BvD calls for risk-based data protection reforms in Germany

Thomas Spaeing, chairman of the Association of Data Protection Officers in Germany (BvD), is calling for data protection reforms to be based on risk levels rather than company size. Speaking at the 10th BvD Autumn Conference in Stuttgart, Spaeing argued that tying reforms solely to organizational size is ineffective, noting that small, data-driven startups or even local clubs can pose significant privacy risks.

These comments follow a keynote by David Diehl of the Federal Ministry of the Interior regarding the German government's data protection plans. The government intends to advocate for 'relative anonymity' and significant relief for small and medium-sized enterprises (SMEs) within the European Union's Digital Omnibus reform process.

On a national level, the German government plans to remove the mandatory requirement to appoint a Data Protection Officer (DPO) to increase corporate responsibility and allow companies to adapt privacy structures to their specific needs. Diehl clarified that this change does not mean the GDPR no longer applies, nor does it mandate that companies forgo data protection measures entirely.