Criminal defense for Data Protection Offences in Bonn

In brief: Unauthorised transfer or processing of personal data that is not publicly available, for payment, on a commercial basis, or with intent to cause harm. The sentencing range is Up to 3 years imprisonment or a fine (subs. 1); up to 2 years (subs. 2); prosecuted on application only (subs. 3) (§ 42 BDSG). What matters is the evidence – we assess it after obtaining the case file.

Legal Basis

§ 42 BDSG

Sentencing Range

Up to 3 years imprisonment or a fine (subs. 1); up to 2 years (subs. 2); prosecuted on application only (subs. 3)

Summary

Unauthorised transfer or processing of personal data that is not publicly available, for payment, on a commercial basis, or with intent to cause harm.

The provision is almost always read too broadly. Section 42 of the Federal Data Protection Act does not criminalise every unauthorised processing of data; both subsections require an additional element that the complaint usually omits.

What subsection 1 requires

Up to three years of imprisonment or a fine applies only to a person who knowingly transfers, or otherwise makes accessible, personal data of a large number of persons that is not publicly available, without being authorised, and does so on a commercial basis. Four elements, then: a large number, not publicly available, no authorisation, commercial basis. Remove the commercial element and the subsection falls away.

What subsection 2 requires

Up to two years of imprisonment or a fine applies to a person who processes personal data that is not publicly available without authorisation, or obtains it by means of incorrect statements, and who acts for payment or with the intention of enriching himself or another or of causing harm to another.

From that follows the most important sentence on this page: looking data up out of curiosity is not a criminal offence. The employee searching the customer system for a neighbour, the police officer running a licence plate check for private purposes, the nurse looking into a patient file acts neither for payment nor with intent to enrich or to harm. That is a problem under employment and civil service law; under criminal law it regularly is not.

A complaint offence

Section 42(3) BDSG makes the offence subject to an application. Those entitled to apply are the data subject, the controller, the Federal Commissioner and the supervisory authority. Without an application from one of them there is no case, and the three-month period of Section 77b StGB applies here too.

The use prohibition in subsection 4

A notification under Article 33 GDPR or a communication under Article 34(1) GDPR may be used in criminal proceedings against the person obliged to notify, or against relatives within the meaning of Section 52(1) StPO, only with that person’s consent. The provision is rarely invoked but is decisive in corporate cases: a person who properly reports a data breach may not be punished for doing so.

Administrative fine proceedings under Article 83 GDPR and civil claims under Article 82 GDPR run in parallel. They apply different standards and should not be answered with a single statement.

Summons or accusation of Data Protection Offences? What matters now

Two things matter immediately: say nothing to the police about the allegation – you are never obliged to – and have your defense obtain the investigation file first. In detail: your rights as an accused person, responding to a police summons.

Possible discontinuation of proceedings

Not every case ends in a trial. Depending on the evidence and any prior record, the proceedings may be discontinued for lack of sufficient suspicion (§ 170 II StPO), for triviality (§ 153 StPO) or subject to conditions (§ 153a StPO). Often a penalty order without a public trial can be achieved.

Victim-offender mediation and restitution

In many cases, victim-offender mediation or making good the damage (§ 46a StGB) can significantly reduce the sentence or enable a discontinuation. Whether this is advisable in your case is something we assess based on the file.

What we do after reviewing the file

We assess the evidence, look for procedural errors and negotiate with the prosecution about a discontinuation.

Available 24/7: +49 228 504 463 36

This information does not replace a review of the individual case. In criminal proceedings, the defense strategy depends substantially on the case file, the specific allegation and the evidence.