#
Core GDPR bases are firmly in force (green), but §26 BDSG's acknowledged normative imprecision on special-category employee data and the absence of a dedicated Employee Data Protection Act create interpretive uncertainty, justifying an amber rating for this module overall.
Sub-modules (4)
Lawful BasesAmber
Six Art 6(1) GDPR bases apply; §26 BDSG (Art 88 opening clause) governs employment-context processing but is considered too imprecise by BfDI/DSK.
Claims (2):
- GDPR Article 6(1) provides six lawful bases for processing personal data.
- §26 BDSG governs employment-context data processing under the Art 88 GDPR opening clause; criticized by BfDI/DSK as too imprecise, prompting calls for a standalone Employee Data Protection Act. Interpretive uncertainty flagged by DSK; see gaps_register on Employee Data Protection Act status.
Consent ThresholdsGreen
Consent must be an unambiguous active affirmative act; digital-consent age fixed at 16 in Germany.
Claims (2):
- Consent under GDPR requires an unambiguous, active affirmative act by the data subject.
- Germany (GDPR Art 8 opening clause) sets digital-consent age at 16.
Special CategoriesAmber
Art 9(2)(a) explicit consent required for sensitive data; §26(3) BDSG imposes additional employment-context conditions.
Claims (2):
- GDPR Article 9(2)(a) requires explicit consent for processing special-category (sensitive) data absent another statutory exception.
- §26(3) BDSG imposes additional conditions on processing special-category data in the employment context.
Pseudonymisation And AnonymisationGreen
TTDSG §19(2) requires telemedia providers to enable anonymous/pseudonymous use where technically feasible and reasonable.
Claims (1):
- TTDSG §19(2) requires telemedia providers to enable anonymous or pseudonymous use of services where technically feasible and reasonable.
Key findings (3)
- — source on file
- — source on file
- — source on file
Lawful Processing & Special Data
German law continues to treat B2B email marketing more strictly than the presumed-consent model sometimes assumed from a purely commercial perspective. Under Section 7(2) No. 2 of the UWG (Gesetz gegen den unlauteren Wettbewerb), prior express consent is required for email marketing regardless of whether the recipient is a consumer or a business. This is a materially stricter position than might be assumed by analogy to the presumed-consent rule that does apply to business recipients for telephone marketing under Section 7(2) No. 1 of the same statute; the two marketing channels are treated differently under German law, and the telephone-marketing presumption does not extend to email.
A relevant interpretive development affecting the soft opt-in exception comes from the Court of Justice of the European Union's ruling in C-654/23 (Inteligo Media), understood to have been handed down around 13 November 2025. The ruling is understood to hold that a free account can count as obtaining a customer's contact details "in the context of the sale of a product or service" for soft-opt-in purposes, where the ostensibly free service is in fact indirectly paid for through an associated paid-subscription business model. This interpretation is binding on Germany as an EU member state, though the precise pinpoint paragraph of the judgment has not been independently verified against the court's own text this cycle. For German controllers relying on the soft opt-in under the implementing provisions of the ePrivacy framework, this ruling is relevant to any freemium or indirectly-monetised service model where contact details are collected through a nominally free tier.
Outlook
Controllers operating freemium or tiered-subscription services in Germany should consider how the Inteligo Media interpretation of "in the context of the sale of a service" applies to their own soft opt-in reliance, particularly where a free tier functions as a lead-generation mechanism for a paid tier. The exact scope of the ruling, including whether German courts or the data-protection authorities issue any domestic guidance applying it, was not established this cycle and is worth monitoring.
Sources and claims (7)
- ProbableBfDI — GDPR Article 6(1) provides six lawful bases for processing personal data.observed
- ProbableDSK — §26 BDSG governs employment-context data processing under the Art 88 GDPR opening clause; criticized by BfDI/DSK as too imprecise, prompting calls for a standalone Employee Data Protection Act. Interpretive uncertainty flagged by DSK; see gaps_register on Employee Data Protection Act status.observed
- ProbableBfDI — Consent under GDPR requires an unambiguous, active affirmative act by the data subject.observed
- ProbableBfDI — Germany (GDPR Art 8 opening clause) sets digital-consent age at 16.observed
- ProbableBfDI — GDPR Article 9(2)(a) requires explicit consent for processing special-category (sensitive) data absent another statutory exception.observed
- ProbableBfDI — §26(3) BDSG imposes additional conditions on processing special-category data in the employment context.observed
- ProbableOneTrust DataGuidance — TTDSG §19(2) requires telemedia providers to enable anonymous or pseudonymous use of services where technically feasible and reasonable.observed