Title: VULNERABILITIES IN THE INFRASTRUCTURE

Vulnerabilities in the infrastructure

Identification Processes

In general it is possible for companies to require a special form of documentation from the other contracting party. The German ID Card Act (Personalausweisgesetz) contains provisions concerning use of the German ID card in the relation between citizens and public authorities as well as between citizens and companies. Section 4 para 1 Personalausweisgesetz lays down an opening clause generally permitting use of ID cards for identification in the private sector. However, using the ID card number in a way which allows linking of data is not permissible (Section 4 para 2 Personalausweisgesetz). In addition, a specific legal basis is needed for each case where a company intends to require someone to show an ID card or passport for identification purposes. Usually this legal basis will be section 28 para 1 number 1 Federal Data Protection Act (Bundesdatenschutzgesetz) if the provision’s requirements are fulfilled.

When engaging in business relations with companies, the forms of documentation used and even required as identification depend on the kind of service or contract the data subject is seeking to obtain or conclude. For some kinds of contracts specific legal requirements exist regarding the documentation to be used. These specially codified provisions usually cover the obligation to present an ID card upon entering into a contract or using a service.  

Showing an ID card or passport in Germany is required when opening a bank account. This obligation is derived from section 154 para 2 Tax Code (Abgabenordnung) and section 1 para 5 and section 2 para 1 Money Laundering Act (Geldwäschegesetz). The former lays down the obligation for entities running bank accounts to obtain certainty about the identity and address of individuals entitled to dispose. Requiring new customers who try to open an account to show their ID card or passport is regarded as an appropriate means to obtain this certainty. The latter law defines the obligation of credit institutions, financial service institutions, financial enterprises and insurance companies to establish the identity of the other contracting party when concluding a contract, establishing a business relationship intended to operate on a lasting basis. In this context identification means the establishment of a person’s name by means of a valid ID card or passport, as well as the date of birth, the place of birth, the nationality and the address.

Further occasions where companies require presenting an ID card or passport include closing a cell phone or landline service contract. Section 95 para 4 of the Telecommunication Act (Telekommunikationsgesetz) allows for the service provider to require presentation of an official identity card where it is necessary ‘to verify the subscriber’s particulars’. The service provider may make a copy of the identity card. The copy is to be destroyed by the service provider without undue delay once the particulars needed for the conclusion of the contract have been established. The transposition of Directive 2006/24/EC has also led to new know your customer obligations in the telecommunications sector.

In order to provide public authorities with the most recent address citizen registers are run in all German Bundesländer. In addition, also natural persons may obtain address information on citizens from these registers. Citizens are obliged to notify the responsible registration authority (Meldebehörde) within two weeks when

1. moving into a new domicile, or 

2. moving out of a domicile and not moving into a new domicile in Germany.  

Decentralized registers of residents are run according to the registration laws (Melderecht) of the German Bundesländer. These registers provide the latest address information which is available at the request of public authorities, if transmission is necessary for carrying out responsible tasks. Citizens are obliged to present all necessary documents to prove their statements, upon request to the registration authority. These documents usually cover an ID card or passport as well as the tenancy agreement.

The registration laws also provide an information right (Melderegisterauskunft) for natural persons other than the data subject. If a natural person or entity requesting the current first name and surname, doctoral degree, and address is able to identify the data subject based on first name and surname, date of birth, or a former address, the requested current information is generally provided (so called einfache Melderegisterauskunft). In addition, if the requesting natural person or entity can show probable cause of a justified interest, also the following data will be transmitted:

1. date and place of birth, 

2. former first and surnames, 

3. marital status, 

4. citizenship, 

5. former addresses, 

6. day of moving into / out of domicile, 

7. first name and surname of spouse or civil partner, 

8. legal guardian, 

9. day and place of death. 

A justified interest is for example assumed in case the requesting entity can show probable cause of pursuing legal claims against the data subject. As of today there are no publicly known cases in which perpetrators of identity-related crime have been able to obtain personal data in this way.