In this Insight article, Daniela Schott and Kristin Bauer, from KINAST, elaborate on the Orientation Guide of the Committee of Independent German Federal and State Data Protection Supervisory Authorities - the German Data Protection Conference (DSK) - on artificial intelligence (AI) and data protection. The guide was published on May 6, 2024, and outlines data protection criteria necessary for the compliant use of AI applications and serves as a guideline for their selection, implementation, and use.

New regulations on contracts for digital products have been in force in Germany for just over a year. These new regulations transpose the Directive on Certain Aspects Concerning Contracts for the Supply of Digital Content and Digital Services (Directive (EU) 2019/770) ('the Digital Content Directive') into German law. Thorsten Ihler and Melanie Ludolph, from Fieldfisher, discuss the implications of the new provisions under the German Civil Code ('BGB') in terms of data protection, resulting from the transposition of the Digital Content Directive.

With an increasing focus on Environmental, Social, and Governance ('ESG') across all sectors, businesses are required, and legally bound, to observe specific human rights and environmental due diligence obligations. This Insight article gives an overview over the German Supply Chain Due Diligence Act in German Lieferkettensorgfalts­pflichtengesetz (LkSG) ('the Due Diligence Act'), which will enter into force on 1 January 2023, and discusses its scope of application, definitions, and key requirements.

According to the conception of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), data protection officers ('DPOs') play an important role in the protection of personal data. Their activity serves a regulated self-control of the controller or processor, the advantage of which lies not least in the relief of public authorities. Their appointment is mandatory for all public and many private entities. The activity of a DPO requires knowledge of data protection law and includes providing advice on data protection issues. In Germany, however, the provision of legal services is regulated, among other things, by the German Act on Out-of-Court Legal Services¹ ('RDG'). It is questionable whether this also imposes special requirements on the DPO. Stefan Hessel, Attorney-at-Law and Co-Head of Digital Business Unit at reuschlaw Legal Consultants, sheds light on the topic.

On 20 December 2021, the German Data Protection Conference ('DSK') published the long-awaited guidelines ('the Guidelines') on the new Federal Act on the Regulation of Data Protection and Privacy in Telecommunications and Telemedia of 23 June 2021 ('TTDSG'). The Guidelines consider both the provisions of the TTDSG, which has been applicable since 1 December 2021, and those of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'). Within the Guidelines, the German authorities provide companies with a clearer picture on the most relevant questions around the usage of cookies and similar technologies. There is currently a public consultation going on and it is likely that there will be some form of additions, specifications, and possibly also small changes to the current version.

In part one of a two-part series, Philipp Quiel, Counsel at Piltz Legal, provides an overview on the DSK's opinions regarding the scope of applicability, legal basis, explicit requests, and strict necessity under the TTDSG. Part two covers consent and next steps for companies.