German Data Protection Under Strain: 84% of Officers Juggle Multiple Roles as Government Plans Major Overhaul

A growing mismatch between legal requirements and day-to-day corporate reality is leaving Germany’s data protection framework exposed. New survey data reveals that the vast majority of those tasked with safeguarding personal information are barely scraping by, often combining the role with unrelated duties.

Part-Time Protectors

Research firm Dury Consult polled 500 companies with more than 500 employees during April and May. The findings are stark: only 16 percent of data protection officers work exclusively on this topic. The remaining 84 percent split their time — 22 percent also handle IT security, 17 percent quality management. In 17 percent of cases, the officer is a managing director or board member.

Experts warn that such overlap creates glaring conflicts of interest. When the IT director, for instance, is expected to audit their own systems, independence becomes almost impossible.

The pressure is taking a toll. More than a third (37 percent) of officers cite rising complexity as their biggest headache, while one in four reports acute time shortages.

Reform Plans Ignite Debate

While companies struggle, Berlin is preparing a sweeping turnaround. After coalition committee talks in early July, the government announced a package that would free 99.3 percent of all German businesses from key GDPR obligations.

The centrepiece is a blanket exemption for small and medium-sized enterprises and non-profit associations. The requirement to appoint an in-house data protection officer would be drastically reduced. Supervision would also be centralised under the Federal Commissioner for Data Protection.

State-level data protection commissioners have pushed back, warning that the plan risks weakening oversight entirely. Their counter-proposal: a risk-based approach that considers more than just company size.

Real-World Risks, Real Penalties

Violations already carry heavy consequences — fines of up to 20 million euros or four percent of global annual turnover, plus potential personal liability for executives.

A May 22 ruling from the Siegburg Labour Court illustrates the danger. A physician was ordered to pay 1,000 euros in damages for sharing patient data via a messenger chat. Such cases are becoming more common as digital communication blurs boundaries.

Termination Traps and Parental Leave Protections

Meanwhile, recent Federal Labour Court decisions have tightened procedural rules. On May 7, the court ruled that a standard "Einwurf-Einschreiben" (recorded delivery letter) no longer suffices to prove a termination has been received. Germany's postal scanning practices have undermined the statistical presumption. Lawyers now recommend personal handover or courier delivery.

Another ruling on June 18 clarified that parental leave protection from dismissal arises anew for each separate parental leave period — even when they are applied for jointly. This protection applies irrespective of probationary status or company size.

AI in Hiring Adds a New Hazard

Artificial intelligence is introducing fresh legal risk into human resources. In the United States, a lawsuit filed on July 14 against Meta alleges that former employees were dismissed based on an AI-generated score. In Germany, such a practice would be illegal, experts say, violating co-determination rights and data protection laws.

The EU AI Act classifies these systems as high-risk applications. Non-compliance can trigger fines of up to 15 million euros or three percent of worldwide turnover.

NIS2 Deadline Looms

Adding to the pressure, around 29,500 organisations in Germany and Austria must register with the Federal Office for Information Security (BSI) by July 31 if they fall under the NIS2 directive. A May survey found that more than half of IT security managers had not yet checked whether their organisation needed to register. The clock is ticking.

en | boerse | 69778654 |