Data Protection Law

On 26 March 2026, the Bundestag passed the Data Implementation Act (DADG). Germany has thus created the national legal framework required of member states by the EU Data Act - after a significant delay. Below we provide an overview of the background, content and fine regulations of the new law.

The topic of episode 39 of the Data Navigator Podcast is - once again - the importance of the Data Act for wind energy. Our guest is Stefan Grothe, Technical Officer at the German Wind Energy Association (BWE), the largest association in the renewable energy sector with over 17,000 members. We start with an overview of the wind energy ecosystem: Who are the typical stakeholders - from operators and managers to manufacturers and independent service providers, direct marketers and grid operators? Stefan Grothe explains why the operator structure in Germany is particularly heterogeneous - from community energy companies to large energy suppliers. One focus is on the data generated by wind turbines: Performance data, weather data, temperature, vibration monitoring and voltage data - usually as ten-minute SCADA data . What is particularly exciting is that the data flow is bidirectional - grid operators and direct marketers can also actively control turbines, for example in the event of grid bottlenecks or negative electricity prices. We discuss the new opportunities opened up by the Data Act: higher-resolution data for better condition monitoring, more precise predictions on the service life of large components and new business models for predictive maintenance. Subsystems also play an important role here - such as condition monitoring systems on gearboxes, bearings and rotor blades, whose data has often remained with the manufacturer or service provider up to now. When it comes to trade secrets and IP protection, Stefan Grothe takes a differentiated view: Reverse engineering via data analyses is conceivable in principle, but is only relevant in practice after a long period of operation, if independent service becomes possible at all. It is also clear that knowledge of the Data Act is still patchy in the industry. Finally, Stefan Grothe takes a look at the economic drivers: falling liability caps in maintenance contracts, increasing demands on electricity production costs and the growing importance of better data analyses for insurers and financiers make the Data Act strategically relevant for the industry.

Artificial intelligence (AI) that takes over purchasing in companies, autonomously monitors product stocks, researches prices and triggers orders. The proactive assistant that answers emails, manages calendars and checks in for flights. Or AI-to-AI or multi-agent systems that take over the entire checkout and where all processes on both the buyer's and seller's side run entirely within an AI interface - the use of AI agents or agentic AI promises completely new possibilities. Companies, and in particular retailers, that decide to participate in this new AI-based ecosystem must also be aware of the legal pitfalls: What are the legal rules of the game when AI suddenly negotiates and concludes contracts independently? Who is liable for what?

The "Schabowski" case of the OVG Münster is going to the Federal Administrative Court! The proceedings revolve around Günther Schabowski's famous speech at the press conference on 9 November 1989. Who did the Haus der Geschichte buy this note from? A journalist from the BILD newspaper sued the museum on the basis of the right to information under Article 5 of the German Constitution. The OVG Münster accepted such a claim, rejecting it and basing its decision on the grounds for refusal of the IFG and Art. 86 GDPR. The Haus der Geschichte is now appealing. From minute (20:39), Dr Stefan Brink and Prof Niko Härting talk about the resolution paper of the Data Protection Conference on the P20 Data House, a federal-state project on the IT infrastructure of the police. The paper criticises in particular the lack of a legal basis for the planned IT architecture. Finally, from minute 30:13 onwards, the AI tool Microsoft Copilot is discussed. Copilot is not actually allowed to access files labelled as confidential; however, such access did take place. Stefan and Niko shed light on the consequences under data protection law and finally land on the keyword of digital sovereignty.

Starting at minute 01:41, Dr Stefan Brink and Carl Nowak talk about the unsuccessful attempts of a journalist to obtain the Kohl files, which are in the possession of the widow Maike Kohl-Richter. Unfortunately, it is almost a habit in Germany for outgoing members of government to take files home instead of handing them over to the Federal Archives. Does the Freedom of Information Act impose an obligation on public authorities to retrieve "lost" files? Afterwards (14:14), Stefan and Carl talk about an increase in data protection submissions from 2024 to 2025 to the Berlin Commissioner for Data Protection and the Lower Saxony State Data Protection Commissioner. What could be the causes? Finally, from minute (30:00) onwards, an ECJ ruling from 29 January C-291/24 on the EU Money Laundering Directive is discussed. This concerned the legal requirements in Austrian law regarding the liability of a legal entity for compliance violations. What does this decision have to do with data protection?

The handbook "Data and privacy protection in the employment relationship" has just been published. It offers practical guidance on legal issues relating to employee data, personal rights and the data protection-compliant handling of information in everyday working life.

Dr Stefan Brink and Prof Niko Härting begin by discussing a forthcoming amendment to the BND Act on the occasion of an FAZ article by Thorsten Frei. For Härting and Brink, this is met with "civil rights displeasure". They recognise numerous breaches of taboos, such as the abandonment of the separation requirement, according to which information gathering and police powers are traditionally to be kept separate in German intelligence services. From minute (02:05) onwards, the two take a critical stance on the proposal to remove the control function of the Federal Intelligence Service from the Federal Data Protection Commissioner. From intelligence service to transparency: From minute (17:55), Härting and Brink discuss the ECJ decision of 15 January 2026 - C-129/24, in which numerous requests under the Environmental Information Act were made against an Irish forestry company. The forestry company refused to provide information as the requests were all made under pseudonyms. Can national law require identification for environmental information requests? Finally, from minute 28:51 onwards, the ECJ ruling of 18 December 2025 - C-422/24 is discussed. Ticket inspectors were equipped with bodycams in Stockholm's public transport system, passengers were not informed about this. The Swedish supervisory authority therefore issued a fine on the basis of Art. 13 GDPR. Is this really a case of Art. 13 GDPR or is Art. 14 GDPR (including exemptions in paragraph 5) relevant?

With a new cybersecurity package (Cybersecurity Act 2), Brussels wants to take cybersecurity in the EU to a new level: mandatory certifications, stricter supervision and a stronger ENISA are intended to make the digital single market resilient to current and future threats. The requirements for companies under the NIS 2 Directive are also under review.

Access control via facial scanning, age classification in e-commerce, voice recognition in customer service, or emotion analysis in video calls – there are many applications for biometric systems in business practice. Artificial intelligence (AI) makes many of these systems better, faster, and more effective. But the use of AI with biometric data not only raises concerns among data protectionists – against the backdrop of the AI Regulation (AI-VO), many companies are asking themselves: Which biometric applications are prohibited under the AI-VO, which are considered high-risk, and when do "only" transparency obligations apply?