BLOG

If a company extensively processes special categories of data according to Art. 9 or criminal data according to Art. 10 GDPR as part of its core business, it is obliged to appoint a data protection officer. The article explains which data is affected, when the obligation applies, and what fines are threatened in case of violations.

Following a successful appeal, the appellate court usually remands the case for retrial. The new trial court—the so-called second first instance—decides independently where findings have been overturned. Whether acquittal or a new sentence is possible depends on the scope of the appeal.

Data protection violations can affect anyone and have far-reaching consequences for companies. In addition to high fines under the GDPR, there is a strict 72-hour reporting obligation to supervisory authorities, and in serious cases, even criminal investigations. Those who ignore the requirements risk significant financial damages, loss of reputation, and personal liability. Get informed now to avoid existential consequences.

Who is responsible for data protection in your company? The GDPR's clear answer: the company itself, represented by management or the owner. A Data Protection Officer (DPO) is an important supervisory body, but cannot assume overall responsibility. Do not underestimate this accountability principle, as violations can lead to significant fines and criminal consequences. Ensure clear internal structures and train your employees.

If the appellate judgment in criminal law is flawed, the revision to the Higher Regional Court is the legal remedy. However, it is not a new factual instance, but exclusively corrects legal errors. The deadline for filing is only one week. An alternative is the direct revision, which skips the Regional Court. A precise analysis of the initial judgment is crucial for the strategic decision between appeal and direct revision.

Special categories of personal data according to Art. 9 and 10 GDPR – such as health or criminal records data – are subject to a strict prohibition on processing. Processing is only permissible under narrow exceptions. For extensive operations, a Data Protection Impact Assessment (DPIA, Art. 35 GDPR) is mandatory. Errors lead to significant disadvantages for data subjects, fines, and possible criminal consequences.