Data Protection Acts of the Federal States adapted to the GDPR

About four weeks after the GDPR entered into force, the State Data Protection Acts of the German Federal States were adapted and the regulations of the specific states entered into force. In some Federal States regulations other than the specific State Data Protection Act were also adapted already, although further adaptations were of course needed in every Federal State.

The overview below contains the URLs for the State laws; where available, links to the Law and Ordinance Gazettes of each Federal State are also given:

1. Baden-Württemberg:
   State Data Protection Act (LDSG)
   Law Gazette for Baden-Württemberg dated 20 June 2018
2. Bavaria:
   Bavarian Data Protection Act(BayDSG)
   Bavarian Law and Ordinance Gazette dated 15 May 2018
3. Berlin:
   Law on the protection of personal data in the Berlin administration (Berlin Data Protection Act – BlnDSG)
   Berlin Law and Ordinance Gazettedated 23 June 2018
4. Brandenburg:
   Law on the protection of personal data in the State of Brandenburg (Brandenburg Data Protection Act – BbgDSG)
   Law and Ordinance Gazette for the State of Brandenburg dated 8 May 2018
5. Bremen:
   Bremen Act on the implementation of the EU General Data Protection Regulation(BremDSGVOAG)
   Bremen Law Gazette dated 11 May 2018
6. Hamburg:
   Hamburg Data Protection Act (HmbDSG)
   Hamburg Law and Ordinance Gazette dated 24 May 2018
7. Hesse:
   Hessian Data Protection and Freedom of Information Act (HDSIG)
   Law and Ordinance Gazette for the State of Hesse dated 9 May 2018
8. Mecklenburg-West Pomerania:
   Data Protection Act for the State of Mecklenburg-West Pomerania (State Data Protection Act – DSG M-V)
   Law and Ordinance Gazette for Mecklenburg-West Pomerania dated 22 May 2018
9. Lower Saxony
   Lower Saxony Data Protection Act(NDSG)
   Lower Saxony Law and Ordinance Gazette dated 16 May 2018

• North Rhine-Westphalia:
  Data Protection Act North Rhine-Westphalia (DSG NRW)
  NRW Law and Ordinance Gazettedated 24 May 2018
• Rhineland-Palatinate:
  State Data Protection Act(LDSG)
  Law and Ordinance Gazette for the State of Hesse (Page 93, 204-1) dated 8 May 2018 (Note: the Law and Ordinance Gazette for the State of Rhineland-Palatinate is not available online.)
• Saarland:
  Saarland Data Protection Act
  Official Journal of Saarlanddated 24 May 2018

13. Saxony:
    Saxon Data Protection Implementation Act
    Saxon Law and Ordinance Gazettedated 24 May 2018 (Note: SächsGVBl available at a fee, for the law for adaptation see REVOSax)
14. Saxony-Anhalt:
    Law on the protection of personal data of citizens (Data Protection Act Saxony-Anhalt – DSG LSA)
    Law and Ordinance Gazette for the State of Saxony-Anhalt Page 10 (Note: The Law and Ordinance Gazette for the State of Saxony-Anhalt is not available online.=

• Schleswig-Holstein:
  Schleswig-Holstein Law on the protection of personal data(State Data Protection Act – LDSG)
  Schleswig-Holstein Law and Ordinance Gazettedated 17 May 2018
• Thuringia:
  Thuringia Data Protection Act (ThürDSG)
  Law and Ordinance Gazette for the Free State of Thuringiadated 14 June 2018

The future will show to what extent specific State laws comply with GDPR specifications and requirements. The following was agreed under the Treaty of Lisbon (Section C 83/344, Chapter 17, Official Journal of the European Union dated 30 March 2010):

“The Conference points out that the treaties and laws based on the treaties and enacted by the Union are consistent with established jurisdiction of the European Union court of justice under the conditions stipulated in this case and will take precedence over the laws of member states.” The GDPR thus takes precedence over State laws, i.e. the GDPR shall be applied in case of conflict between national and European law. Practice will here need to demonstrate the extent to which specific state laws comply with the European regulations, i.e. whether changes to some laws are still needed.

Author: Dr. Bernd Schütze