IT Security

Any employee who falls for professionally forged payment instructions from supposed superiors risks not only losing their job but, under certain circumstances, also facing personal liability for damages running into millions. This is demonstrated by a sensational ruling from the Cologne Regional Labour Court. The ruling increases the liability risks for senior executives in particular: in the court’s view, D&O insurance financed by the employer can result in the principles of limited employee liability being overridden. However, the final word has not yet been spoken. An appeal is pending before the Federal Labour Court.

On 11 September 2026, it was that time again: the 7th IT Women Lawyers’ Day took place in Berlin – once more initiated and organised by Marlene Schreiber (HÄRTING Rechtsanwälte) and Nina Diercks (Diercks Law Firm). Lawyers, in-house counsel, data protection experts and tech experts gathered at the offices of HÄRTING Rechtsanwälte to discuss current practical issues relating to IT law.

Checklists and overviews on the implementation of NIS 2.

Admittedly, the Military Counter-Intelligence Service (MAD) is not the focus of the government’s draft bill on the reform of the intelligence services. However, this is due less to its small size – it is the smallest of the three German intelligence services – and more to the fact that a fundamental reform of the Military Counter-Intelligence Service Act (MADG) came into force on 16 January 2026 (see Federal Law Gazette 2026 I No. 7, p. 37). Nevertheless, the draft also contains substantial amendments to the MADG which, from the perspective of those affected, give cause for criticism.

The new EU action plan sets out how Europe intends to address the opportunities and risks posed by artificial intelligence in the field of cybersecurity.

The planned reform of intelligence service legislation has raised serious concerns within the German Bar Association (DAV). Substantial amendments are required during the legislative process to address the significant constitutional concerns. This is evident from the DAV’s statement of 2 September 2026, to which Niko Härting contributed.

In episode 184 of “Follow the Rechtsstaat”, Prof. Niko Härting and Dr Stefan Brink discuss well-known contentious issues that are once again in the legal and political spotlight. The focus is on the complaint lodged by Reporters Without Borders against the use of spyware by the Federal Intelligence Service, data protection risks associated with the use of cloud solutions by public libraries, and international data transfers. The two also discuss what implications current developments in the US might have for the adequacy decision on the EU-US Data Privacy Framework.

In episode 47 of the Data Navigator podcast, Dr Martin Schirmbacher and Dr Hubertus von Rönne address a topic that, since the Data Act came into force, has repeatedly been cited as a supposed counter-argument against claims for the disclosure of data: the GDPR. One of the reasons for this discussion is the third think tank organised by the Federal Commissioner for Data Protection and Freedom of Information on the Data Act, which took place last week. The starting point is clear: the Data Act expressly applies to personal data as well. In the event of a conflict, the GDPR takes precedence. In practice, however, such conflicts arise far less frequently than is often assumed. The decisive factor here is what is known as ‘relative personal reference’. Whether data is personal is not assessed in the abstract, but from the perspective of the relevant data controller. Dr Martin Schirmbacher and Dr Hubertus von Rönne illustrate this principle using the example of a bus driver: for Berlin’s public transport authority, driver data is personally identifiable, as they know who was driving which bus at what time. For the bus manufacturer, which merely receives vehicle data without any personal registration details, this link is generally absent. In the case of a wind farm, the situation may be the reverse: the manufacturer knows its maintenance staff, whilst the wind farm operator is usually unable to identify them. It follows that: The same data set may be personal data for one party and not for another. In scenarios governed by the Data Act, it is often precisely the data recipient who cannot establish a personal link. If, however, the recipient does establish a personal link, they require a legal basis under the GDPR. Legitimate interests are particularly relevant in this context. The manufacturer, in turn, may rely on Article 6(1), first sentence, point (c) of the GDPR for the data transfer, as the disclosure is made on the basis of a legal obligation under the Data Act. Finally, Dr Martin Schirmbacher and Dr Hubertus von Rönne outline the responsibilities of the supervisory authorities. The Federal Network Agency is generally responsible for complaints relating to the Data Act. As soon as personal data is involved, it must involve the Federal Commissioner for Data Protection and Freedom of Information. The state data protection authorities remain responsible for traditional infringements of the GDPR – for example, if a farmer complains that a manufacturer is processing their personal data.

The 4th HÄRTING AI Day will take place in Berlin on 19 November 2026. The event will focus on current issues relating to artificial intelligence, the AI Act, data protection and the practical application of AI in businesses.