The draft Belgian Data Protection Act aimed at implementing the GDPR was approved on 16 March 2018 by the Council of Ministers at its first reading. The draft has been submitted to the Council of State for opinion, as well as to the Belgian Privacy Commission. The revised draft will be submitted to the Federal Parliament for adoption.
The Belgian Federal Parliament adopted the Act of 3 December 2017 establishing the Data Protection Authority as the successor of the existing Belgian Privacy Commission.
The German Data Protection Amendment Act ("GDPAA") passed on 5 July 2017 and enters into force on 25 May 2018. There was only one section that established the right of DPAs to file an action that took immediate effect on the day after the publication of the GDPAA, i.e. on 6 July 2017.
The Parliaments of both the Bund (federal level) and the German Federal States ('Bundesländer', regional level) are now in the process of adapting further Federal States law and sector specific law to the GDPR. These procedures are mainly still ongoing, but are finalised in some areas.
At the federal level, the so-called Second German Data Protection Amendment and Implementation Act is in the making, which will adapt a very large number of federal laws (including i.a. the German Civil Code, eGovernment Act, BSI-Act, Social Security Codes, etc.) to the GDPR requirements. The draft of this “Omnibus law” is not published yet, and the legislative process will likely not begin before summer 2018.
The Federal States are also in the process of changing their laws to meet the GDPR requirements. Only parts of these lawmaking processes have been finished yet, and many legislative procedures are still ongoing.
In the following Federal States the respective acts have been promulgated:
• Brandenburg: Act on adaptation of the general data protection law to the Regulation (EU) 2016/679 and on implementation of the Directive (EU) 2016/680 (Gesetz zur Anpassung des Allgemeinen Datenschutzrechts an die Verordnung (EU) 2016/679 und zur Umsetzung der Richtlinie (EU) 2016/680) dated 8 May 2018
• Bremen: Bremen Act on implementation of the General Data Protection Regulation (Bremisches Ausführungsgesetz zur EU-Datenschutz-Grundverordnung) 8 May 2018
• Hessen: Hessian Act on adaptation of Hessian data protection law to the Regulation (EU) 2016/679 and implementation of the Directive (EU) 2016/680 as well as freedom of information (Hessisches Gesetz zur Anpassung des Hessischen Datenschutzrechts an die Verordnung (EU) Nr. 2016/679 und zur Umsetzung der Richtlinie (EU) Nr. 2016/680 und zur Informationsfreiheit) dated 3 May 2018
• Saarland: Act no. 1941 on adaption of the data protection act of the Federal State Saarland to the Regulation (EU) 2016/679 (Gesetz Nr. 1941 zur Anpassung des Saarländischen Datenschutzgesetzes an die Verordnung (EU) 2016/679) dated 16 May 2018