Just how different is the legal situation in Germany under GDPR compared to previously with respect to running a website?

Question

A frequent statement with respect to making German websites GDPR-compliant is that barely anything has changed in Germany with DSGVO (the German version of GDPR) and the previously applicable national law (BDSG).

At the same time, while many aspects of GDPR are still considered unclear or disputed, there seems to be pretty much a consensus in Germany that any website owner¹ whose site is hosted on the server of a 3rd party will have to sign a contract for processing on behalf with the webhoster.² This appears the case even if the webhoster merely handles visitors' IP addresses such as for security logging purposes.

While I concede companies and people as a whole used to be sloppy about former privacy laws and very late at starting to prepare for GDPR, the requirement for those specific contracts with webhosters are generally implied to be something new. Webhosting companies have started to offer the respective contract templates only recently as a part of their GDPR preparation, and articles point out these contracts as something to take care of to make one's site GDPR-ready, especially including non-commercial fan sites, blogs, and similar.

Was there³ a requirement to have such a contract with one's webhoster for non-commercial/hobbyist websites before GDPR? (If so, was it simply widely ignored, especially on sites hosted abroad, where hosters wouldn't know about (and be unwilling to sign?) such contracts?

EDIT: The only thorough essay on the topic I have found so far is a blogpost on CR-online (in German). It specifically addresses the situation of non-commerical and/or small services (coming to the conclusion that from the point of view of these services, the claim that "not much has changed" is a "myth") and points out that the obligations for internal documentation have been considerably extended. However, it does not concretely discuss any particular setups such as "running a website".

---

¹: Except for websites maintained as a part of a "purely personal or household activity", but it seems disputed whether any publicly accessible website can meet these criteria at all.

²: My understanding is that the website owner ensures towards visitors the visitors' personal data will not be used for anything beyond what is stated in the site's privacy note, and the contract for processing on behalf is the website owner's legal handle to also ensure the webhoster does not exceed the boundaries of the privacy policy (or informs the website owner in time so they can update their privacy note).

³: Either from BDSG itselt, or based upon some EU-wide regulation.

Answer 1

The 2009 edition of BDSG in section 1 describes the BDSG specifically not to apply for computerized data being collected, processed or used exclusively for personal or family activities:

Dieses Gesetz gilt für die Erhebung, Verarbeitung und Nutzung personenbezogener Daten durch […] nicht-öffentliche Stellen, soweit sie die Daten unter Einsatz von Datenverarbeitungsanlagen verarbeiten, nutzen oder dafür erheben oder die Daten in oder aus nicht automatisierten Dateien verarbeiten, nutzen oder dafür erheben, es sei denn, die Erhebung, Verarbeitung oder Nutzung der Daten erfolgt ausschließlich für persönliche oder familiäre Tätigkeiten.

(BDSG 2009, §1, 2.3)

Depending on one's interpretation, there is some overlap between "personal or familiy activities" and "non-commercial/hobbyist", but other than this, German website owners are very likely to be bound to BDSG 2009.

Section 11 has been enacted in September 2009 and is named "Erhebung, Verarbeitung oder Nutzung personenbezogener Daten im Auftrag" (Collection, processing or use of personal data on behalf) and describes data storage and processing via a contractor.

Drastically shortened and oversimplified: if you're asking someone else to store or process data on your behalf, you're still responsible to enforce data protection of the stored/processed data and you'll need to have a written contract with your contractor to address this topic. This contract should outline how and which data is to be stored/processed, how (technical and organizational means) this data is being protected, that your contractor will notify you for data protection violations by the contractor or their employees and that any data is being deleted when the contract has been finished.

Depending on a few circumstances, your current web hosting contract or T&C with your web host may already be sufficient to satisfy both BDSG and GDPR requirements.

At least from a German perspective, you and your web host have demonstrated implied conduct ("konkludentes Verhalten") of storing personal data according to BDSG: by offering web site storage, usually access to server log files and some email service as well, a German web host does offer contractor services according to BDSG and are most likely about to store personal information (server logs, email messages). Most web hosts also do describe their infrastructure in detail, so you've also some outline of their technical measures to protect your data.

So: if you as a German resident did sign a contract with a German web host company after September 2009, you've both most likely agreed by implication to have that web host company to store, process and use personal data as regulated by BDSG.

If

• your legal advisor does not follow this idea of implied conduct to be "safe enough",
• your specific contract may be too old to correctly meet BDSG 2009 requirements or
• you've made your contract with a foreign web host who didn't consider to be possibly impacted by some German law,

you may want to have a specific agreement with your web host in order to satisfy BDSG and/or GDPR requirements.

Most web hosts are used to inquiries regarding which standards or regulations they are compliant with and how those do relate to one's specific product (for example, a web host may be PCIDSS-compliant to handle credit card information in a safe way, but this won't cover your self-written PHP script running on their shared web hosting server farm. While those confirmations are certainly less than a "written contract", they do give you some idea of how serious the web host does take their job to secure your data.

As you've already noticed, web hosts today do offer a free "data processing contract" as an amendment to your existing contract to legally assure how they're storing and processing data.

Such a contract usually doesn't imply any obligations to you, but still may be important. Why: according to BDSG and GDPR, you're still responsible regarding your user's data. If your web host experiences a data breach and loses your user's data, your behavior of NOT having a written contract might be seen as "reckless" in a legal dispute. A written contract saves you from that and also offers you the opportunity to file a complaint against your web host for violating that contract in order to redeem for damages.

So in summary: BDSG from 1st of September 2009 does already address your specific topics in a very similar way than the GDPR does, asking for a written contract. As the GDPR has been presented in January 2012, the BDSG did already address your specific topic before the GDPR has been enacted or even been presented.

The website requirements have to be met by website owners, regardless of where they're hosting their site. If website owners did silently ignore those requirements or implicitely agreed via implied conduct is hard to answer and only known to each website owner. There are also many more, often very specific factors like the age of the contract and the corresponding applicable law. So that part of the question is hard to answer and probably will never come to a profound conclusion.