Author Description

La préface indique: ""What is the data privacy law in Europe?"--Is perhaps one of the most frequently asked questions that lawyers face when supporting data privacy clients in an international context. Through the implementation of its directive 95/46/EC, the European Union, at least, has attempted to ensure the harmonisation of the data privacy frameworks of its member states - a harmonisation which, even today, is far from having been achieved. The question, as it relates to Germany, must therefore at least for now and for the foreseeable future continue to be "What is the data privacy law in Germany?". Due to the principle of territoriality in European data protection law, even companies or other entities not based in Germany are faced with Germany's implementation of the EU data protection framework. Companies that are not based within the European Union (EU) or the area of the European Economic Area (EEA) have to adhere to German data protection law if they intend to collect, process or use personal data in Germany. The same applies to companies within the EU or the EEA if they intend to render a specific data processing operation through a subsidiary based in Germany. In addition cross-border data transfer becomes more and more important - the requirements that apply to such operations are relevant to many types of outsourcing, centralisation across legal entities, functional transfers, and all off-shoring activities. While these kinds of activities are most commonly associated with international groups of companies, any small or mid-sized business could face the same compliance requirements. Compliance with these requirements cannot be achieved unless those entities, respectively the persons entrusted with data protection and secrecy within these entities, are familiar with the complex legal framework of German data protection. This, however, poses difficulties even for Germen experts - especially because of the fragmented and dense set of rules and regulati