Paragraph 3 of the Federal Data Protection Act (BDSG) defines essential terms in German data protection law.
- “Personal data” means all individual details of personal and factual circumstances of a certain or determinable person.
It is considered a comprehensive protection and the word “individual indication” is not restricted. A differentiation between “personal” and “factual” circumstances is not crucial in practice. If there is a personal reference, then all types of information are handled equally. Furthermore, the direct reference to a natural person is not necessary. It is enough that the reference can be established indirectly – for example, by a procedure of exclusion. For practical purposes, the means of determinability are not limited to the individual possibilities of the processing body; crucial are any humanly possible means to create a personal reference.
- “Sensitive data” means special personal data. It is exclusively regulated in § 3 (9) BDSG, including data about
- the racial and ethnic origin
- political opinion
- religious or philosophical conviction
- Union affiliation
- Health or
- Sexual life.
The data listed above is subject to a tight prerequisite for possible processing or use and must be treated differently depending upon the usage context.
- “Collecting” of data is procuring data from the data subject ( 3 (3) BDSG).
- “Processing”: § 3 (4) BDSG differentiates under the generic term of “processing” the following five procedures:
- Saving (§ 3 (4) no. 1 BDSG) means recording, capturing or retaining personal data on a data carrier for further processing or use.
- Changing (§ 3 (4) no. 2 BDSG) is the content-related transforming of saved personal data
- Transmitting (§ 3 (4) no. 3 BDSG) describes the disclosure of personal data to a third party in such a way that it is forwarded or kept ready for viewing and to ensure access.
- Blocking (§ 3 (4) no. 4 BDSG) means marking personal data to restrict further processing or use.
- Deleting (§ 3 (4) no. 5 BDSG) means obfuscating saved, personal data.
- “Using” (§ 3 (5) BDSG) is described negatively and thus comprises each use of personal data, which is not considered processing (see above).
- “Anonymising” (§ 3 (6) BDSG) means changing personal data in such a way, that the individual details can no longer be associated (Var. 1 – absolute –) or can only be associated with a disproportionately large expense of time, costs and manpower (Var. 2 – factual –) to a specific or a specifiable natural person.
- “Pseudonymising” does not include omitting (anonymising), but instead replacing or distorting personal data with the purpose to prevent the determinability of the data subject and to impede it substantially. In case of pseudonymising, there always remains the possibility of association for the responsible authority.
- “Responsible authority” (§ 3 (7) BDSG) is each person or authority, which collects, processes or uses personal data for itself, or allows this to be done on its behalf. Using a service provider does not change anything with regard to the actual responsibility.
- “Data subject” and “third party”: A “data subject” is the specific or specifiable person mentioned in § 3 (1) BDSG, whose personal data is processed or used. The term of “third party” is described negatively in § 3 (8.2) and (8.3) BDSG. A third party is every person or authority outside the responsible authority, so long as it is not the data subject or contract data processing.
Associated or group companies are viewed individually from a data protection perspective and are always identified as independent responsible bodies or third parties. An intra-group data transfer of personal data, thus, cannot take place without a legal basis.
- “Employee”: The BDSG contains special provisions for the use of employee data (§ 32 BDSG). For this purpose, the term of an employee is defined in § 3 (11) BDSG. This includes:
- in recognised workshops for disabled people Employee
- as per the voluntary service for young people Employee
- Persons similar to employees on the basis of economic dependence (in people working from home and their equals)
- Applicants for an employment relationship
- as well as former employee
- Judges of the Federal government and
- Soldiers and persons doing communal service.