Dr Martin Schirmbacher

Checklists and overviews on the implementation of NIS 2.

The EU is significantly expanding the information requirements regarding warranty rights and guarantees in the retail sector. From 27 September 2026, online and high-street retailers must use standardised model notices (‘harmonised notice’ and – under strict conditions – a guarantee label).

In episode 47 of the Data Navigator podcast, Dr Martin Schirmbacher and Dr Hubertus von Rönne address a topic that, since the Data Act came into force, has repeatedly been cited as a supposed counter-argument against claims for the disclosure of data: the GDPR. One of the reasons for this discussion is the third think tank organised by the Federal Commissioner for Data Protection and Freedom of Information on the Data Act, which took place last week. The starting point is clear: the Data Act expressly applies to personal data as well. In the event of a conflict, the GDPR takes precedence. In practice, however, such conflicts arise far less frequently than is often assumed. The decisive factor here is what is known as ‘relative personal reference’. Whether data is personal is not assessed in the abstract, but from the perspective of the relevant data controller. Dr Martin Schirmbacher and Dr Hubertus von Rönne illustrate this principle using the example of a bus driver: for Berlin’s public transport authority, driver data is personally identifiable, as they know who was driving which bus at what time. For the bus manufacturer, which merely receives vehicle data without any personal registration details, this link is generally absent. In the case of a wind farm, the situation may be the reverse: the manufacturer knows its maintenance staff, whilst the wind farm operator is usually unable to identify them. It follows that: The same data set may be personal data for one party and not for another. In scenarios governed by the Data Act, it is often precisely the data recipient who cannot establish a personal link. If, however, the recipient does establish a personal link, they require a legal basis under the GDPR. Legitimate interests are particularly relevant in this context. The manufacturer, in turn, may rely on Article 6(1), first sentence, point (c) of the GDPR for the data transfer, as the disclosure is made on the basis of a legal obligation under the Data Act. Finally, Dr Martin Schirmbacher and Dr Hubertus von Rönne outline the responsibilities of the supervisory authorities. The Federal Network Agency is generally responsible for complaints relating to the Data Act. As soon as personal data is involved, it must involve the Federal Commissioner for Data Protection and Freedom of Information. The state data protection authorities remain responsible for traditional infringements of the GDPR – for example, if a farmer complains that a manufacturer is processing their personal data.

The 4th HÄRTING AI Day will take place in Berlin on 19 November 2026. The event will focus on current issues relating to artificial intelligence, the AI Act, data protection and the practical application of AI in businesses.

The federal states have established a single market surveillance authority to monitor compliance with the BFSG. The authority has now commenced its work.

In episode 43 of the Data Navigator podcast, Dr Martin Schirmbacher, partner and specialist solicitor in IT law at HÄRTING Rechtsanwälte, and Dr Hubertus von Roenne, partner at the strategy consultancy Upgrade, speak with Dr Matthias Nachtmann about the use of data in agriculture. Matthias Nachtmann is the founder and chairman of Friends of Digital Farming, an association promoting the digitalisation of agriculture and food. In the discussion, he explains how data usage currently works in agriculture and what conditions are needed for a functioning data economy in the agri-food sector. Among other things, the discussion addresses why farmers today are often faced with differing data requests from various customers, the role of common rules for data exchange, and why data only scales when it delivers concrete productivity benefits to farms. Other topics covered in the episode include process data and location data in the field, the example of nitrogen with varying requirements across different federal states, and the question of who should define the ‘traffic rules’ for a functioning data economy. Federalism and its impact on innovation in the agricultural sector are also discussed. Further information on digital farming Consultancy and strategy on digital farming by Dr Matthias Nachtmann Friends of Digital Farming Fraunhofer IESE: Digital Farming / Smart Farming Chair of Digital Farming at RPTU GeoBox Rhineland-Palatinate Further podcast episodes on data in the agricultural sector Episode 38: The Data Act from a machinery manufacturer’s perspective with Georg Larscheid from Claas Episode 34: The Data Act from a farmer’s perspective with farmer Dag Frerichs Episode 24: What does the Data Act mean for the agricultural sector? with Prof. Dr Reinhard Grandke All previous episodes of the Data Navigator podcast on the Data Act Data Navigator Newsletter Using data: New every two weeks. Subscribe to the Data Navigator Newsletter now. General information on the Data Act The Data Act as adopted by the Council of the European Union on 27 November 2023 FAQ on the Data Act: “You ask, we answer: How the Data Act affects your business!”

From 19 June 2026, companies must provide an electronic cancellation function for B2C contracts concluded online. The new Section 356a of the German Civil Code (BGB) contains detailed requirements for the design of this process and thus creates a considerable need for implementation in online retail.

The Data Act harbours many ambiguities. We have collected and answered the most frequently asked questions about the Data Act from presentations and client work. Is your question not included? Then please get in touch with us!