Getting connected: Providing IT services to the German healthcare sector subject to ecclesiastical data protection law

Abstract

Due to the pandemic, digitisation is advancing at a quicker pace in Germany, especially in the healthcare sector. Many institutions in the German healthcare sector are owned by religious associations or church bodies. Software providers that consider entering into a contractual relationship, in particular with hospitals, may find themselves faced with ecclesiastical data protection laws of the different churches in Germany as well as the corresponding system of ecclesiastical courts and supervisory authorities. European countries generally have one supervisory authority for data protection. Germany, however, has not one but a myriad of supervisory authorities on both, a secular and ecclesiastical level, which are explored in this paper. This paper aims to give businesses interested in the opportunities arising from the digitisation development an overview of what it entails to conclude a contract for processing personal data of German entities in the healthcare and related sectors and points out the differences between the General Data Protection Regulation (GDPR) and the Catholic as well as Evangelical data protection law.