(1) When using automated retrieval in the case of a search for persons and data validation, the registration authority is to log the following:
1. the body authorised to retrieve the data,
2. the data retrieved,
3. the time of retrieval,
4. the file reference of the retrieving authority,
5. the reason for the retrieval,
6. the retrieving person’s identification code or, in the case of automated retrieval, the designation of the procedure and
7. the records labelled as ‘retrievable’ based on the selection data relating to the persons found (hits).
(2) In the case of a free search by automated retrieval,
1. in addition to subsection (1) nos. 1 to 6, the selection data used are to be logged and
2. instead of the hits referred to in subsection (1) no. 7, the records labelled as ‘retrievable’ relating to the unnamed individuals found (results) are to be logged.
(3) If the retrieving body, or the body making an automated request, is one of the authorities referred to in section 34 (4) sentence 1, then it is required to log this information.
(4) The registration authority is required to log the following data in the case of automated data retrieval by the data subject via an administrative portal (section 2 (2) of the Online Access Act):
1. the data subject’s family name, given names, date of birth and address of the current principal or sole residence,
2. the type of service,
3. the data retrieved,
4. the time of retrieval.
(5) The logging data are to be retained and secured for at least 12 months. They are to be deleted no later than the end of the calendar year following the year in which they were recorded. The logging data may be processed only for the purposes of data protection monitoring, any resulting criminal proceedings and for the purposes of safeguarding the operation of the register and providing information to the data subject.