Digital integrity as fundamental right | IT-Medienrecht

Digital Integrity: Legal Frameworks and Compliance for Companies and Platforms

Digital integrity refers to the protection of personality in networked systems. This concept extends beyond the body and mind, encompassing data, devices, accounts, and digital life circumstances. While Germany currently lacks an explicit fundamental right with this specific name, existing constitutional and EU law guarantees already safeguard key elements. Consequently, this leads to specific compliance obligations for companies and platform operators.

Constitutional Basis in Germany

The anchor is the general right of personality, derived from Art. 2 para. 1 in conjunction with Art. 1 para. 1 GG. In 2008, the Federal Constitutional Court further developed this right to guarantee the confidentiality and integrity of information technology systems. This is often referred to as the “IT fundamental right.” This protection covers not only individual data but also the entire IT system, especially when a comprehensive personal image could be reconstructed from its use. Thus, a digital sphere of personality is recognized, subjecting intervention measures to strict conditions.

This framework is supplemented by informational self-determination, derived from census case law, and the state’s duty to protect. Private security deficits leading to massive personality impairments can trigger state response and guarantee obligations. However, there is not yet an explicit “fundamental right to digital integrity” in the German Basic Law’s wording. Instead, the matter is currently addressed through interpretation and specialized law, particularly concerning data protection.

European Legal Framework: Charter, DSA & AI Act

At Union level, Art. 7 CFR (respect for private and family life) and Art. 8 CFR (protection of personal data) safeguard digital privacy. The GDPR specifies this in Art. 5 (data minimization, integrity, and confidentiality) and Art. 25 (privacy by design/default). Furthermore, since 2022, the EU has codified “Digital Rights and Principles” as political guidelines. These aim for a human-centered, secure, and sustainable digital order.

Two regimes are of particular operational relevance for companies and platforms:

• The Digital Services Act (DSA)

  The Digital Services Act (DSA) addresses due diligence obligations for intermediary services and platforms. This includes risk management, reporting and redress channels, protection of minors, and transparency of recommendation systems. The DSA provides legal protection for the digital sphere of action and communication, even against private gatekeepers.

• The AI Act

  The AI Act, applicable since 2025 with staggered transition periods, introduces risk-based requirements for AI systems. These range from transparency obligations to bans on certain practices, such as real-time biometric remote identification outside narrow exceptions. For companies, a governance framework is being created that practically protects the digital integrity of natural persons.

The result is clear: An independent EU “fundamental right to digital integrity” does not exist. Nevertheless, the combination of the CFR, GDPR, DSA, and AI Act establishes material protection standards that functionally equate to fundamental rights protection.

Reform Debates and International Impulses

The idea of an explicit “Digital Fundamental Rights Charter” has been under discussion for years. Civil society drafts and academic proposals outline various formulation options, adapting traditional protected rights to the realities of the internet and platforms. In Germany, practical development currently focuses on specialized law, such as platform and security law, and the judicial further development of personality rights.

It is insightful to consider Switzerland, where cantonal constitutions have recently included the right to digital integrity. The term used there normatively aims at an independent protection status for digital spheres. This provides valuable argumentation material for the German discourse, though it does not replace the established dogma of fundamental rights here. An amendment to the Basic Law would be politically feasible. However, its legal policy justification would need careful consideration, given the functioning doctrine of fundamental rights and the existing support from EU law.

Practical Compliance Roadmap for Digital Integrity

Regardless of an explicit fundamental rights formula, digital integrity is already a critical compliance issue today. An integrated roadmap is recommended:

1. Define assets to be protected: Personal data, communication content, account integrity, device and session security, identity, and reputation protection. Map these to Art. 5, 25 GDPR.
2. Technology & processes: Implement encryption at rest and in transit, harden endpoints, use secrets management, build zero-trust architectures, apply role-based access, utilize secure default settings (“privacy by default”), and ensure logging with strict purpose limitation.
3. Check DSA obligations (for intermediary services): This includes reporting channels, notice-and-action processes, complaints and internal re-review mechanisms, protection of minors, transparency reports, and recommender controls. Extended obligations apply to very large platforms where necessary.
4. AI Act readiness: Conduct a system inventory, classify risks (prohibited/high/limited/minimal), establish compliance and documentation processes, implement data and model governance, and ensure human oversight. Contractual enforcement against providers and integrators is also crucial.
5. Data protection impact assessments (DPIA): Perform these for risky processing operations. Develop clear remedial concepts, operationalize data subject rights, and manage incident responses with defined reporting chains.
6. Supply chain & contracts: Address technical and organizational measures (TOM), audit/sub-processor chains, AI use and training clauses, export controls for models/parameters, security SLAs, and provisions for exit and data portability.
7. Product and market risk assessment: Combine abuse-prone features, such as deepfake functions, with robust abuse prevention measures (e.g., watermarks/provenance, rate limits, and abuse detection).
8. Documentation & accountability: Maintain proof of measures taken (accountability), conduct regular management reviews, and perform training and penetration tests.

Fazit

Even without an expressly standardized constitutional title, digital integrity is already legally binding. It is addressed under constitutional law through the right of personality and under EU law via the GDPR, DSA, and AI Act. In practice, genuine protection lies not in nominal designations, but in the comprehensive implementation of specific protection and due diligence obligations.