IAPP Country Leader for the DACH Region Ulrich Baumgartner recently caught up with Bavarian Data Protection Authority Michael Will to discuss the current state of data protection enforcement in Germany, particularly as to whether there is a chance that the 16 Länder, or states, would ever be consolidated with a centralized, federal DPA.
The Privacy Advisor: What is the current state of discussion regarding a centralized data protection body for Germany’s non-public actors?
Will: Currently, I am under the impression this is a discussion by and among experts but from different areas. In addition to the Data Ethics Commission and its members — several of whom are well-known figures in the European data protection family — I believe conservative economic politicians and some representatives from the young field of digital policy are currently concerned with the question of whether the German structure of data protection supervision is still up-to-date and adequate for the respective objectives.
Unfortunately, I do not see any real discussion between pro and contra representatives, between reformers and defenders, nor do I see any concrete concepts that could be examined and evaluated.
All in all, we are at the beginning of a debate in which we are preoccupied with some people's doubts as to whether the (EU General Data Protection Regulation), which has now been in effect for two and a half years, and our very special, perhaps even unique supervisory structure in Germany are in harmony with each other.
The Privacy Advisor: From your perspective, what are the pros and cons of the centralization of DPAs?
Will: Proponents of centralization, no matter what the policy area and whether at the national or European level, often and gladly argue for efficiency, standardization and assertiveness. But the counter position on this abstract level is just as possible with headlines that are as valid in data protection as they are in the current debate on our health systems.
Decentralization ensures differentiation and proportionality, agility and thus, for example, faster legal certainty, more specific prioritization and, above all, proximity to the citizen.
Decentralized structures are thus always the condition for plurality and dialogue, which is sometimes seen as a difference of opinion, but should better be understood as dialogue for the best solution.
Centralization, on the other hand, always carries the risk of a one-sided weighting of interests and low transparency.
The Privacy Advisor: Do you consider the argument that the federal structure of supervision in Germany is an "obstacle" for German companies in international competition justified?
Will: I always have difficulties at this point, where we are supposed to look at "the German economy" in its entirety.
I do not see the image of a German economy that is structurally inferior in competition, neither on a European nor on a global scale, especially now in the pandemic crisis. Neither do I see any viable examples so far that the German supervisory authorities have been unable to keep the promise of the GDPR to ensure uniform data protection standards throughout Europe in everyday life.
Incidentally, is not the federal structure with its possibilities for direct contact and specialization more of an advantage of location? Depending on the focus of the industry, the DPA in the various German Länder brings very different and specific expertise, for example, in the media or automotive industries with their digital innovations.
We are, therefore, able to meet the regional need for advice in a way that a central authority would hardly or only slowly develop.
The Privacy Advisor: How strong is the political will at the federal level for change at the moment?
Will: This is difficult to assess from the perspective of a representative of the executive branch and, above all, it is difficult to place it in the overall picture of current political priorities. Since it concerns the field of activity of my authority, I take the discussion and any new contribution to it very seriously in any case.
The Privacy Advisor: What are the positions of the Länder governments on this project?
Will: I have the impression that politicians in all 16 Länder are still observing the discussion, which as said before is still rather vague, and they are therefore hesitating to take a position. Even in a state like Lower Saxony, which has currently attracted the most attention to the smoldering centralization debate by registering the centralization debate for the autumn conference of the economics ministers of the federal states and government, one can hardly be sure whether this initiative will be represented only by the responsible department or by the entire state government.
The Privacy Advisor: Could a state (e.g., Bavaria) prevent the standardization or centralization of data protection supervision for the non-public sector?
Will: From a constitutional law perspective, this is in principle only conceivable if the existing responsibilities of the Länder in the non-public sector, which are determined by the German constitution, were to be reorganized by means of a state treaty, such as in the gambling sector. Such state treaties require ratification by all 16 state Parliaments.
If, on the other hand, the federal government were to take over supervisory responsibilities by means of a federal law, this would, depending on the constellation, only require the approval of the Bundesrat, i.e., a mere majority of the Länder, but not an agreement with all Länder.
The Privacy Advisor: What would be the advantages of a state treaty compared to pure bundling at the federal level?
Will: The constitutional framework for centralized supervision at the federal level is narrow and not very practicable with the stipulation that supervision is carried out by a central higher federal authority alone. Anyone who imagines that centralization of data protection supervision would to some extent transform the current Länder authorities into branches of the (Federal Representative for Data Protection) will not find a constitutionally acceptable solution for such approach. The frequently discussed goal of creating formally secured, i.e., legally comprehensively verifiable, cross-state binding decisions of all supervisory authorities according to the majority principle, is so far mainly implemented by state treaties of the Länder, for example, in the gambling or broadcasting sector.
The Privacy Advisor: What do you think of a stronger legal structure for the DSK and its resolutions, as recently brought into play as another alternative by Federal Commissioner for Data Protection and Freedom of Information Ulrich Kelber?
Will: First of all, for individual proposals, as well as for the debate as a whole, we first need a clear common understanding of the problem before we can discuss the exact fit of individual changes and further developments.
At first glance, the proposal for a stronger legal structure appears to be right in that it offers the opportunity to further strengthen and better coordinate the cooperation required at the European level, including within the German supervisory authorities, for example, by setting up an efficient secretariat.
Beyond the organizational structure, however, we must clarify the details of this proposal more clearly. What kind of decisions by the DSK are actually suitable for creating a legally binding effect? The same applies to the decision-making mechanisms, such as the question of simple or qualified majority voting.
The Privacy Advisor: What is your personal position — where does this road lead Germany to?
Will: According to the GDPR, there is only one way forward: a stronger standardization of national enforcement practices under common European guidelines.
The Privacy Advisor: Would a centralization of supervision in Germany possibly only be the preliminary stage toward a central European supervisory authority for the non-public sector?
Will: The transfer of enforcement powers is not a trivial task even in a federal system, and it is even more so in a European association of states.
Moreover, the potential, which the GDPR coherence mechanism provides in terms of shifting final decision-making powers in the enforcement of data protection law to the (European Data Protection Board), has, in my opinion, not yet been fully exploited in practice by the EDPB.
Therefore, the question of a further stage of centralization should not arise for the time being anyway.
Photo by Daniel Seßler on Unsplash
