Read this comment, it cites the relevant laws for Germany: https://news.ycombinator.com/item?id=15072474

But be aware, in May 2018 it all changes as the new EU GDPR comes into force, and that’s a bit more restrictive (and even applies to anyone processing or storing data of EU citizen, no matter where the processing entity is located)