The primary law governing background checks in Germany is The Federal Data Protection Act (Bundesdatenschutzgesetz (BDSG). As of 1 September 2009 the BDSG provides comprehensive regulation of the processing of personal data. In addition, each German State has privacy legislation and data privacy commissioners to enforce State laws. The German federal government amended the existing law on the processing of employee data in June 2010.. This new law now applies to virtually all data collected and used by employers over the course of an employment relationship. The new law allows employees to consent to the background check; however, it is very strictly limited.
According to Sec. 32a para. 8 of the law, any personal data shall only be collected directly from the affected employee or applicant. Any collection of data on the applicant from a third party requires prior opt-in consent. An exemption is made only for data that is publicly available so that Internet searches on the individual will generally remain permissible. In case an employment relationship has not been founded, the data of the applicant may only be stored further if the applicant has consented.
In addition, a prospective employer may only ask questions relating to particularly sensitive subject matter if the information is significantly and decisively pertinent to the work. In this context, sensitive data includes: disabilities, health, religious or political views – as well as criminal records and financial standing.
