Processing of Special Categories of Data in Germany

The European Union's General Data Protection Regulation (GDPR) regulates what kind of processing is permitted that involves “special categories of data,” which includes race, origin, religious belief, and health data, among others. As an EU regulation, the GDPR has immediate effect in all member states without requiring any national implementation. This ensures that a certain harmony exists across the EU in terms of data processing to break down barriers for international data flow and to facilitate privacy compliance by multinational companies.

Yet, when it comes to these special categories of data, member states are granted some flexibility to tailor certain provisions. The motivation here is to give effect to cultural and social differences regarding the treatment of sensitive issues relating to the special categories of data.

Germany, with its longstanding commitment to data protection, has utilized the flexibility offered by Article 9 of the GDPR to strengthen and specify conditions under which special categories of data can be processed.

In this article, we will explore how Germany's Bundesdatenschutzgesetz (BDSG) aligns with, and expands upon, the GDPR's stipulations. In addition to expanding on the permitted uses of special categories of data, § 22(2) of the BDSG mandates a set of specific rigorous measures designed to ensure the utmost protection of special categories of data.

‍Permitted Uses under GDPR and BDSGThe following table sets out the circumstances under which the processing of special categories of data are permitted under Art. 9(2) GDPR and the additional or specified permissions under § 22(1) and other provisions of the BDSG.

Permitted Uses under GDPR and BDSG by Patrícia GI

In summary, the German deviations from the GDPR in the context of processing of special categories of data are more in the realm of nuances, which can of course matter significantly. For example, the public interest exception can only be relied upon by public bodies, unless the processing is “absolutely” necessary, introducing a higher threshold for private organizations. In addition, where the processing is generally permitted by public bodies, the interests of the data subject must not outweigh the interest in processing the data.

Overall, there is no net new processing purpose introduced under the BDSG, but rather more concrete and stricter conditions are implemented to safeguard special categories of data.

Additional Safeguard Required under BDSG

Many of the provisions under the GDPR require member states to implement appropriate safeguards as a condition for the exception to the prohibition of processing special categories of data to apply. Germany has done so in § 22(2) of the BDSG, which stipulates a mandatory framework of safeguards that must be instituted whenever special categories of personal data are processed under the exceptions provided by the law. These measures are not optional but are requisite conditions that underpin the legitimacy of the processing activities. The list of mandated measures includes:

• Technical and organizational measures to ensure GDPR compliance.
• Mechanisms for auditing whether, how, and by whom personal data have been accessed, modified, or deleted.
• Education and sensitization programs for all personnel involved in data processing operations.
• The mandatory appointment of a data protection officer to oversee data processing practices.
• Access restrictions to personal data within the responsible entity to prevent unauthorized use.
• The pseudonymization of personal data to obscure identities.
• The encryption of personal data to protect against unauthorized access or breaches.
• Measures to ensure the resilience of processing systems and the ability to restore access to personal data swiftly after a physical or technical incident.
• Regular procedures for testing, evaluating, and assessing the efficacy of all technical and organizational measures.
• Specific procedural protocols to ensure that data transfers or processing for different purposes remain compliant with both the BDSG and the GDPR.

Through these measures, the BDSG ensures that the processing of special categories of data, while necessary for certain specified purposes, does not compromise the fundamental rights and freedoms of the individuals concerned.

How Private AI Can Help

Private AI’s technology is well equipped to help organizations with compliance with the BDSG, in particularly with §22(2). Among the listed safeguards, pseudonymization falls most obviously into Private AI’s area of expertise. Using the latest advancements in Machine Learning, Private AI can identify and replace over 50 entities of personal data to facilitate compliance. This is possible in 52 languages, which makes the tool perfect for companies operating in multiple jurisdictions, processing data in many different languages. To see the tech in action, try our web demo, or get an API key to try it yourself on your own data.

In summary, the German deviations from the GDPR in the context of processing of special categories of data are more in the realm of nuances, which can of course matter significantly. For example, the public interest exception can only be relied upon by public bodies, unless the processing is “absolutely” necessary, introducing a higher threshold for private organizations. In addition, where the processing is generally permitted by public bodies, the interests of the data subject must not outweigh the interest in processing the data.

Overall, there is no net new processing purpose introduced under the BDSG, but rather more concrete and stricter conditions are implemented to safeguard special categories of data.

Additional Safeguard Required under BDSG

Many of the provisions under the GDPR require member states to implement appropriate safeguards as a condition for the exception to the prohibition of processing special categories of data to apply. Germany has done so in § 22(2) of the BDSG, which stipulates a mandatory framework of safeguards that must be instituted whenever special categories of personal data are processed under the exceptions provided by the law. These measures are not optional but are requisite conditions that underpin the legitimacy of the processing activities. The list of mandated measures includes:

• Technical and organizational measures to ensure GDPR compliance.
• Mechanisms for auditing whether, how, and by whom personal data have been accessed, modified, or deleted.
• Education and sensitization programs for all personnel involved in data processing operations.
• The mandatory appointment of a data protection officer to oversee data processing practices.
• Access restrictions to personal data within the responsible entity to prevent unauthorized use.
• The pseudonymization of personal data to obscure identities.
• The encryption of personal data to protect against unauthorized access or breaches.
• Measures to ensure the resilience of processing systems and the ability to restore access to personal data swiftly after a physical or technical incident.
• Regular procedures for testing, evaluating, and assessing the efficacy of all technical and organizational measures.
• Specific procedural protocols to ensure that data transfers or processing for different purposes remain compliant with both the BDSG and the GDPR.

Through these measures, the BDSG ensures that the processing of special categories of data, while necessary for certain specified purposes, does not compromise the fundamental rights and freedoms of the individuals concerned.

How Private AI Can Help

Private AI’s technology is well equipped to help organizations with compliance with the BDSG, in particularly with §22(2). Among the listed safeguards, pseudonymization falls most obviously into Private AI’s area of expertise. Using the latest advancements in Machine Learning, Private AI can identify and replace over 50 entities of personal data to facilitate compliance. This is possible in 52 languages, which makes the tool perfect for companies operating in multiple jurisdictions, processing data in many different languages. To see the tech in action, try our web demo, or get an API key to try it yourself on your own data.