»ZEIT ONLINE: Die großen Konzerne können einfach einen Anwalt anrufen, um die DSGVO umzusetzen. Aber kleinere Betreiber, gerade Blogger und Vereine, haben oft nicht das Geld und wissen nicht, wie sie alle Kriterien umsetzen sollen.
Jourová: Die sollen mir eine E-Mail schicken.
ZEIT ONLINE: Wir werden das genauso veröffentlichen.
Jourová: Ja, ja. Machen Sie das.«
Meine Mail an die Dame ist gerade raus. 
Jetzt kam die Antwort:
Brussels, 28/06/2018
JUST.C3
Subject: Your mail to Commissioner Jourová
Dear Mr ...,
thank you for your mail to Commissioner Jourová, who asked us to reply on her behalf. We
apologise for the delay in replying.
We appreciate your efforts to correctly implement the requirements of the General Data
Protection Regulation (GDPR) and take note of your concerns.
We would like to clarify that the GDPR does not substantially change the core principles of
the EU data protection legislation dating back to 1995 and which was the basis of the German
data protection law valid until 24 May 2018. Except if your core business is data processing
and/or dealing with sensitive data, and provided that you were already in compliance with the
previous legislation, you will not need to make major changes to your data processing
operations to comply with the GDPR.
The aim of the GDPR is to empower individuals and give them more control over their
personal data, because we witness growing threats coming from massive data breaches or
identity theft. But the GDPR is also designed with businesses in mind. It harmonises the rules
across the EU and gives more flexibility to controllers and processors processing personal
data due to accountability principle and the risk-based approach. It also contributes to the
confidence of customers and consumers.
For information on the General Data Protection Regulation, we recommend visiting the
website of the Directorate-General Justice and Consumers, which contains guidance for
citizens, businesses and other organisations as well as documents regarding the application of
the GDPR: https://ec.europa.eu/commission/pri…dataprotection/
2018-reform-eu-data-protection-rules en, and, in particular, the factsheet “Seven
steps for businesses to get ready for the General Data Protection Regulation“:
2
https://ec.europa.eu/commission/sit…eet-business-7-
steps_en.pdf.
The monitoring and enforcement of the application of the GDPR is a task of the competent
national protection authority and of the courts. National protection authorities are also in
charge of providing advice on the application of the GDPR. We would therefore advise you to
consult them on specific questions you might have. Regarding the contact details of the
competent German data protection authorities, we would like to point you to the following
website: https://www.datenschutzwiki.
de/Aufsichtsbeh%c3%b6rden und Landesdatenschutzbeauftragte.
The national data protection authorities of the EU, regrouped in the European Data Protection
Board, have issued guidelines on key aspects of the GDPR:
http://ec.europa.eu/newsroom/artic…?item_type=1360.
We would like to point out that this information and guidance are intended to contribute to a
better understanding of EU data protection rules. This is intended purely as a guidance tool –
only the text of the General Data Protection Regulation (GDPR) has legal force. As a
consequence, only the GDPR is liable to create rights and obligations for individuals. This
guidance does not create any enforceable right or expectation.
The binding interpretation of EU legislation is the exclusive competence of the Court of
Justice of the European Union. The views expressed in this guidance are without prejudice to
the position that the Commission might take before the Court of Justice. Neither the European
Commission nor any person acting on behalf of the European Commission is responsible for
the use which might be made of the following information. As this guidance reflects the state
of the art at the time of its drafting, it should be regarded as a 'living tool' open for
improvement and its content may be subject to modifications without notice.
We hope that this information gives a first guidance to you in putting the General Data
Protection Regulation in practice.
Kind regards
Olivier Micol
Head of Unit