Spotlight On Germany: Stricter Obligations And Sanctions For Data Breaches As Of 2018

Cyber-attacks have become a frequent theme in daily news. In Germany, the attacks on Deutsche Telekom and the parliament Deutsche Bundestag have proven that companies are regular and prime target for hackers. Cyber incidents like the attacks on Yahoo or Sony and many others show that criminals are especially interested in personal user information.

In case of such data breaches, pursuant to German data protection law, companies have to notify the responsible supervisory authority and the data subject. Those provisions are currently to be found in Section 42a of the German Federal Data Protection Act (BDSG). In order to strengthen and unify the data protection law within the European Union, the European Parliament and the European Council have adopted the new General Data Protection Regulation (GDPR) in April 2016 which will apply as of 25 May 2018.