(1) When setting up a procedure for automated retrieval, the body authorised to retrieve data is required to implement appropriate technical and organisational measures as referred to in Articles 24, 25 and 32 of Regulation (EU) 2016/679 to ensure that data can be retrieved only by persons authorised to do so and that only those data are retrieved which are necessary to carry out its tasks.
(2) Where an automated retrieval as per section 34a finds the records of different persons, identifying features are created and transferred for that purpose. The data referred to in section 3 may not be processed to create such identifying features. The recipient of the data may transfer the identifying feature only to the registration authority.
(3) As regards the public bodies referred to in section 34 (4) sentence 1 and other public bodies determined by federal or Land law, it is to be ensured at all times, in the case of central Länder collections of registration data or, if such do not exist, in the case of other bodies determined by Land law, or in the case of the registration authorities, that data can be retrieved via the Internet or the network linking the Federation and the Länder. Subsection (1) sentences 2 to 4 applies accordingly.
(4) The retrieving body is responsible for the permissibility of each individual automated retrieval. The registration authority checks the permissibility of the retrieval only if there is reason to do so.