Germany's new data protection chief: Digital sovereignty is important

Since October, Moritz Hennemann has served as the Federal Commissioner for Data Protection and Freedom of Information (BfDI). Even he was "shaken" by the Hanning case.

Interview by Christian Rath

taz: Mr. Hennemann, you were previously known primarily as an expert on data use, not data protection. Will you now become a "Federal Commissioner for Data Use"?

Moritz Hennemann: I don't see the contrast between data protection and data use that you suggest. They are two sides of the same coin. Data protection incorporates data use and sets guardrails. However, data use is very important for our economy and our state because it holds diverse innovation potential. Many modern services are based on the analysis of large data sets, including with AI. The "Industry 4.0" and "Industry 5.0" concepts rely on the digitalization, networking, and automation of production processes, as well as their sustainability. The digitalization of administration can reduce bureaucracy and enable greater proximity to citizens.

taz: Will you be a lenient or a strict data protection commissioner?

Hennemann: I primarily focus on proactive, early, and solution-oriented advice. I don't just want to say what isn't possible, but above all, what is possible and how it can be done. That was also the approach of my predecessor, Louisa Specht-Riemenschneider. The goal of this advice should also be to prevent data protection violations from occurring in the first place. If necessary, I will also use the other options available to my authority, the classic supervisory role. In doing so, I will neither act particularly harshly nor particularly leniently, but will enforce data protection law in a balanced manner. I am pragmatic, but not everything that is particularly practical is also compliant with data protection.

taz: The coalition is considering consolidating data protection supervision over the economy. A good idea?

Hennemann: Yes. If data protection supervision over the entire economy were to lie with the Federal Commissioner, that would be expedient from my perspective. Currently, as Federal Commissioner, I am primarily responsible for federal authorities as well as telecommunications and postal services. The state data protection authorities, on the other hand, oversee state authorities and the majority of the economy. This can lead to inconsistent application of the law and thus to legal uncertainty. However, if data protection supervision were consolidated, the BfDI would need to be adequately staffed to meet the demand.

Moritz Hennemann (41) has been the Federal Commissioner for Data Protection and Freedom of Information (BfDI) since October 1. He was elected in June by the Bundestag on the proposal of the CDU/CSU with a large majority. His term of office is five years. Previously, Hennemann was a professor of law at the University of Freiburg. He succeeded Louisa Specht-Riemenschneider, who had to give up the office after a two-year term for health reasons.

taz: The EU Commission has proposed, in the so-called Digital Omnibus, to reconsider the requirements of the General Data Protection Regulation (GDPR). A good idea?

Hennemann: Yes. After ten years of the GDPR, it is appropriate to put the regulation to the test to make it more understandable and practicable. However, this is not just about deregulation. In some areas, obligations can be specified, some things can be eased, and others should be tightened. I am a proponent of graduated obligations depending on the risk of data processing. Stricter rules should apply to particularly high-risk players than to data-efficient small businesses and small associations. Tightening is necessary, for example, in dealing with data brokers, i.e., data traders. Abuses have been uncovered here, such as sensitive citizen data flowing uncontrolled out of the EU.

taz: Is digital sovereignty a goal? A European cloud infrastructure, European data centers, European AI language models?

Hennemann: Digital sovereignty is important. We must reduce systemic dependencies. One component of this is the storage of data of European citizens and companies within the EU under EU data protection law. For data from security authorities, the data should even remain in Germany.

taz: Are our data in good hands with the security authorities, especially the intelligence services? Former BND chief August Hanning is in pre-trial detention on suspicion of treason. Former Office for the Protection of the Constitution chief Hans-Georg Maaßen now moves in right-wing extremist circles.

Hennemann: Such cases naturally shake me as well. Nevertheless, it remains clear that the intelligence services operate on the basis of the Basic Law and, in times of hybrid threats, have the important function of recognizing and classifying these threats in a timely manner. At the same time, effective control and rule-of-law guardrails, as set by the Federal Constitutional Court, are necessary. This includes not only secrecy protection but also data protection law.

taz: Due to the planned reform of the intelligence services, you will lose data protection supervision over the Office for the Protection of the Constitution and the Federal Intelligence Service. Critics see this as a weakening of oversight. Do you agree?

Hennemann: We would have wished for data protection supervision over the intelligence services to remain with our office. Because we have a high level of technical expertise here. In the future, the Independent Control Council will be responsible for oversight, to which we will hand over the task in an orderly manner, as far as legally possible.

taz: The Independent Control Council is primarily composed of former federal judges. Isn't that an adequate replacement?

Hennemann: The crucial point is that the legislator grants the Control Council the powers to fulfill this task effectively and independently. Based on the current draft, I do not yet see this as fully achieved. For example, the Control Council is not required to report on its activities until 2031. And the possibilities for government agencies to prohibit or restrict this reporting, for instance to protect the "well-being of the Federation," go too far.

taz: In addition to data protection, you are also responsible for freedom of information. Which is more important?

Hennemann: Both are equally important, even though numerically significantly more employees in my office deal with data protection.

taz: In July, the coalition committee of the CDU/CSU and SPD announced significant cuts to the Freedom of Information Act (IFG). Among other things, future requests would have to be justified, and the costs of providing information would no longer be capped. Are you outraged?

Hennemann: This debate actually gives me less pleasure than the debate on data protection reform. But no draft law has been presented yet, so I can only emphasize in the abstract that I consider freedom of information to be an important instrument of our democracy and that the proposals to hollow out the IFG do not convince me. An informed population is a stabilizing factor, especially given the diverse threats in the information space as well. Access to reliable first-hand information plays an essential role here. I consider a clarification of military and security-related concerns to be understandable, even though a far-reaching exception for these already applies in the IFG today. I would be more pleased if, in the interest of data use, open data requirements were strengthened in the future, for example through a transparency law that obliges the state to generally publish its non-sensitive data.