What information is part of the data protection declaration?

Many websites are to be classified as critical in reference to data protection. The data protection declaration often does not contain important information that is relevant for the user. Take Google or Amazon as an example: For the user, it is somewhat difficult to find out which services are used to collect data and to inform oneself comprehensively about data protection in this manner. Even though personal data is not stored in most cases, there is usually a lack of understandable information available to the user about how his or her data is being used.

The legal situation in Germany with respect to the contents of the data protection declaration of websites is clearly defined. According to § 13, Par. 1 of the TMG (Telemediengesetz), the website operator is obligated to inform the user

• about the type, scope, and purpose of the collection and usage of personally identifiable information
• about processing in countries outside of the European Union or the European Economic Area
• in a generally understandable manner and
• once the period of usage begins.

According to § 15, Par. 3 of the TMG, the vendor is also obligated to inform the user if the collected data is going to be used to create pseudonym usage profiles (web tracking) and that the user has the possibility to object to this.

For data protection it is important to decipher the data protection declaration  from the explicit consent of the user. A special characteristic of the data protection declaration  is that the vendor of a page explains to the user just how the collected information is being processed. With the consent, the operator of a website is obtaining the permission of the user to use the collected data for a purpose that requires his or her explicit consent. One example of this is the shipment of advertising E-mails or the consent of the user for the sale of his or her data to a third party.

Optimally, operators should design their websites such that the user has the opportunity to object to the use of his or her data via a clearly indicated button.