Competence of the Federal Commissioner for Data Protection and Freedom of Information (BfDI)
Germany has a federal system of data protection supervision, which consists of the data protection supervisory authorities in the federal and state (“Länder”) governments. In addition, in the area of broadcasting, press, churches and religious communities, there also exist separate supervisory bodies.
The BfDI’s competence in the field of data protection covers, on the one hand, the data protection supervision of public authorities in the federal government. On the other hand, the BfDI supervises compliance with data protection law at companies providing telecommunications or postal services or falling under the Security Clearance Check Act. However, for the majority of companies in the private sector as well as for clubs, associations or freelancers, the BfDI is not competent, but the Länder supervisory authorities.
What exactly does that mean?
Therefore, the BfDI is competent for the following bodies:
- Federal authorities, e.g.
- Federal Offices including the Federal Security Authorities
- Federal Institutes (e.g. Federal Institute for Drugs and Medical Devices, Robert Koch Institute or Johann-Heinrich-von-Thünen-Institute)
- Federal corporate bodies, institutions and foundations under public law, among others
- Joint institutions of the Federal Employment Agency and the municipalities – so-called job centres
- The German Statutory Pension Insurance Scheme (“Deutsche Rentenversicherung Bund”)
- Statutory health insurance with the exception of AOKs and some health insurance funds
- Prussian Cultural Heritage Foundation (“Stiftung Preußischer Kulturbesitz”)
- Deutsche Welle (Germany’s international broadcaster), insofar as it processes personal data for economic-administrative purposes
- Tax authorities of the Länder in so far as they process data within the scope of the Tax Code (e.g. in the case of income tax) and local tax offices, insofar as they process data on impersonal taxes (taxes on real estate or business taxes) in accordance with the Tax Code
- Competitor companies under federal public law, e.g.
- KfW Bank
- Deka Bank
- Courts of the Federation in so far as they act in administrative matters
- Telecommunications or postal services providers only to the extent that they process personal data for the provision of such services; other business areas or areas of work of these companies (e.g. participation in address trading or employee data protection) do NOT fall under the BfDI’s competence
- private companies covered by the Security Clearance Check Act (SÜG)
In all other cases, please contact the data protection commissioner of your federal state, the data protection supervisory authority for the non-public sector or the specific supervisory bodies in the area of broadcasting, the press, churches and religious communities.