In its decision of March 11, 2021, the data protection authority once again affirmed its competence vis-à-vis public prosecutors’ offices and went on to state that the simple-law provisions of the Code of Criminal Procedure also had to be interpreted in the light of the constitutional provision of the
§ Section 1 of the Data Protection Act and the data minimization obligation under EU law.
The starting point of the appeal proceedings was a uniformly conducted preliminary investigation, in the context of which the competent public prosecutor’s office granted the second defendant full access to the files (Section 51 of the Code of Criminal Procedure) as requested. This included, among other things, a medical report which had been drawn up on the basis of a bodily injury offense of which the first defendant had been accused, but which had no factual connection whatsoever with the second defendant’s offense. The data protection authority upheld the complaint filed by the first defendant on the grounds of a violation of the right to confidentiality, stating that data processing by the competent law enforcement authorities must always be reviewed for proportionality (data minimization obligation), irrespective of any legal basis.
The decision is not legally binding.