Source: http://www.inhouselawyer.co.uk/practice-areas/tmt-3rd-edition/germany-tmt-3rd-edition/
Timestamp: 2019-08-17 15:33:49
Document Index: 641759334

Matched Legal Cases: ['Art. 6', 'Art. 6', 'Art. 95', 'Art. 44', 'Art. 45', 'Art. 45', 'Art. 46']

Germany: TMT (3rd edition)
This country-specific Q&A provides an overview to technology, media and telecom laws and regulations that may occur in Germany.
Under German law communications networks and services are regulated by the Telecommunications Act (TKG).[1] The TKG covers activities of sending, transmitting and receiving of signals according to the term “telecommunications services”[2] regulated in section 3 TKG. Service provider is any person who performs telecommunications services wholly or partly for commercial purposes or takes part in these performances of service. However, a licence or authorisation for telecommunication service providers is not required. The operators just have to notify the Federal Network Agency[3] about commencement, modification or termination of the activities in accordance with section 6 TKG.
[1] Telekommunikationsgesetz
[2] Telekommunikationsdienste
[3] Bundesnetzagentur
Section 43a TKG determines which information operators have to make available to the consumers in the contract in an explicit, comprehensive and easily accessible form. The minimum contractual information shall include, inter alia, information on all restrictions on the access and use of services and applications, the minimum level of service quality offered, as well as information on all procedures set up by the company for the measurement and control of data traffic. Moreover, already at the conclusion of contract, the operator is obliged to inform about the necessary steps for a possible change of supplier according to section 46 TKG. The maximum contract term is limited to 24 months pursuant to section 43b TKG. Additionally section 44 TKG provides for customers friendly regulations in case of damage or cease and desist claim of the customer. The interests of disabled end-users are considered in section 45 TKG. The availability of an error correction service is required pursuant to section 45b TKG and the entitlement of the customer for an itemized bill in section 45e TKG.
The creators of computer software (“author”/“Urheber”) are legally protected by copyright, especially by the special provisions for computer programmes regulated in sections 69a et seqq. of the Copyright Act (UrhG) based on the EU computer program directive (2009/24/EG). Author is defined as the maker of the piece of work according to section 7 UrhG,[4] therefore in terms of software the software developer as natural person. This copyright ownership as author is not transferable, but it is possible to grant licenses to third parties in return for an appropriate remuneration in accordance with sections 31 et seqq. UrhG. If a software is created by an employee, then the employer has the exclusive right to use and exploit the software in accordance with section 69b UrhG provided that nothing contradictory is agreed. Moreover, the creator could be protected by patent law (PatG)[5] in specific circumstances where the software fulfils the requirements of an invention in a field of technology (“technische Erfindung”) and the Employee Inventions Act (ArbnErfG).[6] Furthermore, the creator is protected by the criminal law provisions in sections 106 et seqq. UrhG. In accordance with those sections unauthorised use, unauthorised affixing of copyrights as well as unauthorized tampering with technical protective measures is punishable.
[4] Urhebergesetz
[5] Patentgesetz
[6] Arbeitnehmererfindungsgesetz
In respect of databases German copyright law recognises specific intellectual property rights. There are two kinds of databases. One is an autonomous work and protected by copyright because it is considered a personal intellectual creation (“persönliche geistige Schöpfung”) in accordance with section 4 UrhG. For such databases, a full copyright protection similar to software applies. The other type of database is protected because of the financial investment which was required for creating it. The latter is regulated in sections 87a to 87e UrhG which are based on the EU Database Directive (95/46/EG). These sections of the law rule that only the producer of the database is authorised to reproduce, distribute and publicly report the database as a whole or a part of essential type and extent. The European Court of Justice has decided that the essential part of a database refers to the extracted or reused volume of the database (judgment in the case C-203/02). An essential part is therefore considered to be 10 percent or more. Excluded from protection, however, are reproductions for private use, for purposes of scientific research pursuant to sections 60c and 60d and for illustrative use in education pursuant to section 87c UrhG.
The key protection for personal data is found in the GDPR (DS-GVO)[7] and the new version of the German Federal Data Protection Act (BDSG).[8] Since 25th May 2018 the GDPR and the revised BDSG have been in force. The new regulation on the protection of personal data for the whole of the European Union pursues the objective to ensure a quite harmonized approach to data protection within all member states. In general, the GDPR can be considered to be very strict, particularly due to the very high fines it imposes for breaches.
In accordance with Art. 6 GDPR the processing of personal data shall only be lawful if and to the extent that a statutory permission is applicable or the data subject has given consent to the processing. Art. 6 (2) GDPR permits the processing of personal data in particular to the extent necessary for the performance of a contract (lit. b), for compliance with a legal obligation (lit. c) and in case of prevailing interests of the data controller (lit. f) as general permissions.
In addition, German law also contains sector specific protection for personal data. Section 88 TKG is an important provision for the telecoms sector as it stipulates the requirement of secrecy of telecommunications. Further telecom-specific regulations on data protection are found in sections 91 et seqq. TKG. The data protection regulations of the TKG, which have been issued to implement the directive 2002/58/EG, will continue to be applicable in accordance with Art. 95 GDPR.
In respect of electronic information and communication services (“telemedia”) which are not consider telecommunications, in particular websites, specific protection rulings were found in sections 11 et seqq. in the Telemedia Act (TMG).[9] However, since the GDPR came into force, it was unclear whether the special regulations of the TMG remain applicable. The TMG was until now not adapted to the new data protection laws. In this regard the DSK (Datenschutzkonferenz, a joint committee of the data protection authorities of the German federal states) issued a position paper in April 2018. Hereinafter the sections 12, 13, 15 TMG are no longer applicable. Sections 67 et seqq. of the Volume X of Social Security Statute Act (SGB X)[10] contain special provisions protecting social data which have been revised in the context of the GDPR and continue to apply in this respect.
[7] Datenschutzgrundverordnung
[8] Bundesdatenschutzgesetz neu 2018
[9] Telemediengesetz
[10] Zehntes Buch Sozialgesetzbuch
The EU applies restrictions on the transfer of personal data overseas. These are grounded in Art. 44 et seqq. GDPR. These supplementary rules set higher requirements on the lawfulness of the transfer of personal data to a third country outside of the EU or international organisations. In addition to compliance with the general requirements of the GDPR, a transfer of data in this sense may take place on the basis of an adequacy decision of the European Commission pursuant to Art. 45 GDPR. The decision on adequacy depends on whether the third country offers an adequate level of protection that is comparable to the EU (which is the minority), and “unsafe” countries, as determined by the European Commission. For example, India, China and the United States are considered “unsafe” in data protection context.
When there is no adequacy decision pursuant to Art. 45 GDPR, personal data may only be transferred to a recipient in that country if the controller or processor in such countries has provided appropriate safeguards, and on the condition that data subject rights are enforceable and effective legal remedies for data subjects are available pursuant to Art. 46 (1) GDPR. In practice the most common measure is the implementation of the EU model clause. Additionally, Binding Corporate Rules (BCR) play an important role in multi-national companies. The EU and the USA have established the so-called “EU-US Privacy Shield” since August 2016. It provides an opportunity for US companies which would like to receive data from the EU to register in a list of the US Federal Trade Commission (FTC) and thereby commit to comply with the fundamental principles of EU data protection laws. The Privacy Shield has replaced the so-called “Safe Harbor Framework” which was declared invalid by the European Court of Justice on 6 October 2015 (C-362/14). As many principles of Safe Harbor are again found in the Privacy Shield, some scholars are of the opinion that there is a risk that also the Privacy Shield may be successfully challenged in the European Courts.
There is no law that specifically regulates cloud-based services in German law. But the data protection laws mentioned above set the legal framework to be complied with.
Moreover, there are specific restrictions for regulated markets. For example, financial institutions which outsource activities and processes are obliged to follow the requirements pursuant to section 25b Banking Act (KWG).[11] Cloud computing often qualifies as “outsourcing” in this respect. The German financial supervisory authority BaFin (Bundesanstalt für Finanzdienstleistungsaufsicht) summarized the legal requirements for cloud usage by financial services institutions in a whitepaper dated 8 November 2018 (Merkblatt – Orientierungshilfe zu Auslagerungen an Cloud-Anbieter). Similar specifications are found in the Stock Exchange Act (BörsG)[12] and the Securities Trading Act (WpHG).[13] Also for the insurance sector, special restrictions exist, e.g. section 32 Insurance Supervision Act (VAG),[14] according to which the insurance company stays responsible for the fulfilment of regulatory rules when outsourcing activities. For usage of social data in clouds exist restrictions regulated in section 80 SGB X revised in the course of the GDPR and for taxation the restrictions are regulated in section 146 (2, 2a) tax code (AO).[15] According to this section books and otherwise required records shall be kept within the scope of AO, therefore in national territory.
Up to 2017, some professionals which are subject to professional secrecy had to face restrictions with regard to cloud-based services. For example doctors, lawyers, tax advisors and persons working in life and health insurance have a statutory duty of professional secrecy, and in case of unauthorized disclosure, this is considered a criminal offence pursuant to section 203 German criminal code (StGB).[16] But a recent legislative amendment of section 203 StGB also provides these professionals the opportunity to use e.g. Cloud-Services and external service providers, because pursuant to section 203 (3) StGB it is no longer a problem to pass on the information to involved persons as long as this is necessary for the using of the person’s activity and provided that proper contractual safeguards as regards data secrecy are in place.
[11] Kreditwesengesetz
[12] Börsengesetz
[13] Gesetz über den Wertpapierhandel
[14] Versicherungsaufsichtsgesetz
[15] Abgabenordnung
[16] Strafgesetzbuch
German requirements on electronic signatures are laid down in the Regulation on Electronic Identification and Trust Services (eIDAS)[17] which replaced the German Signature Act (SigG)[18] in July 2017. The new regulation contains binding European-wide rules in the areas of electronic identification and electronic trust services. The eIDAS Regulation introduced the so called “electronic seals”. Technically, these are similar to the electronic signatures. The main difference is the assignment to a legal rather than a natural person. While electronic signatures can be used to sign a declaration of intent, the electronic seal of an institution serves as proof of origin: It can be used wherever a personal signature is not necessary, but proof of authenticity is desired, e.g. in the case of official decisions, certificates and account statements.
For the validity of electronic signatures in general (for example in e-mails or PDF documents), there are no specific requirements. However, for legal acts which require written form according to section 126 German Civil Code (BGB),[19] this form requirement can (where not excluded in the law) only be replaced by a qualified electronic signature. A qualified electronic signature is only given in cases where an certified identification unit was used when creating the signature (which is rarely the case). Electronic documents only have the same value of proof as documents which were signed by hand if a qualified electronic signature is used in the document (section 371a German Code of Civil Procedure.[20]
[17] Verordnung über elektronische Identifizierung und Vertrauensdienste
[18] Signaturgesetz
[19] Bürgerliches Gesetzbuch
[20] Zivilprozessordnung
There are diverse regulations on cybersecurity depending on the industry sector and depending on which data is processed. When personal data is processed, section 32 GDPR requires a level of security appropriate to the risk. Telecommunications operators are obliged to take measures for the security of the secrecy of telecommunications and against unauthorized access to personal data in accordance with section 109 TKG. Section 8a BSI-Act (BSIG) [21] regulates obligations for operators of critical infrastructure to ensure their technical functionality. The implementation of the NIS EU directive in the member states led to a high common security level of network and information systems in the EU.
[21] Gesetz über das Bundesamt für Sicherheit in der Informationstechnik
Prof. Dr. Peter Bräutigam, Partner
Dr. Thomas Thalhofer, Partner