German data protection reform stalled by CSU resistance and Interior Ministry delay
German data protection reform stalls as CSU resistance and Interior Ministry delays prolong legal uncertainty for businesses; key decisions remain pending.
The planned German data protection reform, intended to centralize supervision of private-sector privacy rules, has run into internal resistance and procedural delays that threaten its near-term implementation. Chancellor Friedrich Merz and other coalition leaders had framed the move as a way to end years of legal fragmentation, but the proposal now faces opposition from elements of the CSU and a slow-moving interior ministry. The dispute centers on whether responsibilities for overseeing corporate data handling should be bundled in a strengthened Federal Commissioner for Data Protection and Freedom of Information.
Coalition leaders framed centralisation as legal relief
At a July 1 press conference, Chancellor Merz described the initiative as a simplification of complex rules and a reduction in bureaucratic duplication that has burdened companies. The reform under discussion would concentrate responsibilities in the office of the new federal data commissioner, Moritz Hennemann, who is scheduled to take office in October 2026 and succeed Louisa Specht-Riemenschneider. Proponents argue that moving authority from multiple state authorities to a single federal regulator would provide consistent decisions and legal certainty for businesses.
Supporters in the coalition, including CSU leader Markus Söder, publicly signaled willingness among some states to transfer oversight of the private sector to the federal level. Officials have pointed to the European legal framework and diverging state-level interpretations since the GDPR’s introduction as drivers for a unified national approach.
Interior Ministry reportedly delaying the reform dossier
Despite the public announcements, sources have told the Frankfurter Allgemeine Zeitung that a reform decision paper has sat within the Federal Ministry of the Interior for roughly four months without being advanced. The ministry’s spokesman has declined to say whether the document has been signed and only described the work as “internal preparatory steps.” The apparent inaction has prompted scepticism about the timetable and raised questions about whether the announced breakthrough reflects a binding agreement or a political signal.
The Interior Ministry has stated that the government and the Länder had agreed in December to implement the changes by December 31, 2027, but critics say the broad deadline lacks clarity on sequence and substance. Observers warn that delayed implementation will prolong the legal uncertainty that firms claim hampers investment and digital projects.
Bavaria’s dual-authority structure at the heart of resistance
Bavaria’s existing structure, unique among German states, is a focal point of the dispute. The state maintains two separate data authorities: the Bayerischer Landesbeauftragte for public-sector privacy matters, led by Thomas Petri, and the Bavarian State Office for Data Protection Supervision (BayLDA) in Ansbach, headed by Michael Will, which oversees the private sector. The BayLDA has become a regional advisory center and is credited by some local businesses for practical, proximity-based support.
Opponents of full centralisation argue that abolishing the BayLDA’s private-sector remit would erode regional expertise and responsiveness. Bavarian ministers have warned that the state’s economic stakeholders value localised oversight and that any transfer of powers should consider the operational consequences for ongoing cases and advisory services.
Business community and data experts cite fragmentation as a problem
Companies and privacy professionals have for years described Germany’s patchwork supervisory landscape as a barrier to compliance and cross-border operations. Multiple state regulators have at times issued conflicting interpretations of the same GDPR provisions, creating operational risk and legal unpredictability for firms operating nationwide. Proponents of reform say a single federal supervisory authority for the private sector would reduce duplicate proceedings and align enforcement.
Yet critics caution that centralisation alone will not resolve all tensions between European court rulings and national practice. They stress that the architecture of supervision, the scope of transferred powers, and transitional rules for pending proceedings will determine whether consolidation yields practical benefits.
State-level alternatives and Bundesrat endorsement complicate consensus
Not all states agree that full centralisation is the right path. In mid-June, the state-level data protection authorities issued “Stuttgart impulses” advocating for a distribution of responsibilities by thematic area, rather than a one-size-fits-all federal takeover. Separately, a Hamburg-led initiative proposed that a single authority should handle cross-state matters, with other regulators deferring in those cases—a model the Bundesrat approved on Friday, July 10, 2026.
The coexistence of competing models has deepened political divisions and given federal negotiators multiple conceptual routes to resolve the fragmentation. It also raises the prospect of protracted intergovernmental bargaining, including over which competences move to the federal level and which remain with the Länder.
Outstanding procedural questions and a protracted timeline
Officials on all sides acknowledge that any change will require detailed rules on the timing of transfers, treatment of ongoing investigations, and the future role of state authorities in overseeing public administrations. Michael Will and other state officials have pressed for greater specificity, arguing that vague political targets are insufficient to assess trade-offs and legal risks. The government’s self-imposed deadline of December 31, 2027 leaves time for negotiation, but it also means extended uncertainty for businesses awaiting firm regulatory direction.
For now, the fate of the German data protection reform rests on whether the Interior Ministry advances its decision paper and whether conservatives within the CSU reconcile centralising ambitions with Bavaria’s institutional preferences. The coming months are likely to see intense technical and political negotiations before a durable structure for data supervision emerges.
