In the interview with Ralf Kamnitzer, one of the most experienced data protection experts in the Rhine-Main region

Since 25.05.2018, the introduction date of the new EU General Data Protection Regulation (GDPR), a lot has happened. While many companies are still struggling with this issue and see it as the biggest economic brake or obstacle to innovation, others praise data protection in Germany as the only correct solution and decision. Advocates demand that the domestic economy and its stakeholders fully participate, review all business processes accordingly, and thus fully integrate data protection into the company. To give a better overview of the discussion and recommendations for action to interested decision-makers for the compliant protection of their company's know-how, we are speaking today with long-standing data protection expert Ralf Kamnitzer.

DIGITAL FUTUREmag: Mr. Kamnitzer, since the pan-European introduction of the GDPR three years ago, a lot has happened. Why has data protection become so important?

Ralf Kamnitzer: The interest in personal information about the lives and activities of neighbors remains very interesting and desirable for many people. This is evidenced by police-registered crime statistics in the area of cybercrime in this country. Over 100,000 cases were committed in 2019 – according to a BKA press release dated 30.09.2020. The industry association BITKOM estimates the associated economic damage for this period at over 100 billion euros.
Data protection is not a modern invention, but an old right that is still practiced today. We respect and adhere to these rights without knowing why. Here are some well-known classics: the Hippocratic Oath (medical confidentiality), the seal of confession (church), postal and telecommunication secrecy, and in some cases banking secrecy. These legal data protection standards are punishable by law. Violations of these standards are assessed and punished differently by the courts. Our natural life is consciously or unconsciously influenced by these (behavioral) rules.

On 13 October 1970, the Hessian Data Protection Act entered into force as the first and oldest data protection law in the world for public administration. It stipulated how, when and why personal data may be processed. Its goal is still to this day to prevent violations of the right to informational self-determination (ruling of the Federal Constitutional Court of 15.12.1983). The later Federal Data Protection Act (BDSG), which has been active since January 1978, forms the basis for the current law, the European General Data Protection Regulation of 2018. This created a legal basis not only for the Federal Republic of Germany, but throughout Europe.

DIGITAL FUTUREmag: Many companies do not know exactly how to integrate data protection internally. What professional advice can you give them?

Ralf Kamnitzer: Data protection based on the European General Data Protection Regulation (GDPR) falls under the area of corporate compliance for all companies. Practicing data protection is mandatory for all company executives. Today, the most varied data from customers, employees, interns, suppliers, and service providers is collected, stored, and processed. Whether sole proprietor, SME, or corporation: everyone is obligated to account for how they collect, store, or process the information obtained or provided. To ensure this process meets a uniform standard, the legal norm (GDPR) currently provides the necessary guidelines.

Data protection is not a one-time product but, like all other compliance regulations, is a living process for the company. It is important to document and adapt existing workflows (processes) for collecting, storing, and processing personal data to reflect reality. In accordance with the legal norm, these individual workflows (processes) must be recorded in a regulated and documented form. Below are some examples: recording employees upon hiring, recording absences, conducting training measures, handling potential video surveillance, managing customer data, and confidentiality obligations for employees and service providers.

These workflows (processes) are known everywhere. Only through the legal obligation to account for business activities does documentation become necessary. Therefore, just as much importance should be placed on it when founding a company as when creating the business or financial plan. The earlier data protection is integrated, the easier it is to implement the legal norm. However, experience shows that long-term employees are often reluctant to engage with new topics, such as data protection in the company. Following the motto: “We know our shop inside out...”.
Many companies now understand data protection as a marketing project and leverage it. After all: many customers consciously check whether a provider or manufacturer actively practices data protection and award contracts accordingly.

DIGITAL FUTUREmag: For many companies, the regulations and requirements in the area of data protection are a burden—others, however, see the advantages in it. What additional benefits can a company gain from the data protection project?

Ralf Kamnitzer: The benefits of proactive data protection offer a wide range of advantages. The effects can be seen and recognized both internally and externally. By sensitizing individual employees to this aspect, security within the company can be redefined—both in interactions among colleagues and with customers/suppliers. Proactive data protection is used by every single employee at and for the workplace. It helps to strengthen security in communication and in the respective workflows.

The presence of a data protection officer can be helpful in reducing tensions between management, staff, and the works council. The task of the data protection officer is to advise and support the company in applying data protection regulations. This includes, for example, the use of the internet and email communication or balancing the distribution of tasks among employees. Not only the General Data Protection Regulation (GDPR) must be observed, but also a variety of other regulations, such as the Social Security Code, the Basic Law, the Tax Code, or the Air Traffic Act.
The mandatory documentation of individual workflows (processes) can reveal structural changes. This can result in economic gains for the company (cost savings). Here, data protection officers also act as internal consultants, similar to the optimization of production processes in recent decades. The established workflows are now being put to the test.
Another major potential lies in the analysis of workflows. This involves questioning why and how the work process runs as it does. At the same time, this also allows for checking whether the distribution of responsibilities among individual employees still aligns with what is described in the employment contract.

Crucial for the company is the realization of data subject rights. Experience shows that this often requires the assistance of data protection officers. This can leave a positive impression on the company—think, for example, of corresponding marketing measures.
Let me briefly add this at the end: In my view, practiced data protection and effective IT security are integral components of quality management. Moreover, data protection helps optimize business processes and serves as a protective shield for the company itself. After all, lost corporate secrets are neither replaceable nor retrievable!

DIGITAL FUTUREmag: Many thanks for your transparent insights and explanations on essential security measures relevant to operations, which help decision-makers successfully leverage their business resources.