Need for action in 2017: The age of the EU General Data Protection Regulation is getting closer
> December 2016

The EU General Data Protection Regulation (GDPR) will from May 2018 onwards be a directly applicable law in all member states of the European Union. Companies are therefore required to check their data protection organisation, contracts, declaration and concepts of consent by then and adapt them to the new regulations. There is need for action for all European companies as the regulations for data protection have to be adhered to no matter what the size of the company is. On top of that, in Germany the appointment instructions for a data protection officer (DPO) are likely to be adopted unchanged. A violation of the appointment obligation is subject to a penalty.

On 11 November 2016, the German Federal ministry of the interior presented a draft law for the adjustment of the German Federal data protection act to the GDPR according to which companies are obliged to appoint a DPO if they normally employ at least ten people for the processing of personal data. The possibility to access a company email account already means the person is permanently handling personal data so that the appointment obligation will apply for almost all companies with more than ten employees. This equals the presently valid regulations in the German Federal data protection law.

According to GDPR, companies will from 2018 be obliged to publish the contact data of their DPO and inform the supervisory authority of it. Therefore, the supervisory authority has one simple possibility of control: Companies with more than ten employees which do not disclose the contact data of their DPO have to expect inquiries from the supervisory authority and in the worst case fines. In those cases, it is recommended to the companies to use the year 2017 for preparations for the data protection regulations effective from May 2018 to avoid unpleasant surprises.