Data Protection Officer and Trade Law

Data protection is fundamentally anchored in other legislation, currently still in the Federal Data Protection Act and, since May 25, 2018, in the EU General Data Protection Regulation, as well as in the supplementary new version of the Federal Data Protection Act.

Data protection officers and trade law – how are these two topics linked?

When a business is registered or notified, a significant amount of personal data is collected from the respective business operators. This data is primarily used to assess the professional reliability of the business operator under trade law.

Section 11 of the Trade Regulation Act (GewO) supplements the corresponding data protection provisions of the GDPR, specifically regarding the collection, use, and processing of data in the context of trade licensing requirements. Prior to the amendment of the Trade Regulation Act in 1995, many data protection officers in the field of trade law had called for such data protection provisions to be included in the Act. The background to this was a need to clarify data protection requirements for the extensive personal data collected in various trade-related procedures.

This need was identified primarily because trade licensing procedures involve extensive access to personal data from various areas that, at first glance, seem only tangentially related to business operations. Examples include checking data not only from trade-related procedures and criminal or administrative fine proceedings, but also from settlement or insolvency proceedings, tax and social security matters, and immigration and work permit procedures.

For a long time, data protection and trade law were therefore seen as being in tension, which prompted data protection advocates to call for the addition of general data protection legal bases to the Trade Regulation Act.

This also concerned the almost routine transfer of data from trade-related procedures to other agencies. Examples include chambers of industry and commerce, chambers of crafts, state occupational health and safety authorities, and the Federal Employment Agency.

Therefore, in addition to Section 11 GewO, Section 14 GewO was also linked to data protection. Section 14 GewO regulates which data may be transferred to other agencies for what purpose in the context of trade licenses.

Since these provisions were included in the Trade Regulation Act, data protection and trade law have been harmoniously linked once again.

Legal bases for data protection

Despite these data protection provisions, the Trade Regulation Act does not become a primary, standalone legal basis for data protection that sets its own independent requirements. Rather, the data protection provisions in the Trade Regulation Act must always be viewed in the context of general legal bases, especially in connection with the EU General Data Protection Regulation. The data protection provisions in trade law can be seen as implementing regulations for general data protection rules.

However, according to the prevailing opinion in legal commentary, the more specific regulation of Section 11 GewO takes precedence over general data protection rules. This is intended to apply at least as long as Section 11 of the Trade Regulation Act does not itself refer to other, more general data protection provisions.

This view applied, at any rate, in relation to the old Federal Data Protection Act. Whether it also applies in relation to the EU General Data Protection Regulation has not yet been conclusively clarified. It is possible that the topic of data protection officers and trade law will become relevant again as the EU General Data Protection Regulation becomes binding. A reference in Section 11 GewO to the EU General Data Protection Regulation might become necessary.

Ultimately, however, this is likely to be of less significance for private-sector companies, as it is primarily public-law bodies that are involved in the corresponding data collection and transfer in the context of trade licenses.