(Speech, Frankfurt University, Symposion on „The Culture of Privacy and Data Protection in the EU and the U.S.“, March 9th, 2016)

When it comes to data protection in Germany, there is an on-going and quite lively discussion. There is a mainstream, and there is a minority. My views are clearly the views of the minority.

What are the mainstream views?

Quite clearly, the mainstream takes the view that German data protection laws are the best in the world. The whole of Europe followed the German example when introducing the European Data Protection Directive in 1995.

• Perfect Rules

The laws are perfect, and we would live in a perfect German data protection world if only everybody played by those wonderful rules. Unfortunately, although there are 17 German DPAs, they lack the thousands of officers they would need in order to enforce the rules. (Well, the minority would argue that only 100 % enforcement would be able to prove how over-exertive the rules really are.)

• Good Guys vs. Bad Guys

According to mainstream views, we have a domesticated government that is law-obedient and generally respects the citizens‘ privacy. When it comes to privacy, we do, however, need a strong state to make sure private enterprises respect our privacy. The villains in the privacy game are quite clearly to be found in private industry, whereas the good guys are the brave DPAs, politicians and government officials, relentlessly defending citizens‘ rights against „digital capitalism“.

Silicon Valley is the homebase of digital capitalism. If you want to protect data these days, you have to take on the Marc Zuckerbergs and Eric Schmidts of this world, the capitalist billionaires who are more powerful than most governments.

• EU:  Strict and Powerful New Regulation

The new European Data Protection Regulation with its hefty fines and its wide territorial scope is seen as a forceful weapon in Europe’s fight against Google and Facebook. Once Google and Facebook are forced to obey the European (or rather German) rules, Deutsche Telekom and the other German internet companies will thrive. With equal rules for everyone and a „level playing field“, European customers, in their millions, will move away from Facebook and Google to German competitors (that hardly exist).

• USA:  Wild West of Data Protection

While Europe is about to adopt the strictest possible data protection laws, there are no „real“ data protection laws in the US. Being unfettered by data protection, the Silicon Valley companies were able to rise to the power they possess today. Facebook’s and Google’s success is, at least, partly due to the fact that the US are the Wild West of data protection.

And what about government? Edward Snowden has unmasked the ugly face of the US government. Hardly a „true democracy“, the US are governed by politicians that have come into office thanks to donations from big business. If mainstream German data protectionists had a vote in US elections, Bernie Sander’s share would be close to 100 %.

• Weapons of Mass Surveillance

Lacking a „true democracy“, the US has a government that allows the NSA to spy on our chancellor and to co-operate closely with Silicon Valley „internet giants“ in order to install and operate systems of mass surveillance. The German BND is involved in such surveillance schemes, though partly as a victim as the NSA „uses“ their German counterparts for hideous activities that the Germans are only partly aware and in control of.

If that is – albeit not without exaggeration – the German data protection mainstream, what would be a minority view?

• INDUSTRY

1. Personal Liberty:  We need to remember that there is more to personal liberty than data protection and online privacy. In particular, we must not underestimate the value of the freedom of information and the freedom of expression.

2. Trade Weapon Fallacy:  We need to understand that it serves privacy badly if data protection is used as an instrument to strenghten the position of German companies competing against US „internet giants“. Civil rights should not be misused as trade weapons.

3. The Good, The Bad and The Ugly:  We need to understand that DPAs are not, by definition, „good cops“. By being over-restrictive, they can severely violate the fundamental liberties of citizens and enterprises.

4. Actual Relevance of Data:  We need to stop „counting the pixels“ (Jochen Schneider). Personal data are not protected for their own sake. They are protected when they can cause harm to citizens. When there is no such harm, there is no justification for data protection laws.

5. Back to the Roots:  We need to revisit the 1960s and 1970s and remember that data protection is not a German but a US invention. We need to be more open to a dialogue with our US colleagues. And we should stop taking it for granted that there can be no better data protection principle than the German „Recht auf informationelle Selbstbestimmung“ (right to informational self-determination), combined with the „Grundrecht auf Integrität und Vertraulichkeit informationstechnischer Systeme“ (right to integrity and confidentiality of IT systems).

• STATE

1. Dark Side Origin:  We must not forget that data protection is not primarily designed to empower the state to protect citizens. On the contrary: Data protection’s main focus is the protection of citizens against the state.

2. Comprehensive Surveillance:  German secret services – as their US counterparts – are trying to use the digital infrastructure of the 21st century for comprehensive surveillance. We need to understand that the methods and strategies that Edward Snowden revealed are not just a US but a global phenonemon. The German secret service BND is no better than the NSA.

3. Monitoring Secret Services:  For reasons of privacy, data protection and the protection of other civil liberties, secret services both in the US and in Europe need to be controlled and regulated far better than presently. Germans should, however, stop pointing fingers at the NSA and should instead go ahead with an extensive reform on the authorities of German secret services and on their control.