Following a significant fine against the parties to an
asset acquisition for illegally transferring customer information,
the Bavarian Data Protection Supervisory Authority (Bavarian DPA)
announced on August, 20, 2015 that it has fined a company that
engaged a service provider based on a data processing agreement
which did not meet the requirements of Section 11 of the German
Federal Data Protection Act (FDPA). The technical and
organizational measures of the service provider were not specified
as required by Section 11 of the FDPA.
Background
Since 2009, companies that engage service providers to process
personal data must enter into a very specific data processing
agreement. The FDPA sets forth various required provisions to be
included in such an agreement. For example, the parties must agree
that data processing operations will comply with the customer's
(data controller's) instructions, that the customer will have
audit rights that the processor will abide
