Rechtsfragen zur EU und Bundesrepublik Deutschland

Exam Review - Preparation

• The exam covers a range of topics related to EU law, fundamental rights, data protection law (including GDPR, BDSG, ePrivacy/TTDSG), cybersecurity law (NIS-2 Directive, RCE-Directive, Cybersecurity Act, BSIG), cyberresilience (Cyberresilience Act), cybersecurity in consumer protection law and civil law, the organisation of the exam, and how laws are made.

Exam Structure

• Select correct answers with a cross or similar marking.
• Clearly indicate any answer changes (e.g., additional arrows, underlining).
• Use a visible pen; avoid pencils and erasers.
• Ensure only one answer is correct unless specified otherwise.
• If multiple answers are correct, answer the question completely by selecting all correct options.

Topics for Review

• Introduction to EU law
• Fundamental Rights
• Data Protection Law: GDPR, BDSG, ePrivacy/TTDSG
• Cybersecurity Law: NIS-2 Directive, RCE-Directive, Cybersecurity Act, BSIG
• Cyberresilience: Cyberresilience Act
• Cybersecurity in consumer protection law and civil law
• How laws are made (process)
• Separation of powers (EU and German levels)
• Hierarchy of law (EU primary law, secondary law, regulations, directives)
• Legislative procedure (ordinary legislative procedure, roles of EU Commission, Parliament, and Council)
• Interpretation of legal texts (wording, historical interpretation, systematic interpretation, teleological interpretation, conformity with constitutional and Union law)
• Catalogues of fundamental rights in Europe (German Constitution, European Convention on Human Rights, European Union Charter of Fundamental Rights)
• Violation of fundamental rights: scope of protection, justification, proportionality
• Three functions of fundamental rights: right of defense against state actions, the state's duty to protect against interference, basic rights to participation
• Right to private life / data protection / informational self-determination (German Constitution, EU Charter, ECHR)
• Data Protection Law (overview, implementation, update by GDPR)
• Applicability: GDPR: personal data, processing (definitions)
• Identified or Identifiable: all means reasonably likely, the controller's use of data
• Typical mistakes in anonymization
• Roles and persons (controller(s), processor(s), joint controllers, European Data Protection Board)
• Territorial scope (domicile principle, market place principle, legal exclave)
• Privacy Principles (legal basis, lawfulness, fairness and transparency, data security, integrity and confidentiality, accountability, data minimization, accuracy, storage limitation, right to erasure, right to restriction of processing)
• Legal basis for processing personal data (consent, contract, vital interest, legitimate interest, legal obligation, public duties, electronic communication, employment, collective agreements, research purposes, social law, trade law, tax law, public law, special categories of personal data).
• Consent (freely given, specific, informed, unambiguous, active, revocable)
• Privacy by Design: Risk-based approach (risks, costs, state-of-the-art, and implementation) Technical Measures: anonymization, pseudonymisation.
• Data Protection by default, Security of processing, protection impact assessment
• Data Processing in & outside EU (adequacy decisions, transfer safeguards, derogation rules), Checklist.
• Cybersecurity Law: NIS-2 Directive, goals, content, changes to previous Directive, applicability (critical sectors, annexes)
• Cybersecurity Act: ENISA mandate, EU certification scheme
• Cyberresilience Act: objective, applicability, products with digital elements, concept of criticality, levels, modules, obligations of manufacturers, importers, and distributors
• Consumer Protection & Civil Law: Contract Law (B2C vs. B2B, product defects, cumulative defects, obligations to update, expected periods of availability, relevant legal directives (specific directives and year of enactment))
• Applicability of Consumer Protection Law: contract between consumer and trader/seller (payment, provision of digital product, personal data, digital content/service, good with digital element), legal requirements.
• Training & Practice Cases (handwritten notes case, dynamic IP case, European General Court case)