§ 1 BDSG
Scope of the Act
(1)This Act shall apply to the processing of personal data byFor non-public bodies, this Act shall apply to the wholly or partly automated processing of personal data as well as to the non-automated processing of personal data which are stored or are intended to be stored in a filing system, unless the processing by natural persons is carried out in the exercise of exclusively personal or family activities. 1 public bodies of the Federation,; 2 public bodies of the Länder, insofar as data protection is not regulated by Land law and insofar as they
a)execute federal law or;
b)act as bodies of the administration of justice and the matter does not concern administrative affairs.
(2)Other federal legal provisions on data protection shall take precedence over the provisions of this Act. Where they do not regulate, or do not conclusively regulate, a matter to which this Act applies, this Act shall apply. The right of access to official information shall remain unaffected.
(3)The provisions of this Act shall take precedence over those of the Administrative Procedures Act insofar as personal data are processed in the determination of the facts of the case.
(4)This Act shall apply to public bodies. It shall apply to non-public bodies insofar asInsofar as this Act does not apply pursuant to the second sentence, the provisions of Part One and Part Two shall apply to the controller with the proviso that only Sections 22, 23, 24, 25 Subsection (1), Sections 26 to 31, 35 Subsection (1) and Subsection (3), Sections 36, 37, 38, 42 and 43 shall apply in their own right. 1 the controller processes personal data wholly or partly by automated means or; 2 personal data which are processed non-automatically are stored or intended to be stored in a filing system.
(5)The provisions of this Act shall not apply insofar as the law of the European Union, in particular Regulation (EU) 2016/679 as amended, is directly applicable.
(6)For processing operations for the purposes referred to in Article 2 of Regulation (EU) 2016/679, the Contracting States of the Agreement on the European Economic Area shall be treated as equivalent to the Member States of the European Union. Personal data which constitute a business secret shall also be treated as equivalent to special categories of personal data within the meaning of Article 9 Subsection (1) of Regulation (EU) 2016/679.
(7)For processing operations for the purposes referred to in Article 1 Subsection (1) of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89), the Contracting States of the Agreement on the European Economic Area shall be treated as equivalent to the Member States of the European Union.
(8)For the processing of personal data by public bodies in the context of activities falling outside the scope of Regulation (EU) 2016/679 and Directive (EU) 2016/680, Sections 1, 2 Subsections (5) and (6), Sections 10 and 11, Sections 14 to 16, Section 19 Subsection (2) and Section 20 Subsection (1), first sentence, No. 1, (4), (7) and Subsection (2) of this Act shall apply in conjunction with the relevant provisions of Regulation (EU) 2016/679, unless the specific subject matter of the data processing requires otherwise.