Conclusions on the provisions of European law

1. The ECHR provides no decision on the relationship between data protection and freedom of broadcasting. Freedom of broadcasting is given great importance by the ECHR and also in the European Court of Human Rights¿ interpretation of the convention. Regarding data protection the Council of Europe has adopted the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data.

2. Freedom of broadcasting was implicitly recognised by the European Court of Justice as a Community basic right, although there has been no such recognition of the right of indivduals to determine how their personal data is used and of data protection to date. It cannot, however, be derived from this that freedom of broadcasting takes priority over the right to data protection at European level.

3. The Charter of Fundamental Rights of the EU, which guarantees freedom of broadcasting and the right to protection of personal data, contains the same constitutional conflict as German constitutional law. To date, the European Court of Justice has not provided an interpretation of the Charter in favour of either data protection or freedom of broadcasting.

4. The EC Directive on Personal Data Protection must be effectively implemented in full by the member states. However, under Community law, the choice of means to achieve the aims of the Directive is at the discretion of the individual member states.

5. When implementing the Directive, the provisions of national law must be taken into account. In Germany, the federal states must therefore pass relevant regulations on data protection in broadcasting to implement the Data Protection Directive. It is not possible for the German Federation (Bund) to be responsible for centralised overall data protection.

6. Under § 28 EC Data Protection Directive, the member states must undertake, in principle, to set up a supervisory office. Transferring the supervisory obligations to a public authority would be inadmissible under constitutional law, as would subsequent supervision of the data protection officer by a public authority. The supervisory powers specified in § 28 must therefore be transferred to the data protection officer of a broadcaster.

7. The total independence of the supervisory office provided for by § 28 is guaranteed for data protection officers in broadcasting by the fact that their independence is stipulated both in the constitution and by the legislator.

8. With the right to make a complaint as per § 41 Paras. 5-7 NDR-StV (NDR State Treaty), the NDR data protection officer has the option of giving an opinion as provided for in § 28 Para. 3 Option 2 for the supervisory office.

9. The supervisory office's obligation to regularly submit a published report, may be fulfilled by posting the data protection officer's report on the NDR website.

10. In broadcasting, the data protection officer lacks the authorisation to instruct that data be blocked or destroyed/deleted, or to issue a ban on processing data as provided for in § 28 Para. 3 Option 2. In this respect, an expansion of the legal position of data protection officers in broadcasting by the legislator is needed in order to implement § 28 of the Directive.

11. When the powers of data protection officers are expanded, the possibility of taking legal action against the charges made by the data protection officer must be in place.

12. In the event of the data protection officer being a supervisory office as per § 28, as is the case at NDR, he must be involved in the appointment of the German representative of the group as per § 29.

13. § 9 of the Directive stipulates that the member states are responsible for making decisions on exceptions. The Directive therefore provides the member states with the option of maintaining the media privilege. This demonstrates that the Directive does not require a division of supervisory powers, which would be unconstitutional under German law.

14. However, § 9 only permits exceptions with regard to data which is exclusively being processed for journalistic purposes.

15. On the basis of exceptions as per § 9, the position of the NDR data protection officer may therefore remain unchanged with regard to checking journalistic data, even if the Data Protection Directive is implemented in full.

16. However, an exemption from the requirements of the Directive as per § 9 is not possible for administrative personal data. With regard to administrative personal data, data protection officers in broadcasting must act as the supervisory office as per § 28, and as a result must be equipped with the comprehensive supervisory powers described.