In Germany, data protection is regulated though the Federal Data Protection Act. A ruling by the Constitutional Court from 1983 on informational self-determination specified the right to data protection.

The Federal Data Protection Act came into force in 1977. Since then it has been updated at various instances, and has progressively been adapted to European and international guidelines.

The Federal Data Protection Act applies to both public authorities and private parties, including private law companies, unions, political parties, freelancers or associations. It specifies the conditions, under which federal public authorities may collect data. A legislative act must form the legal basis for a survey. In addition, the surveyed individuals must explicitly agree to the collection of sensitive data, such as religious affiliation or ethnic identity. Private entities are subject to equally strict conditions.

Besides the requirement of explicit consent, there must be a legitimate justification for the collection of data. Thus, the measure must be vital or of important interest. Furthermore, data may only be collected if it has been made public by the surveyed individual. In addition to the collection of data, the processing and use of data is also regulated through similar requirements. Such limitations may inlfuence or determine whether previously collected information may be processed. If collected improperly the further storing or analysing of such data is prohibited.

In 1983, the Federal Constitutional Court set a precedent concerning ‘the right to informational self-determination’. This right aims to strengthen the protection of privacy, particularly in the light of modern data processing. The judgement confirms people’s self-determination over their personal data, meaning that individuals may decide when, and to what extent their personal information is revealed. This also implies that based on the principle of self-determination, people may refuse to provide information. Even though it does not explicitly mention it, the right to informational self-determination has been derived from the German Basic Law (Grundgesetz, GG). It stems from the right to personality, the freedom of action (art. 2 para. 1 GG), as well as human dignity (art. 1 para. 1 GG). It therefore enjoys constitutional protection. In Germany, the terms ‘data protection’, and ‘right to informational self-determination’ are synonymous.

The State Data Protection Laws apply to the respective state authorities, i.e. state agencies and municipalities. In particular, they stipulate the legal basis for the respective State Data Protection Commissioners.

Although there is robust legal framework in place to protect personal and sensitive data, it can be assumed that is not fully applied in all of Germany. For example, in 2005 it came to light that the police in several states used software which recorded the sexual orientation of suspects without their knowledge.