Before the GDPR came into effect, I had to deal with both the German Bundesdatenschutzgesetz and the Italian Codice in materia di dati personali, and recall them having very similar provisions (though I am not a lawyer). When the GDPR arrived, I found it equally similar to these two.

As far as I can tell, the major changes of the GDPR are maximum fines for violations, as well as some refinements (e.g. what data falls under “special categories”, the processing of which is subject to further restrictions).

Now, with the GDPR in force, I frequently hear statements (from people who are also not lawyers, all of them in a German context) to the effect that the GDPR changes everything, and every practice based on national data protection law becomes obsolete. My reading of the GDPR is a different one—IMHO the measures required for compliance with national data protection law are not very different from those required for GDPR compliance, save for a handful of exceptions or refinements.

Have I overlooked something here?

  • 4
    GDPR harmonized existing data protection laws. Previously, companies generally ignored these local laws. An EU-wide regulation is much harder to ignore, especially if there's the potential for fines that are more than a slap on the wrist. The flood of "we're updating our privacy policy" emails made more lay people aware of data protection laws.
    – amon
    Jan 17, 2020 at 14:40

1 Answer 1

  • The BDSG continues to be effect. It supplements European law, the GDPR. If you can completely answer a legal question just by reading the GDPR, you’re done. More often than not you’ll find the phrase “Union or Member State law” or similar. Then you’ll still need to head to the national law.
  • The GDPR is not “aware” of national laws and respective court decisions. You cannot simply transfer ideas, principles familiar from the BDSG to the GDPR, although you’ll still recognize some concepts. You must be aware of this, should a dispute be referred to the ECJ.
  • In practice, the changes are comparable to any major change in law, regardless of the subject or which government level enacted the act. National regulators are still in charge in enforcing data protection rights and some will be glad to assist you to bring you up to speed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .