To whom does the German &#39;Impressumspflicht&#39; apply? 'Impressumspflicht' is a law in Germany forcing people running a website to publish personal information like name, address, email, telephone number and so forth. If it is a commercial website, even more information needs to be provided like tax number, competent court and so on. My question is, what are the exact circumstances for this law to apply? I'm pretty sure it applies to people residing in Germany, even if the server hosting the website is not in Germany. But what about a foreigner or a German citizen not residing in Germany, but the hosting server is in Germany? Does the law apply then? Or if the website officially belongs to a foreign company? Thus, the variables in which I would like the application of said law to be examined are: Citizenship (German or not) Permanent residency (in Germany or not) Location of the server (in Germany or not) The possible implications of a foreign company It might also make a difference, if the foreign country is in the EU. Maybe the values should better read (Germany / EU / Rest of the World).
Disclaimer: Links are in German. My German is quite rough. Quoted translations provided by Google Translate. Turns out the question "Do I need an Impressum?" is complicated. I'll start with examining the case for companies, then work down to the average private citizen. Impressum requirement The requirement for an online Impressum comes from the Telemediengesetz (TMG) &sect;&nbsp;5: 1) Service providers are obliged to keep the following information readily available, readily accessible and constantly available for commercial, usually paid telemedia: the name and address under which they are established [...] Applicability based on country of origin The applicability of the TMG is described in &sect;&sect;&nbsp;2a, 3. Thankfully, there is a 2013 court case focused on these sections, involving an Egyptian company marketing cruises and not having a proper Impressum on their website. Also thankful is that law firm mth Tieben &amp; Partner summarized this decision, because as it turns out, I cannot read judicial German. Summarizing their summary, &sect;&sect;&nbsp;2a, 3 sets the standard that the required information is based on a country of origin principle (Herkunftslandprinzip), where if that country of origin is Germany, § 5 applies. However, this principle is rooted in EU directives, and as such is not applicable to non-EU countries. For these, the law falls back on the older principle of market location (Marktortprinzip). If the non-EU company advertises in Germany and thus participates in the German market, then it must have a valid Impressum. I'll note that, the TMG considers Germany to be the "country of origin" if the company is either registered in or has significant operations in Germany (see the given sections for specifics). This is not the same "country of origin" as is found in copyright law. Applicability to private website hosts As it turns out, an Impressum is not required for private non-commercial websites. However, as pointed out by this Anwalt article, the wording of the TMG makes it such that omitting an Impressum may often be illegal. In particular, the definitions section of the TMG provides very broad definitions of "Service provider" (Diensteanbieter): Service provider shall mean any natural or legal person who provides his own or third-party telemedia for use or provides access to use; in the case of audiovisual media services on demand, service providers shall mean any natural or legal person who effectively controls the selection and design of the content offered, and "commercial communication" (kommerzielle Kommunikation): Commercial communication means any form of communication which serves the direct or indirect promotion of the sale of goods, services or the appearance of an undertaking, other organization or a natural person engaged in trade, trades or crafts or a liberal professions; [...] Conclusion In terms of variables like the one you suggest, the proper "variable" for companies is the country of origin. For private web hosts, I would argue that residency is the closest analogue to country of origin as defined in TMG &sect;&sect;&nbsp;2a, 3. Location of server doesn't matter, and I don't think citizenship does either. With that in mind, the values would be: Germany: Required EU: Not required Rest of world: Required if advertised/directed in/towards Germany. with the caveat that truly private non-commercial websites never require an Impressum.
These documents constitute personal data and - in principle - you, as the subject, have the right to get a copy of them by issuing a "subject access request". The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form. (Art. 15 (3) GDPR) GDPR applies to controllers of any kind, including government organisations. The subject access request can usually be a simple email. The ICO has a template for this: https://ico.org.uk/your-data-matters/your-right-of-access/ (but keep it simple, you can literally just ask for "all personal data" they have on you; no need to speculate on what kind of data they may have). The subject access request is sent to the actual controller, but if you don't get a response to your request after 30 days, you can file a complaint with the supervisory authority (see here for Germany; note that federal institutions are supervised by the BFDI, not the data protection authorities of the Länder). Also note that you may have to go through some trouble to be properly authenticated by the controller. They do need to be certain that you are the data subject. There are also reasons why a controller can refuse to provide some or all of the information (e.g. if your request is clearly excessive or unfounded, if it's impossible to comply without violating another data subject's rights), but I would be surprised if any of those applied in your case. Your rights can also be restricted depending on the legal basis for processing. This includes rights that are illogical as well as some that provide special protection for processors: You can't object to processing based on consent (but you can revoke your consent), fulfilment of contract (but you can cancel your contract), a legal obligation on the part of the processor, or a vital interest (but you still have the right to erasure) Your right to portability and right to erasure does not apply if processing is based on a legal obligation or a public task (justice, parliamentary or government functions, statutory functions etc.) your right to portability also doesn't apply if processing is based on vital interest (e.g to protect someone's life) or legitimate interest of the processor. It is possible that processing all or some of your data was based on the performance of a public task, in which case they will refuse your request.
Impressum Requirement Wow, based on your citations, you've done a lot of research on this topic. I'm just going to add one more reference, which is from the same site as your first German citation and has incredibly detailed and judicially referenced information on almost everything related to the Impressum. All my non-GitHub links are to sections of that page. Based on your research, I'm going to take it for granted that you understand that according to the Telemediengesetz (TMG), an Impressum is required on a web page if it is &quot;business-like&quot; (geschäftsmäßig), or if it helps, I prefer to word it as &quot;potentially commercial.&quot; I would have to argue that open source projects have to be seen as inherently &quot;business-like&quot; for the purposes of the TMG for two reasons: Some other legal person may have similar software as part of their business and might have the need to serve legal notifications to the owner of a GitHub project (TMG § 8 gives competitors the right to sue). Think potential copyright violations here. It is possible to build a more traditional commercial business around open source, for example what Canonical is doing around Ubuntu. Additionally, the common legal advice is to even include an Impressum on a personal blog, though I'm not aware of any court case having occurred at that level yet. In my opinion, a GitHub account can be seen as more &quot;business-like&quot; than a personal blog, and would follow that advice out of caution. I'll note that the XING situation you bring up is complicated. It centers over whether the content of XING pages is &quot;business-like&quot; according to the TMG. It may well turn out that some pages will need an Impressum and others won't. As for placing it in the project's readme.md, that might work but I have two concerns: The courts have essentially stated that the text of the link must imply that the required information under TMG § 5 is located there. For example, the words Impressum and Kontakt work, but the word Information does not. To me, &quot;readme&quot; is not sufficient, but this concern might be negated by the fact GitHub by default renders the readme.md directly on the project home page. While it has been ruled that the Impressum does not necessarily have to be directly on the home page (for GitHub, that would be the company's/users profile page), it must still be readily available in an intuitive location. I don't know if putting it in a project page satisfies the legal requirement. If it was sufficient, it's also likely that each project would have to have an Impressum so that it can't be missed. Examples The dominant pattern that I could find1 on GitHub is an off-site link to the Impressum contained in the profile page's byline right underneath the title. Examples: https://github.com/sedadigital, https://github.com/comsysto, https://github.com/znes, https://github.com/eSagu, https://github.com/TIBHannover. I'm almost certain this meets or exceeds the legal requirements. Example screenshot: Additionally, I found a few that had a repository specifically for an Impressum. Example: https://github.com/johsteffens. Since these repositories were clearly visible on the user's main page (either because there weren't enough repositories to make them span multiple pages, or because it was specifically pinned to the main page), I would argue these also meet the legal requirement for being readily available. While I didn't find any examples of it, another possibility would be to combine the above two approaches, having a link in the byline that links to an Impressum repository or some other page within GitHub. This would be useful if you didn't otherwise have an Impressum hosted elsewhere. There were also scattered examples of people placing an Impressum on a project wiki page or on an impressum.md file at the top level. However, none of the users I looked at were consistent in doing this across all their projects. Also as previously mentioned, it's questionable whether not having it on the main user profile page meets the legal requirement. The Wiki page in particular I don't think meets the requirement that it can easily be found. Found using the following Google search: site:github.com impressum -impressum.php -impressum.html -impressum.jsp -impressum-manager -github.io -issue. Exclusions meant to filter out a lot of false positives, mostly projects for websites that had their Impressum in code format meant for deploy and not for display on GitHub itself.
You premise is correct. The processor is someone that processes data on your behalf, and since the GDPR definition of processing is extremely broad, that is about every third party subcontractor that you use for data processing, including various cloud providers. I'm afraid it will soon become a huge mess with a gazillion contracts to sign. I disagree. Yes, the GDPR says that a contract between the controller and processor must exist, but Article 28 of the GDPR does not say anything about how the controller shall document these instructions. Basically, in cases like the one you describe where John Doe relies on a web agency for having a contact form on the web, there will be a standardized (by the web agency) service agreement between the John Doe (controller) and the web agency (processor). There is nothing stopping the parties from agreeing that this service agreement that John Doe accepted as part of the onboarding procedure is also the DPA as required by the GDPR. Putting something like the following in the service agreement would do it: The parties agree that this Service Agreement between You (controller) and Us (processor) set out Your complete and final instructions to Us in relation to the processing of Personal Data and that processing outside the scope of these instructions (if any) shall require prior written agreement between You and Us. You also agree that We may engage Sub-processors to process Personal Data on Your behalf. The Sub-processors currently engaged by Us and authorized by You are listed in Annex A. I think we will se a lot of amendments in service contracts as the GDPR gets better understood, but I don't really see a flood of DPAs in addition to these amended service contracts.
Note that the answer to most of your questions has nothing to do with the GDPR specifically, but has to do with the legal force that an EU Regulation has. Here's a related answer on EU Regulations vs. Directives. That said, here are my answers to your specific questions: So member states can define a different age, even though the GDPR says that it should be 16. But is this an exception? Yes. Are there any other exceptions? Yes. Scanning the Regulation for instances of "Member State" is a good way to find them. In my opinion, the biggest area of the GDPR where Member States have influence is Article 6, "Lawfulness of Processing". In some circumstances, it allows Member States to specify what could be considered a lawful basis for processing. Must these exceptions be explicitly stated in the GDPR? Yes. As a Regulation, exceptions must be explicitly stated in order to be permissible because Member States have no authority to overrule EU law*. I'd like to understand to what extent the GDPR must be followed by member states, and to what extent it could be amended in national laws. "Amended" is a fuzzy term. It can mean adding, changing, or removing from the law. Unless otherwise specified, Member States could not change or remove provisions, but there could very well be additions consistent with the GDPR. *Some Member States dispute this statement when it comes to constitutional issues.
However, if a website is based in the US and the terms of service say that the law governing the terms is US law, how can GDPR have any affect? It is unlikely that the EU will be able to enforce financial penalties against a company with no presence in the EU. But they could for example block your website in the EU, depriving you of your EU user base. The actual measures that they could or would take against such a company are still unclear, since the GDPR is quite new, and there has been no action under the GDPR against foreign companies. I'm not a lawyer, but I've signed many contracts in my life and nearly all of them have some form of "governing law" clause. The governing law clause in a contract identifies the law that will be used to interpret the contract and to resolve any disputes arising from the contract. The law identified in the clause does not become the sole law governing every aspect of the relationship between the parties, however. For example, a business in New Jersey could have a contract with a client in New York with a clause specifying New Jersey law as the governing law of the contract. But that does not mean that New York's consumer protection law doesn't apply to the transaction.
germany Visitors in hotels must be registered and the hotel must keep the paperwork for a certain duration. According to §29 Bundesmeldegesetz, foreigners who are required to be named in their registry need to show an identity document (groups might have summary listings for some). There are some optional simplifications. Paying by credit card may count as identity verification. From context where this law is placed, it is not about interpersonal issues in the hotel. Germany requires all residents to register with their municipality of residence, and registering hotel visitors closes loopholes. §28 immediately before this is about sailors on river barges, §32 is about hospitals.
The European Convention on Human Rights has an article about privacy (article 8). Note that this is from the Council of Europe, which is not the same as the European Union: non-EU member states such as Russia, Turkey, and Azerbaijan are also part of the Council of Europe and therefore the ECHR. I'm not sure if you first have to go to a lower court, but the European Court of Human Rights is the authority on this (commonly mistaken for the European Court of Justice, but they are distinct entities). According to this ruling of the ECtHR, it is not illegal to monitor your employees' communications per se. However, the monitoring has to be: for legitimate purposes ("the employer had only accessed the account in the sincere belief that it contained only messages of a professional, not personal, nature"), proportionate ("it was the only possible way available"), and communicated to the employee (or, if the monitoring is not announced, at least the restriction on personal use should be communicated, for example through company policy). In the European Union, there is also the GDPR, but this does not change much. It applies to your employer the same as any other organisation and basically says that they have to be reasonable about it: collect only what they need, for a legitimate purpose, and tell you about it. I think you should be able to request a copy of any data they collected about you, ask a human to review an automated decision, and your other usual rights. They don't need your consent to start collecting data, as Esa Jokinen already commented: "GDPR doesn't even require consent to handle PII data, but the consent is just the last option when there's no other legitimate reason to process the data." In fact, your employer probably cannot ask you for consent: because of the employer–employee imbalance of power, the consent would probably not be considered to be freely given (where this article mentions "The GDPR states", I think they are referring to recital 43).