Read an interview here with “our” Professor Gerhard Kongehl, who trains data protection experts through his company, udis, and is based at the TFU Gründerzentrum in Neu-Ulm.
TFU: Professor Kongehl, you have been working as a data protection expert for over 30 years and founded the company udis more than 25 years ago. Congratulations! At udis, you train experts using the Ulm Model. I assume these are professionals from larger companies?
GK: Thank you for the congratulations; we’ve really invested a lot of time and effort into this important issue. But your assumption is wrong: Data protection isn’t just a concern for larger companies. More than 70% of the trainees at udis come from small and medium-sized businesses!
TFU: I see! But even from companies that are really young and small?
GK: No, of course, it’s mostly established companies; aside from the relatively low fees, the training takes quite a bit of time. Finding the time for it is the main problem, because we all have busy schedules.
TFU: But what should a young entrepreneur—male or female—do? Just ignore data protection for now?
GK: Of course not. Contrary to popular belief, data protection isn’t that difficult, and with professional data protection, you can even save money. The key is to keep a few important considerations in mind and act accordingly.
TFU: And what are they?
GK: Well, first of all, everyone in the company needs to be absolutely clear on this: other people’s data is completely private. Assume that you are not allowed to use it. If you do need to use it, it should only be for valid, legally defined reasons.
TFU: Isn’t that also a valid reason for wanting to do business with data? Especially for Internet companies, that treasure trove of data is the most important thing, after all!
GK: All individuals affected by data processing—including customers, insofar as they are natural persons—must be informed of how their data will be used. In many cases, consent must even be obtained from the data subjects in advance. And, of course, data is valuable. But that doesn’t mean you can just use it. After all, you wouldn’t walk into a jewelry store and steal a gold watch just because it’s there and it’s valuable.
TFU: So, is it okay to use data, or isn’t it?
GK: If the individuals whose data is being processed give their consent, you may always proceed. However, I caution against “tricking” people into giving their consent in any way—if consent forms are hidden or can be easily altered, we’re on thin ice, both from a moral standpoint and from a legal one. Facebook is a cautionary tale. If you’re smaller than Facebook and don’t have a 99% market share—you might want to consider whether you’d be better off taking a more transparent approach.
TFU: The younger generation is obviously much less hesitant to share their data than older people. Aren’t we just being too cautious?
GK: Just let something really bad happen a few times—something made possible by data that was shared too carelessly. The tide can turn quickly, but the data is already out there. Besides, if a user does something voluntarily, that’s okay—as long as he or she really knows what it means and what they’re doing. Unfortunately, very few people do. So, in addition to educating users, it’s absolutely essential that companies be forced to take data protection seriously. Just because something is possible doesn’t mean it’s okay.
TFU: Back to founders: What does this actually mean for a young company? What do they need to keep in mind? Without what precautions might they be liable to prosecution?
GK: Basically, it’s quite simple and can be summed up in five sentences:
1. The use of personal data is generally prohibited.
2. “In general” means as long as no exceptions have been specified.
3. Exceptions apply only if the data subject has given consent or if there is a legal basis that permits the processing of the data within defined limits.
4. One of these legal exceptions, which is important for companies, is that the processing of personal data is necessary for the conclusion, performance, or termination of a contract with the data subjects
5. Anyone who violates these regulations will face a fine that is intended to be higher than the financial benefit they would gain by ignoring them.
That’s it.
TFU: Dear Professor Kongehl, thank you very much for the interview, and we wish you continued success!
