The GDPR contains structurally similar obligations for public authorities and for private parties. This runs through the entire GDPR. The parallels are partly clear, partly hidden. Principles of state and administrative law thus find their way into all "civil" areas of law. Like the state legislator or state authorities, private individuals must, among other things

►  seek legal bases for their own actions [Tile O.03],

►  balance fundamental rights [Tile P.04],

►  weigh up interests [Tile BD.03],

►  fulfil transparency requirements [Tile O.07],

►  cite legal bases,

►  provide information on legal remedies,

►  meet the requirements of written form,

►  fulfil the obligation to state reasons,

►  fulfil the requirements of certainty,

►  carry out tests of appropriateness [Tile BD.05], tests of necessity [Tile BD.06], tests of reasonableness [Tile BD.07] and tests of proportionality [Tile BD.08],

►  carry out risk impact assessments [Tile BD.09].

These obligations ultimately make citizens the guardians of the common good. The use of private parties is not limited (as in the case of indirect third-party effect) to cases of market dominance, discrimination in mass transactions or the provision of public communication spaces, but affects every citizen and every company in every processing of personal data. This is the step from indirect to direct third-party effect of fundamental rights.

In sum, the obligations of the GDPR are likely to be an encroachment on private autonomy that violates the requirement of the Federal Constitutional Court (cf. BVerfG, judgment of 22.1.2011 - 1 BvR 699/06, para. 48), according to which the citizen is recognised by the fundamental rights as a free person who is self-responsible in the development of his or her individuality, may shape his or her actions according to subjective preferences in private freedom without being fundamentally accountable for this, and may only be called into service by the legal system in a limited manner and in particular in accordance with the principle of proportionality.

For more to this topic, see Veil, Datenschutz, das zügellose Recht - Teil III: Die totale Drittwirkung (in German)