According to the Verbotsprinzip (i.e. precautionary principle), the processing of personal data is generally prohibited [Tile PC.08]. It is only permitted if there is a legal ground and the processing is justified in the specific individual case by this legal ground.

However, the GDPR is not content with imposing the obligation on the controller to base its data processing on a legal ground. In addition, there are numerous further preventive and accompanying obligations. Among other things, the data controller must

►  search for legal bases for his own actions,

►  observe the principles of data processing

►  balance fundamental rights,

►  weigh up the interests involved,

►  fulfil transparency requirements,

►  cite legal bases,

►  provide information on legal remedies,

►  meet the requirements of written form,

►  fulfil the obligation to state reasons,

►  fulfil the requirements of certainty,

►  carry out proportionality tests,

►  take technical and organisational measures,

►  fulfil documentation obligations.

Von Lewinski therefore also speaks of an entire Vorfeldschutzkaskade (i.e. a cascade of obligations that must be fulfilled beforehand). In total, the controller is subject to 68 obligations, which are shown on the tiles on this page and cited with the corresponding provisions.

Of course, not every controller has to fulfil all of these obligations for every processing operation. However, a large part of the obligations apply to most controllers and in principle to every processing operation.

In view of the general ban on processing personal data and the multitude of obligations, the question arises whether the GDPR in its entirety does not violate the requirement of the German Federal Constitutional Court [ruling of 22.1.2011 - 1 BvR 699/06, para. 48], according to which the citizen is

►  is recognised by the fundamental rights as a free person who is self-responsible in the development of his or her individuality,

 

►  may shape his or her actions according to subjective preferences in private freedom, without being fundamentally accountable for this,

 

►  may only be called into service by the legal system in a limited way and in particular in accordance with the principle of proportionality.