For over a year the German government has been drafting a law to bring its legal system into line with the requirements of the "Information Age". This was originally called the "Multimedia Law", and a preliminary draft was released in July 1996. Since it was felt that the term "multimedia" was too vague, the title was then changed to "Information and Communications Services Law". A semi-final draft of this new law (hereinafter referred to by its German acronym "IuKDG") was released for public comment on November 8, 1996, and it is this version which will be commented on here. The IuKDG is composed of 12 articles; in some cases the articles themselves constitute individual laws, while in others they amend pre-existing laws. A translation of the draft is appended to this article.
This is the so-called "Law on the use of Teleservices" or "TDG". This law is designed "to create uniform economic conditions for the various uses of electronic information and communication services" (s1), and sets forth several important general principles regarding the use and provision of online services in Germany. "Teleservices" are defined very broadly (s2(2)), and the term is likely to include nearly all types of online services, including telebanking, electronic data bases, Internet access, the offer of good and services over the Internet, etc. The law provides that teleservices do not need to be licensed (s4), but does provide certain legal restrictions for their use. Most importantly, s5 sets forth liability rules for Internet content. In general, service providers are responsible for content which they themselves provide, and not responsible for third party content to which they merely provide access, but are responsible for third party content which they make available for use "if they have knowledge of such content and blocking its use is both technically possible and can be reasonably expected".
The provisions regarding responsibility have met with varying reactions in Germany. On the one hand, they finally provide some criteria for determining the responsibility of service providers, which is to be welcomed, while on the other hand they seem rather vague, so that it is not clear to what extent they will actually improve the present legal situation for service providers (Compuserve has, for example, sharply criticised these provisions).
This is the so-called "Law concerning Data Protection in Teleservices", and is designed to provide some clarity with regard to the obligations of service providers in the data protection area (general German data protection law continues to apply to teleservices to the extent that they are not regulated in this law). The main principle of the law is that "personal data may only be collected, processed, and used by service providers to perform teleservices if this law or another legal provision so allows or the person affected has given his consent" (s3(1)). The provision of teleservices may not be made dependent on a person giving such consent (s3(3)), and users of teleservices must be instructed regarding the collection of personal data (s3(5)). Most importantly, consent may now be made electronically, which was previously not allowed under German data protection law; this may, for example, allow the use of digital signatures in the giving of such consent (s3(7)). The service provider must make it possible for teleservices to be paid for either unanimously or using a pseudonym (s4). Different conditions are set on the use of "contractual data", "use data", and "billing data" (õs5 and 6). Service providers need to study the data protection provision of the law closely, as it will impose important new burdens on them.
This is the "Digital Signature Law", and is by far the longest article of the IuKDG, taking up about half of its length. The Digital Signature Law has been revised intensively by the government in a series of drafts over the last few months, and is likely to undergo further changes before being presented to parliament for approval. Because of its length and complexity, it is not possible to give a detailed examination of the Digital Signature Law here, so that only a few salient characteristics can be mentioned.
The law is designed to regulate the general technical conditions for the use of digital signatures in Germany, and does not address a number of important legal questions which have so far hindered their acceptance, such as the frequent requirement in German law that documents be "in writing", meaning that they must be recorded on paper. The law sets forth a strict regulatory framework in order to ensure public confidence in the security of digital signatures, and provides procedures for the granting of licenses for certification authorities (referred to in the law as "certifiers", s4)
Observers familiar with digital signature laws from other jurisdictions (e.g. from the US) may be surprised by the absence of detailed provisions regarding liability; while this has been criticised to some extent in Germany (e.g. by consumer groups), it is justified by the government on the grounds that German law already contains general provisions on tort liability that will likely be sufficient for any problems which arise. On the key question of how users of digital signatures are to be identified by certifiers, the law has a general provision which only requires that they be identified "reliably" (s5(1)); this will likely result in procedures already in use in Germany for identification, such as presentation of a passport or identity card at the opening of a bank account. The law provides for an "government authority" to regulate the use digital signatures and to provide such services as stepping in if a certifier goes out of business; this is likely to be the regulatory body for the telecommunications industry set forth in the new German telecommunications law, which was recently passed. The Digital Signature Law further provides specific data protection provisions, and sets forth requirements for the use of technical components in digital signatures (õs13 and 14).
An important question relates to use of technical components and certificates which come from outside Germany. The law sets forth different criteria for such requirements and for certificates coming from inside and outside the EU; while EU technical components and certificates can be recognised based on a level of security substantially similar to that in Germany, non-EU certificates require the conclusion of an international agreement between Germany and the appropriate foreign jurisdiction in order for them to be recognised within Germany (s14(5) and s15). While this differentiation may be understandable owing to Germany's requirements under EU law, it is regrettable in that it will likely slow down the acceptance and use of digital signatures in Germany, as it will require a long and complex process of negotiating international agreements between Germany and foreign jurisdictions. The Digital Signature Law further provides for the adoption of an Ordinance (s16), which will be presented to parliament for approval together with the Digital Signature Law.
Article 4, 5, and 6:
During the recent controversy involving investigations of Internet service providers in Germany by public prosecutors, it came to light that German criminal law contains a number of gaps, so that, for example, information provided by online services does not always fall within laws which criminalize the dissemination of certain types of information (e.g. information harmful to minors). These articles contain amendments to the Criminal Code, the Law on Misdemeanors, and the Law on the Dissemination of Writings Harmful to Minors, so that information provided on computer networks in the future will come within such laws. Of particular interest for online service providers is a new s7a to be added to the Law on the Dissemination of Writings Harmful to Minors which will require individual service providers to appoint a "youth protection officer" responsible for advising them in questions relating to the protection of minors.
This article provides for amendment of the German Copyright Law in order to implement the EU Database Directive. Previously, under German copyright law a database which is a mere collection of facts was often difficult to bring under the definition of a copyrightable "work". The amendments now provide for such protection, as well as allowing certain exceptions, such as for reproduction for private use.
In drafting the Digital Signature Law, it was, as described above, decided not to make wholesale changes to German legal requirements which require a writing on paper; rather, the decision was made to make a couple of individual exceptions in order to test whether a general "electronic form" could be introduced in German law to supplement the traditional written form. One of these exceptions is in this article, which amends the "Law on the Protection of Distance Learning" so that "electronic declarations of will" (such as digital signatures) can be used.
Articles 9 and 10:
These articles amend the German "Price Information Law" and "Price Information Ordinance" to provide rules for giving information on screen regarding the provision of online services.
The IuKDG will continue to be the subject of negotiations between the government and the parliamentary opposition, so that changes (particularly in regard to data protection) are likely by the time it is finally enacted into law. The government's plan at present is to present a final version of the law to the federal cabinet some time in late December. The law will then be the subject of parliamentary debate in negotiation throughout early 1996, and will hopefully be enacted into law in the summer of 1997.
This article is correct to the best of our knowledge at the time of its publication. However, it is written as a general guide, and specialist advice should therefore be sought regarding specific questions.
For further information, please contact Christopher Kuner, Gleiss Lutz Hootz Hirsch & Partners, Gartnerweg 2, 60372 Frankfurt, Germany, Fax number 49-69-95514198, e-mail firstname.lastname@example.org
The article is correct to the best of our knowledge at the time of publication. However, it is written as a general guide. Therefore specialist advice should be sought as regards your specific circumstances.