Data Navigator: Personenbezogene Daten im Data Act

In episode 47 of the Data Navigator podcast, Martin Schirmbacher and Hubertus von Rönne address a topic that has been repeatedly used as a trump card since the Data Act came into force: the GDPR as a supposed blocker for data disclosure claims. The impetus for this discussion is, among other things, the third think tank on the Data Act hosted by the Federal Commissioner for Data Protection and Freedom of Information, which took place last week. The starting point is clear: the Data Act explicitly applies to personal data. In case of conflict, the GDPR takes precedence – but such conflicts rarely arise in practice. The key tool for resolving these perceived tensions is the concept of relative personal data: whether data is personal data is not assessed abstractly, but rather from the perspective of the respective data controller. Martin and Hubertus illustrate this with the example of bus drivers: For Berlin's public transport company, BVG, driver data is personal data – they know who drove which bus and when. For the bus manufacturer, who only receives vehicle data without login, this connection is generally lacking. In the wind farm example, the situation can be reversed: The manufacturer knows its maintenance staff, while the wind farm operator generally does not. This leads to an important intermediate conclusion: The same data set can be personal data for one party and not for the other – and in the Data Act scenario, it is often the recipient who cannot establish a link to a specific person. Where a link to a specific person does arise for the recipient, they need a legal basis under the GDPR – typically legitimate interests. The manufacturer, in turn, can rely on Article 6(1)(c) GDPR (legal obligation under the Data Act) for the transfer. In the final section, Martin and Hubertus clarify the issues of jurisdiction: The Federal Network Agency (Bundesnetzagentur) is the lead agency for Data Act complaints but must involve the Federal Commissioner for Data Protection and Freedom of Information (BfDI) as soon as personal data is involved. The state data protection authorities remain responsible for classic GDPR violations – for example, if a farmer does not want John Deere to process his personal data.