Germany: BfDI issues statement on potential breach in connection with online questionnaires for 2022 census
The Federal Commissioner for Data Protection and Freedom of Information ('BfDI') issued, on 18 May 2022, information on the online questionnaire of the Federal Statistical Office for the 2022 census. In particular, the BfDI stated that after an initial check, it had determined that there was no risk to the data entered on the census website, however, it noted that the review of the website is not yet complete. More specifically, the BfDI detailed that, on 12 May 2022, it had become aware of a potential personal data breach in connection with an online questionnaire for the 2022 census which it feared took place through the involvement of a US IT service provider that could have made the personal data transmitted therein accessible to unauthorised persons.
Notably however, the BfDI's inspection showed that there was no risk to the personal data entered in the questionnaire. Nonetheless, the BfDI noted that whether the transmission of metadata when the page was accessed, such as the date and time of calls, amount of data transferred, references to origin and IP address etc., is lawful is still the subject of the ongoing review. Additionally, the BfDI stated that it had intervened to ensure a change was made to the website so that the IT provider is no longer used in connection with the questionnaire, and therefore transmission of metadata no longer takes place.
You can read the press release, only available in German, here.