitations, and potential.

On 4 March 2022, the Baden-Württemberg data protection authority ('LfDI Baden-Württemberg') published its frequently asked questions ('FAQs') on cookies and tracking by website operators and smartphone app developers. The FAQs are meant to complement the German Data Protection Conference's ('DSK') guidelines ('the Guidelines') on the new Federal Act on the Regulation of Data Protection and Privacy in Telecommunications and Telemedia of 23 June 2021 ('TTDSG'), published in December 2021.¹ Unlike the Guidelines, the FAQs of the LfDI Baden-Württemberg specify the application of the legal requirements in greater detail. The FAQs contain a 16-page list of negative examples for obtaining consent that indicate a very strict interpretation of the requirements of the TTDSG and the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR').

Dr Carlo Piltz and Philip Schweers, from Piltz Legal, illustrate and discuss some of these examples, whilst also taking a look at recommendations for the use of cookies without obtaining consent.

According to the conception of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), data protection officers ('DPOs') play an important role in the protection of personal data. Their activity serves a regulated self-control of the controller or processor, the advantage of which lies not least in the relief of public authorities. Their appointment is mandatory for all public and many private entities. The activity of a DPO requires knowledge of data protection law and includes providing advice on data protection issues. In Germany, however, the provision of legal services is regulated, among other things, by the German Act on Out-of-Court Legal Services¹ ('RDG'). It is questionable whether this also imposes special requirements on the DPO. Stefan Hessel, Attorney-at-Law and Co-Head of Digital Business Unit at reuschlaw Legal Consultants, sheds light on the topic.

On 20 December 2021, the German Data Protection Conference ('DSK') published the long-awaited guidelines ('the Guidelines') on the new Federal Act on the Regulation of Data Protection and Privacy in Telecommunications and Telemedia of 23 June 2021 ('TTDSG'). The Guidelines consider both the provisions of the TTDSG, which has been applicable since 1 December 2021, and those of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'). Within the Guidelines, the German authorities provide companies with a clearer picture on the most relevant questions around the usage of cookies and similar technologies. There is currently a public consultation going on and it is likely that there will be some form of additions, specifications, and possibly also small changes to the current version.

In part one of a two-part series, Philipp Quiel, Counsel at Piltz Legal, provides an overview on the DSK's opinions regarding the scope of applicability, legal basis, explicit requests, and strict necessity under the TTDSG. Part two covers consent and next steps for companies.