# German Federal Administrative Court (BVerwG), judgment of 27 September 2018, 7 C 5/17

Requirements for national legal bases for data processing in the public sector; limits of general catch-all clauses.

> Quelle: https://www.thomashelbing.com/en/wissen/dsgvo-hub/rechtsprechung/1.4.21-bverwg-7-c-5-17
> Sprache: en



## 1 Overview [#1-overview]

The decision concerned the reach of Bavarian state law governing data processing by public bodies. The German Federal Administrative Court (BVerwG) addressed the question whether a general provision assigning tasks satisfies the requirements of Article 6(3) GDPR.

Reference: [BVerwG, judgment of 27 September 2018, 7 C 5.17, NVwZ 2019, 473](https://www.bverwg.de/270918u7c5.17.0)

## 2 Requirements under Article 6(3) GDPR [#2-requirements-under-article-63-gdpr]

National legal bases for processing under Article 6(1)(c) and (e) GDPR must be sufficiently clear and precise. Blanket provisions assigning tasks do not satisfy that requirement; the legislature must itself frame the processing in sufficiently specific terms in order to comply with the requirement of specificity.

## 3 No supplementation by way of a balancing of interests [#3-no-supplementation-by-way-of-a-balancing-of-interests]

The BVerwG makes clear that the national legislature may not "top up" the necessity of a processing operation by means of general balancing-of-interests clauses. Article 6(1)(e) GDPR does not provide for an additional balancing of interests.


---

## About the author

This article was written by [Dr. Thomas Helbing, specialist lawyer for IT law in Munich](https://www.thomashelbing.com/en).

Since 2020 and continuously through today (2026), Handelsblatt has [recognized](https://www.thomashelbing.com/en#auszeichnungen) Dr. Helbing as one of **"Germany's Best Lawyers"** in IT law and data protection law.

According to Kanzleimonitor.de (2024 to 2026 editions), he ranks among the **leading lawyers for data protection and IT law** and is listed among the **top 100 lawyers in Germany (2024/25)**. Kanzleimonitor is considered a particularly meaningful market study because it is based exclusively on personal recommendations from in-house counsel.

Dr. Helbing has **many years of advisory experience in data protection and IT law** and advises clients of all sizes, from startups through fast-growing SaaS companies and unicorns to international corporate groups.

His [professional background](https://www.thomashelbing.com/en#stationen) covers the **full spectrum of IT and technology law practice**. He began his career at a major international law firm, then gained **in-house experience at a DAX-listed company**, and is himself an **entrepreneur and founder of several digital ventures**. He also has **hands-on programming experience**, which allows him to understand technical systems, software architectures and digital business models not only from a legal perspective but also from a technical one.

For many years, his [clients](https://www.thomashelbing.com/en#referenzen) have included **technology companies and SaaS providers**, leading **German research institutions** and a **systemically important German bank**. His advisory focus lies in particular on **GDPR compliance, the data economy, SaaS, AI regulation and IT contract law**.