Moritz Hennemann has been Germany's Federal Data Protection Commissioner since 1 October 2026. In his first appearance before the Bundestag's Committee on Digital Affairs and State Modernisation, he called digital sovereignty a task for the whole state, and described data brokers' trade as "höchst problematisch und in vielen Fällen datenschutzwidrig" (highly problematic and in many cases in breach of data protection law). He also suggested stepping up enforcement against unlawful data transfers to countries outside the EU. The Bundestag lists the session for Wednesday, 7 October, and its news service reported it on 8 October.
The case for tightening
The strongest argument for a stricter regime is that personal data sold by brokers is hard to trace once it leaves the EU. A data subject cannot object to a sale they never see. A regulator that can only act after a transfer has happened may be acting too late. Hennemann's framing also has a respectable intellectual basis. He is a legal scholar who has researched the role of data in innovation and the economy, and he describes data protection as a "Vertrauenskatalysator" (trust catalyst) for digital state modernisation.
That framing matters. A commissioner who calls privacy a trust catalyst is arguing that confidence in data handling is a precondition for adoption, not a brake on it. The question is whether the instrument he reaches for fits the problem.
The law already covers outflows
Chapter V of the GDPR already regulates transfers to third countries. Article 44 sets the general principle. Article 45 covers adequacy decisions, Article 46 covers appropriate safeguards such as standard contractual clauses, Article 47 covers binding corporate rules, and Article 48 deals with transfers or disclosures not authorised by Union law. Article 49 lists narrow derogations. A broker moving profiles to a country with no adequacy decision and no valid safeguard is, on its face, already in breach.
The commissioner's own words point the same way. He described the trade as non-compliant "in vielen Fällen" (in many cases). If that is right, the gap is in enforcement and supervisory capacity, not in the text. New rules layered on top of Chapter V would burden the lawful majority of transfers, including the routine flows of German manufacturers, research hospitals and software firms. They would do little to stop operators who are already ignoring the existing rules.
The press reports do not say what a tightening would look like in practice, and a sound assessment has to wait for that detail. Three questions will decide whether it helps or harms. Does it target brokers specifically or all transfers? Does it sit in German law or in an EU instrument? Does it add obligations for exporters who already comply?
Legal uncertainty is already the main cost
Companies sending data to the United States rely on the EU-US Data Privacy Framework. On 3 September 2025 the EU General Court dismissed Philippe Latombe's annulment challenge, finding that the US ensured an adequate level of protection when the framework was adopted. It rejected the argument that the US Data Protection Review Court lacks independence. IAPP's report notes the court also said the Commission must keep monitoring the framework and may suspend, amend or repeal it. Latombe appealed to the Court of Justice on 31 October 2025, per WilmerHale's account. The framework therefore remains legally contestable, and the Court of Justice struck down both of its predecessors, Safe Harbor and Privacy Shield.
This is the context in which a new German push on outflows lands. Firms already plan for the possibility that their main transatlantic transfer mechanism could fall. An additional national layer, or a vaguer EU one, would raise compliance costs most for small and mid-sized companies that cannot run a transfer impact assessment team. Legal certainty is a form of data protection too, because rules that nobody can confidently follow protect no one.
A review should clarify, not just tighten
Hennemann also backed a GDPR review after about ten years, saying it makes sense to examine where more precision is needed and where legal uncertainty exists. He welcomed the debate on the EU Digital Omnibus and on a German data code (Datengesetzbuch). That is the more promising half of his remarks.
The Commission published the Digital Omnibus on 19 November 2025. According to Foley's analysis, it would add three sentences to the definition of personal data in Article 4(1), stating that information is not necessarily personal data for every entity merely because another party could identify the person. Critics argue this narrows the definition. Others read it as largely restating existing recitals. Either way, the proposal shows that the review is not a one-way ratchet. The same exercise that could tighten broker rules could also clarify when transfers are in scope.
A fair reading of the commissioner's position is that he wants both: sharper rules against abusive trade and fewer ambiguities for compliant firms. That balance is achievable only if the two are kept separate.
What would a proportionate approach look like?
- Enforce first. Use Chapter V and the supervisory authorities' existing powers against data brokers before drafting new transfer rules.
- Target the business model. Rules aimed at the resale of personal data are narrower and less costly than rules on every third-country flow.
- Settle the framework question. Clarity from the Court of Justice on the Data Privacy Framework would do more for transfer certainty than any new German provision.
- Fold changes into the EU review. A national tightening that diverges from the single market's rules would fragment the very market that digital sovereignty is meant to strengthen.
Digital sovereignty is a legitimate goal, but sovereignty built on unpredictable rules becomes a reason for investment to go elsewhere. Hennemann has a chance to define his term as an enforcement-led, evidence-based agenda. What he says next about the actual text of any proposal will matter far more than what he said in his first committee hearing.