Social Secrecy: How Social Data Is Protected in Public Agencies
Social secrecy is regulated in Section 35 of the First Book of the Social Code (SGB I). The provision sets out under what conditions benefit providers may handle information about people who apply for support. What exactly does this right protect, and when may an agency process data? This article explains the rules that together govern data protection in this field.
What Is Social Secrecy?
Under Section 35, paragraph 1 of SGB I, everyone is entitled to have benefit providers refrain from processing social data about them without authorization. Social secrecy thus creates a right for the person concerned and, at the same time, a duty for the bodies that keep this data in their files.
Section 67, paragraph 2 of the Tenth Book of the Social Code (SGB X) defines the term social data. It means personal data in the sense of Article 4, number 1 of the GDPR that a body named in Section 35 of SGB I processes for its tasks under the Social Code. Whether a piece of information counts as social data therefore depends not only on its content but also on who processes it and for what purpose. The same information about a person can fall under social secrecy in one setting and not in another.
A typical example is an application for a benefit: it is addressed to a benefit provider and not to arbitrary third parties. The protection applies to how the social data contained in it is handled.
Where Do the Conditions for Processing Come From?
The conditions for authorized processing are not set in a single provision. They come from the GDPR, the Second Chapter of SGB X (Section 67 and following) and the relevant books of the Social Code. These rules complement one another. When assessing an individual case, all three levels therefore have to be taken into account.
SGB X has its own rules for each step in handling data: for collection (Section 67a), storage (Section 67b) and transmission (Section 67d and following). That makes it possible to check each step separately for lawfulness. That data could lawfully be collected does not yet mean it may also be passed on to another body. Storage likewise needs its own basis.
Data may be collected when it is necessary to carry out a task of the body concerned. This criterion determines what details an agency can demand from a person. Data protection in public agencies thus rests on one simple question: is the information necessary for the specific task?
Which Rights Do Data Subjects Have?
The rights under the GDPR, such as the right of access, also apply against social benefit providers. Anyone who has filed an application can therefore ask what data the agency has stored about them. The special social law provisions do not displace the general rights but apply alongside them.
Summary
Social secrecy shields social data from unauthorized processing. Its basis is Section 35 of SGB I, supplemented by the GDPR and SGB X. Public agencies follow the principle of necessity: data may be collected and passed on only within the tasks of the body in question. Applicants can exercise their rights under the GDPR. This article offers a general overview and does not replace legal advice.