According to Art. 45 Para. 1 GDPR, “[a] transfer of personal data to a third country or an international organisation may take place where the [European] Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection. Such a transfer shall not require any specific authorisation.”

The Commission has adopted a so-called “adequacy decision” so far with respect to the following countries: Andorra, Argentinia, Canada (limited to commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Switzerland, Uruguay and the United Kingdom. Data transfers to such countries are treated equally as transfers within the EU/ EEA.

On the contrary, transfers to so-called unsafe third countries – countries that, from the EU’ Commission’s perspective do not provide an adequate data protection regime – regularly require a special “safeguard” to ensure a compliant processing.

Among the possible safeguards for data transfers to unsafe countries listed in Art. 46 Para. 2 GDPR are the so-called “Standard Data Protection Clauses” adopted by the European Commission. The Clauses contain mandatory rules partly individually designed for the four possible transfer constellations: EU-controller to non-EU-controller, EU-controller to non-EU-Processor, EU-processor to non-EU-processor and EU-processor to non-EU-controller. For instance, the Clauses’ module for EU-controller to non-EU-processor must be chosen where the solutions of a US IT service provider are sought, provided that the latter is able to access the controller’s personal data in the course of the service provision.

A suitable alternative to the Standard Data Protection Clauses regarding data transfers occurring between companies of the same business group are the so-called “Binding Corporate Rules” for which Art. 47 Para. 2 GDPR stipulates basic content requirements.

Neither the Standard Data Protection Clauses nor the Binding Corporate Rules need to be put in place if a derogation according to Art. 49 Para. 1 GDPR applies. Important examples for such derogations are the data subject’s explicit consent to the transfer (Art. 49 Para. 1 lit. a GDPR) and the transfer’s necessity “for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken at the data subject’s request” (Art. 49 Para. 1 lit. b GDPR).

The GDPR also applies, according to Art. 3 (2), to controllers or processors not established in the EU if they are processing personal data of data subjects in the EU with the intention of offering them chargeable or non-chargeable goods or services. As a consequence, the GDPR applies to non-EU companies that are promoting their products to people living in the EU, e.g. by offering a respective delivery destination.

Furthermore, the requirements of the GDPR must be fulfilled by controllers or processor who monitor the data subject’s behavior – e.g. by performing website tracking – if this behavior takes place within the EU (Art. 3 (2) (b)). Finally, the GDPR applies where Member State law is applicable by virtue of international law (Art. 3 (3)).

Data processings conducted by controllers or processors outside of the EU/EEA must comply with the GDPR if the data processing takes place “in the context of the activities” of a controller’s resp. processor’s establishment’s activities (Art. 3 (1)). Hence, as long as the processing is organized and maintained by an EU/EEA-based establishment, the GDPR applies.

A data processing, as defined in Art. 4 (2) GDPR, means “any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means”. Art. 4 (2) contains a non-conclusive list of examples for such an operation including the collection, recording, storage, disclosure by transmission and dissemination of personal data. Not only “constructive” operations, but also the erasure and destruction of personal data are mentioned as possible operation forms.

While the GDPR applies undisputedly to all electronic data processings (“wholly or partly by automated means”, Art. 2 (1)), non-electronical processings are only covered if the data (is to) form part of a filing system. The term filing system is defined in Art. 4 (6) and means “any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis”.

The data protection’s purpose is to enable the person’s impartial and unworried participation in social life by regulating the use of personal information by entities that may potentially hinder the person from expressing themself and actively taking part in social life, e.g. by spreading political opinions or engaging in economical activities. Such “hindering entities” may be public offices, credit agencies or employers.

In spaces, where such risks do not prevail – among family members, friends or even close colleagues – the GDPR does not apply if the processing of personal data is conducted “by a natural person in the course of a purely personal or household activity” (Art. 2 (2) (c)). As a result, data protection law must not be complied with as long as friends, family members (or other intimate conversation partners) keep the information private. However, where the intimate conversation circle is broken by one or several communication partners and information is disclosed to third parties, the GDPR applies again.

According to Art. 4 Para. 1 GDPR, “an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”. The legislative text mentions the person’s name only as one example for an “identifier”. Hence, not only the name, but everything that contributes to the individualization of a person must be considered personal-related.

Furthermore, data may be personal-related even though the person’s civil identity – name, address, birthdate etc. – remains concealed. In other words: The identification of a person is not a prerequisite for the assumption of personal data; an individualization suffices. A prominent example for an individualization without identification is the tracking of website browsing activities by means of cookies, canvas fingerprinting or other technologies: The targeted advertising based on individual tracking profiles is possible without knowledge of the person’s civil identity.

Sometimes, the person’s name is not only not necessary but even useless for the individualization – and is therefore not personal data. This can be the case for very common names such as “Müller” or “Meier” if those are mentioned in a context where it is impossible to assign them to particular persons.

As a result, it is only the context in which a particular data is being communicated that allows for a definite assertion as to whether data is personal-related or not.

Data must be considered anonymous if it has no (more) potential to individualize a person. This typically holds true for statistics whose purpose is to evaluate behavior or characteristics of a group but not of individual data subjects.

However, even statistical data may be personal-related if the selection criteria for the group’s composition unveil a group member’s identity. This is possible if particular criteria (e.g. “female” or “older than 60 years”) occur only once within the group. In this case, the aggregation method used to conduct the statistical analysis proves ineffective in terms of anonymization.

While the “aggregation method” aims at diluting the individual character of a dataset by compiling it with datasets of other data subject’s, the “removing method” focuses on data elements within a dataset: The removal of identifiers such as the person’s name or the person’s birth date may lead to a “paling” of the dataset. In many cases, a combination of the aggregation and the removing method is required to successfully achieve anonymity.

A third method that can generate anonymity is encryption. Like the other two methods, the effectiveness of encryption depends heavily on “objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments” (Recital 26 S. 4 GDPR).

Therefore, if an anonymization method such as MD5 has failed to resist attempts of reidentification, it must be considered ineffective from that time on. This is why technical developments such as the emergence of new hacking strategies demand a continuous check as to whether a once selected encryption methods still upholds anonymity.

Traditionally, consent is seen as a core element of data protection as it grants the person the explicit right to say “yes” or “no” to a processing of their data. This absolute right, to refrain from confirming a data processing or – from the business’s perspective even worse – to withdraw consent that had once been given, is a main reason why, for most data processings, consent is not a suitable legal basis.

Furthermore, where the data subject is existentially dependent on the controller, consent must often be deemed invalid. This is the regular case for many data processings in the employment context if the employee is, objectively speaking, not in the position to agree in a voluntary way.

As a result, consent should be obtained only if the following three prerequisites are met: (1) the potential confirmation of the data subject can, in the absence of any explicit or implicit pressure, be deemed voluntary (2) the processing is not indispensable for the company and (3) it is organizationally and technically feasible to exclude data subjects from the processing who are either not willing to consent or, at a later stage, withdraw their permission. These criteria usually apply e.g. to marketing data processings.

Only for exceptional cases – especially when sensitive data according to Art. 9 GDPR is processed – consent must be sought despite data processing being indispensable for the controller.

In the sense of the GDPR, valid consent requires a “clear affirmative action” (Recital 32 S. 1). This means “a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement.”

Despite the possibility of “unwritten” consent (e.g. oral, see above), recorded consent is highly recommended as Art. 7 Para. 1 GDPR expects the controller to be able to prove the person’s assent. There should thus be no doubt about their positive attitude towards the data processing. This, in turn, requires the person to be fully aware of essential processing circumstances such as the purpose(s), the data categories and the data recipients. This information must be given in a clear and specific way.

According to Art 13 Para. 2 lit. c GDPR, the data subject has also to be informed of their right to withdraw the consent at any time “without affecting the lawfulness of processing based on consent before its withdrawal”.

Granting consent may, according to Art. 7 Para. 4 GDPR, not unnecessarily be made conditional for the performance of a contract. In a similar way, it is not permissible to combine multiple, different purposes in a consent form seeking just one approval; each independent purpose must be independently approvable.

From a data protection point of view, consent for marketing operations is generally required if the company’s legitimate interests (Art. 6 [1] [f] GDPR) do not override the fundamental rights and freedoms of the data subject. This is particularly the case where the data categories used for the marketing operation are to be considered highly sensitive. The latter is regularly the case with special categories of personal data (such as health data) or location-based marketing.

A risky and therefore consent-requiring marketing operation prevails as well if the data subject’s profile serves as marketing base. A profile might enable the analyzing and/ or predicting of aspects concerning the person’s economic situation, health, personal preferences, interests, reliability, behaviour, location or movements (Cf. Art. 4 No. 4 GDPR). As a result, where website tracking relies on data concerning the person’s search history or shown interests, consent is required even in the absence of highly sensitive data categories.

Finally, the sensitivity of marketing operations may result from the applied marketing method: Other than written marketing, “lively” vocal advertisement must usually be considered more intrusive and requires the person’s prior approval.

Recital 47 (7) GDPR states that, “[t]he processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest” according to Art. 6 (1) (f) GDPR. This statutory clarification must, however, not be overestimated as the existence of a legitimate interest itself does not necessarily lead to an overriding interest.

In accordance with competition law that applies to the marketing activity as such, the mere usage of the person’s postal address for paper mail advertising may take place without the person’s consent if, as provided for in Section 7 (2) No. 1 UWG, it is not obvious – e.g. in light of an adblock sticker on the mailbox – that the person does not want to be advertised. In addition, a marketing activity without the prior consent of the person may, pursuant to Section 7 (3) in connection with Art. 6 (1) (f) GDPR, take place where (1) the person’s e-mail address has been obtained from the person in the context of the sale of a product or service, (2) the address is meant to be used for direct marketing of one's own similar products or services and (3) the person has not objected to the address’ usage. If these three conditions are fulfilled, the person may be advertised without prior consent provided that the right to object at any time is transparently commmunicated to the customer in the moment of data collection and then always when being used.

Depending on the individual processing circumstances, the data subject has, inter alia, the following rights: right to access (= What kind of data do you process about me?, Art. 15 GDPR), right to rectification (= You are processing incorrect data about me – please correct it!, Art. 16 GDPR), right to erasure (= I want my data to be deleted!, Art. 17 GDPR), right to restriction (= Stop using my data for operational purposes!, Art. 18 GDPR), right to data portability (= I want my data to be extracted in a structured, commonly used and machine-readable format in order to transmit it to another company, Art. 20 GDPR), right to object (= Stop using my data for marketing purposes or other legitimate reasons!, Art. 21 GDPR), right to withdraw consent (Art. 7 Para. 3 GDPR), right to lodge a complaint with a supervisory authority (Art. 77 GDPR) and right to compensation (Art. 82 GDPR).

All rights – except for the right to withdraw consent and the objection against direct marketing – are limited. For instance, the answering of an access right request may, according to Art. 15 Para. 4 GDPR, “not adversely affect the rights and freedoms of others”. “Others” include the data controller insofar as business secrets are concerned.

Despite often being claimed as an absolute right, the so-called “right to be forgotten” does not need to be satisfied where the processing is still necessary to fulfil a legitimate and overriding business interest.

Furthermore, some of the rights, namely the right to data portability, the right to object and the right to withdraw consent apply only if the respective processing is based on a particular legal basis.

Restrictions to the above-mentioned data protection rights may not only be found in the GDPR but also in the German Federal Data Protection Act, Sections 34 seq.