New government data strategy – potential impact on companies

published on 11 September 2023 | reading time approx. 3 minutes

On 30 August 2023, the German Federal Cabinet approved the new national data strategy "Progress through Data Use" presented as part of a digital initiative. The strategy, which was jointly developed by the Federal Ministry of Digital Affairs and Transport (BMDV), the Federal Ministry of Economics and Climate Protection (BMWK) and the Federal Ministry of the Interior Homeland (BMI), further develops the previous data strategy and focuses in particular on better data for new, effective and forward-oriented data use. The data strategy includes, among other measures, various legal changes up to and including the fourth quarter of 2024. The main changes are outlined below, together with any practical implications for companies.

Content Overview

The almost 40-page strategy, focuses mainly on the quality and quantity of data used and appeals in particular to civil society groups, business enterprises and re-search institutions as key players to support the willingness to share data voluntari-ly. Through joint use, new economic potential is to be developed and the basis for more progress is to be created. The tension between expanding access and use of data on the one hand, and compliance with the fundamental right to informational self-determination on the other, should always be given appropriate consideration.

Legislative changes

With reference to key projects from the coalition agreement, the new data strategy outlines, among other implementation measures, the federal legislation intended by the end of 2024. The Health Data Use Act, which has already been announced for the third quarter of this year, will have little impact on the majority of company prac-tice. However, the changes to the Federal Data Protection Act planned for the end of 2023 (Q4) and the creation of an Employee Data Protection Act are likely to have a much more significant impact. Unfortunately, the data strategy does not provide any concrete information on the content or scope of the legal changes or innova-tions, apart from nebulous references to "modern, manageable" employee data pro-tection. At least, however, the aforementioned standards give hope for a practical implementation that, contrary to many other amendments to data protection law, could lead to more legal certainty for users.

Assistance for private individuals and companies

In addition to legislative measures to implement the goals set out in the data strate-gy, practical instruments are also being sought to support private individuals and companies. These include, for example, the low-threshold provision and accessibil-ity of sample contracts and sample contract clauses from the areas of data privacy and IT security. This is intended to contribute to the establishment of a uniform and legally

secure best practice in dealing with relevant (legal) regulations. A particular focus will be placed on the transfer and sharing of data between different players. Fur-thermore, data cooperation between companies, in which there is a considerable economic and legal interest, is to be promoted in the future through the further de-velopment of legal frameworks under competition law and, in particular, antitrust law. The long-term goal is to make Germany an attractive location for investments in the data economy.

Data protection authorities

With the aim of facilitating and standardizing the practical implementation of data protection at national and EU level, the new data strategy also provides for a num-ber of changes for the data protection supervisory authorities. On the one hand, it is intended to strengthen the Conference of Independent Data Protection Authorities of the Federal Republic of Germany (DSK) by institutionalizing it in the Federal Data Protection Act. In addition, national data protection supervision is to be standard-ized to a greater extent. In view of the sometimes widely differing views and imple-mentation practices of the state authorities, standardization to counteract this is also very welcome in the interests of legal certainty for companies. In this context, it should be examined to what extent it is possible to have a single data protection supervisory authority responsible for cross-border, jointly managed data processing.

Outlook

In addition to the points outlined above, the new data strategy contains many other, some long overdue, approaches to promote innovative handling of data. The paper may be limited to explanations of the intended strategy that are both pleasant-sounding and also lacking in contour. Regardless of this, the initiative is a step in the right direction and gives hope that the intended measures will also have an im-pact in practice. If the changes do have an impact, companies should benefit above all from greater legal certainty in connection with the processing of personal data. The new Employee Data Protection Act, which promises to make the handling of employee data more manageable, is to be expected with particular excitement. Ul-timately, only a continuous review of the measures actually implemented from the end of 2023 will show to what extent the new strategy can meet the expectations placed on it.

Find the data strategy here (German language).