May companies (e.g. trade fair organisers, theatres, etc.) collect, store or transmit data of customers or visitors to events at the request of health authorities in case it later becomes known that an infected person was at the event?

Section 16 Para. 1 IfSG (Infektionsschutzgesetz ─ German Infection Protection Act) provides: "If facts are established which could lead to the emergence of a transmittable disease, or if it is to be assumed that such facts exist, the competent authority shall take the necessary measures to remedy the dangers threatening the individual and/or the population. The personal data collected in the course of these measures may be processed only for the purposes of this law.”

In the event that the competent authority has issued an order to store visitor data, the organiser may base his request for the collection and storage of the data in compliance with the official request order on Article 6 (1) letter c) and (2) and (3) GDPR. Such a request for the storage of visitor data regularly corresponds with an obligation to transmit the data to the competent authority, for example under the provisions of Section 16 (2) sentence 3 IfSG. Accordingly, the obligation exists to provide the necessary information and to submit documents at the request of the authority.

As soon as such an official request order has been issued, the company affected should check whether the resulting data processing (in particular the collection and storage of the data in question and, if applicable, the transfer to the health authority) is mentioned in the information to be provided by it under Articles 13, 14 GDPR and, if not, make an adjustment.

As long as no official request order has been issued, organisers are free to collect and store the names and contact details of their visitors for the purpose of transmitting them to the health authorities upon request on the basis of a consent pursuant to Article 6 (1) letter a) GDPR of the visitors. In such cases, the duration of storage should be based on the presumed incubation and detection period of infections.

Source: The Baden-Württemberg State Commissioner for Data Protection and Freedom of Information (available at (in German)