Fact or Fake? 8 Questions regarding the General Protection Regulation

(Part 2/4)

In times of digitisation, countless opportunities are emerging for businesses, as well as completely new risks. “Data is the oil of the 21st century”, many people say. To further control the commercialisation of personal data and to limit incidents such as Cambridge Analytical and Facebook in the future, the European General Data Protection Regulation (GDPR) came into force on 25 May 2018. This regulation affects every member state of the European Union and is therefore binding for everyone. The impact of the GDPR on the handling of data is immense. Since the entry into force, however, there has been great uncertainty concerning the interpretation of the regulation. We will shed some light into this darkness and clear up with 8 common misunderstandings in the coming weeks.

Are businesses allowed to send customer satisfaction surveys with invoices?

The German Federal Court of Justice (BGH) ruled in its judgement on 10 July 2018 (VI ZR 225/17) that linking a customer satisfaction survey to an invoice is unlawful. Sending a customer satisfaction survey is categorised as electronic mail, even when combined with an invoice, for the purpose of advertising. Transmitting it without the consent of the affected person represents an interference with the protected privacy of the recipient.

Is the tax consultant considered a processor if he is only responsible for payroll accounting?

Collaborating with a tax consultant is a use of a third-party specialist service. Because of tax consulting law the tax consultant is autonomously responsible and works independently. Even if their utilisation is limited to payroll accounting they cannot refer to instructions of their clients. This opposes the requirement of subordination of the processor.

This means: If personal data is transmitted to a tax consultant, there must be a legal basis for the lawful processing of the data in accordance with Art. 6 GDPR (here: Art. 6 (1) lit. GDPR). This is also the case with other professional bearers of secrets such as accountants, lawyers or external company doctors.