Interview: "Data protection protects the weaker against powerful actors"

The number of data protection complaints and submissions from citizens increased sharply in 2025. In NRW, the State Data Protection Commissioner Bettina Gayk recorded almost 45 percent more submissions than in the previous year – a total of over 18,000. Other data protection authorities also report similar developments. "One thing the increase in complaints shows very clearly: Citizens want their data protection rights to be respected," emphasizes Gayk.

In Hamburg, complaints rose by 62 percent in 2025, with social networks, dating platforms, and AI applications being particularly affected. Hamburg's Data Protection Commissioner Thomas Fuchs speaks of a "major challenge" for the supervisory authorities – triggered not least by new AI offerings and growing public awareness. In Berlin, Data Protection Commissioner Meike Kamp reported an increase in submissions of around 50 percent for 2025 – it was striking that many complaints were formulated with the help of AI chatbots, which at the same time make the authority more visible but also raise false expectations about legal assessments.

Dismantling of rights under the guise of deregulation

Interest in data protection seems to be growing. At the same time, concerns are growing about the disempowerment of authorities and the weakening of the General Data Protection Regulation. Gayk warns in an interview against political "quick fixes" that could lead to a reduction of citizens' rights under the slogan of deregulation or innovation promotion. While discussions are underway at the EU level on omnibus procedures for the reform of the GDPR and the AI Regulation, and nationally about a reorganization of data protection supervision, data protectionists warn against reducing data protection to a supposed obstacle to innovation.

How innovation and fundamental rights protection can still be reconciled, why AI real-world laboratories must not be lawless spaces, and why data protection is indispensable for a democratic society, explains Prof. Tobias Keber, State Data Protection Commissioner in Baden-Württemberg and Chairman of the Data Protection Conference 2026, in an interview with heise online. He advocates for data protection authorities to constructively engage in the ongoing reform processes, utilize optimization potential in the interplay of different legal acts, and at the same time secure the internationally recognized European protection standards. This requires stronger cooperation – also beyond data protection supervision – as well as practical guidance for business, administration, and society.

Do you feel a growing skepticism towards data protection in your work?

People turn to us, want advice, attend our training sessions, file complaints because they believe their rights have been violated. They want us to investigate such cases. In 2025, we received over 7,600 complaints, 90 percent more than in the previous year. In 2024, there were just under 4,000 complaints. But still: Yes. I notice that data protection increasingly has to justify and explain itself. It's about protecting a fundamental right that is of central importance for the information society. This also includes protecting the weaker against powerful actors, regardless of whether they are companies or state actors.

Data protection is not an end in itself. It ensures that people can move freely, decide freely, and choose freely. That is why data protection is also firmly anchored in the primary law of the European Union, the EU Charter of Fundamental Rights. With all the necessary discussion about simplification, streamlining, and deregulation, it must be clear from the outset that in Europe we want a digitalization and technologization that is oriented towards fundamental rights and based on rules.

There are increasingly loud political demands for faster innovation – if necessary through deregulation. How does that fit together?

Innovation is important, no question. But if innovation is only possible by dismantling fundamental rights, then it is not sustainable innovation. That is precisely why we co-founded MindBW, which deals with AI real-world laboratories: as an initiative for human-centered innovation. The human being should not just be rhetorically, but actually at the center. Innovation and data protection go very well together and are not a contradiction.

What exactly is MindBW – and what distinguishes it from previous real-world laboratories?

MindBW is primarily a network that works interdisciplinarily: technology, ethics, law, administration, health research, consumer protection. Baden-Württemberg already has many real-world laboratories – we are talking about over 20 active ones at present. They have built up a lot of expertise.

However, the decisive difference now comes with the EU's AI Regulation. For the first time, it provides for AI real-world laboratories with legal effect. This means that certain data protection facilitations are possible in these sandboxes, such as the further processing of data for a different purpose – under clearly regulated conditions.

Sounds like a lot of freedom. Isn't there a risk of abuse?

No, because an AI real-world laboratory is not a lawless space. Each project has a clear plan, milestones, and a fixed duration. We have learned from the classic real-world laboratories that endless testing phases can be problematic. This should not happen again with AI real-world laboratories.

What do companies or research institutions specifically gain from this?

They get a protected experimental environment and, above all, legal certainty. At the end, there is a final report that clearly states: What is permissible, what is not. This is extremely valuable for companies. AI real-world laboratories can be enormously helpful for progress; we should not miss the opportunity for this in Baden-Württemberg. Since we see ourselves as a learning authority, the knowledge gained from the AI real-world laboratories also benefits our daily work.

Who is involved in MindBW?

The project is broadly based, with researchers from the health sector, the Institute for Digital Ethics, the Applied AI Institute for Europe at IPAI Heilbronn (Editor's note: Innovation Park Artificial Intelligence), and my authority involved, for example. We bundle technical, legal, societal, and supervisory expertise equally. The network is still under development, but the core team is already very functional.

You have taken over the chairmanship of the Data Protection Conference (DSK) for 2026. What is particularly important to you?

Now I am speaking as DSK Chairman: In addition to the goal of safeguarding data protection rights, the DSK aims to ensure uniform application of data protection law and to jointly advocate for its further development. The narrative that the DSK is constantly in disagreement is not true. On the contrary: the pursuit of consensus laid down in the rules of procedure is actually the norm within the substantive issues dealt with by the conference. If this is not the case in exceptional circumstances, majority decisions can also be made.

Regarding the further development of data protection, legislative changes to the GDPR and the AI Regulation are pending with the omnibus procedures, among other things, which we want to accompany constructively. Overall, for contemporary data protection supervision, it will be important to cooperate constructively and efficiently with an increasing number of actors involved in data, AI, and digital law.

You mentioned it: At the EU level, the reform debate on the GDPR is underway – keyword "Omnibus Procedure". Why do you view it critically?

The omnibus procedure is originally intended to correct typos. Now, fundamental issues are being discussed there: the definition of personal data, the introduction of legal bases for training and use of AI, and modifications to data subject rights. These are not minor issues. Doing something like this in a fast-track procedure carries the risk of a deterioration of the legal situation. Not all of the Commission's proposals are conducive to greater legal certainty either. As the DSK, we are constructively contributing to the debate. Last year, the DSK pointed out that the Commission's reform considerations fall short in other areas and leave potential for improvement unaddressed. For example, manufacturers of products could be made more responsible for designing their products in compliance with data protection. Small and medium-sized enterprises would then no longer bear the main data protection burden when selecting and using such products.

There are also discussions at the national level – for example, about the disempowerment of state data protection authorities. How realistic is that?

Different models are currently being discussed politically, including strengthening the DSK through a secretariat. The DSK expressly supports this. There is no concrete draft law yet.

Why is data protection indispensable in your view?

Data protection is not an obstacle, but a prerequisite for freedom, democracy, and value-based innovation. Those who sacrifice it carelessly often realize too late what has been lost.

(mack)