Data Protection; Information, Guidance, and Oversight in Public Agencies

All Bavarian government agencies and other Bavarian public bodies (e.g., municipalities, district offices, regional administrations, district hospitals) that process personal data must appoint a government data protection officer. Multiple public bodies may appoint a joint data protection officer; this person need not be an employee of the responsible bodies and may also be represented and assisted by other individuals. The contact information for the government data protection officer must be published in an easily accessible manner; the name of the government data protection officer does not need to be included in the publication.

The data protection officer has the following statutory duties:

• Information and Advice
  The data protection officer informs and advises the controller and the employees who carry out processing regarding their obligations under data protection law; the data protection officer is involved in all matters related to the protection of personal data
• Monitoring
  The data protection officer monitors compliance with data protection regulations and the controller’s strategies for the protection of personal data.
• Advice on Data Protection Impact Assessments
  Upon request, the Data Protection Officer advises the controller regarding a data protection impact assessment and monitors its implementation
• Cooperation with the supervisory authority
  The Data Protection Officer cooperates with the data protection supervisory authority and serves as its point of contact for data protection matters
• Support for Data Subjects
  Data subjects may consult the Data Protection Officer on any matters concerning the processing of their data and the exercise of their rights under the General Data Protection Regulation
• Opinion Prior to the Use of Automated Processing
  Before implementing or making a significant change to an automated process used to process personal data, the Data Protection Officer must be given the opportunity to provide an opinion
• Opinion on planned video surveillance
  Public authorities must inform the government data protection officer in a timely manner prior to the implementation of video surveillance and give him or her the opportunity to provide input

Delegation of Additional Responsibilities

The following responsibilities of the controller under the GDPR may be delegated to the government data protection officer:

• Implementation of the reporting of data breaches to the supervisory authority
• Coordinating the implementation of data subjects’ rights under Art. 12 et seq. of the GDPR.

If you have any questions regarding video surveillance by businesses or private individuals, please contact the responsible Bavarian State Office for Data Protection Supervision (https://www.lda.bayern.de/de/thema_videoueberwachung.html). There you will also find information on the topic of video surveillance by businesses and private individuals.

The City of Erlangen’s privacy notice pursuant to Articles 13 and 14 of the General Data Protection Regulation (GDPR) can be found here: https://erlangen.de/themenseite/recht/datenschutzhinweise