Disclosure of subscriber data

(1) To perform its statutory task under section 3(1), first sentence, nos. 1, 2, 20, 24 or 25, the BSI may require disclosure, from whoever commercially provides or participates in providing telecommunications services, of subscriber data within the meaning of section 3, no. 6 of the Telecommunications Act and of data collected under section 172 of the Telecommunications Act (section 174(1), first sentence of the Telecommunications Act). Disclosure under the first sentence may be required only to protect the supply of the population in the sectors under section 2, no. 24, or public security, in order thereby to avert an impairment of the security or functionality of information technology systems of an essential entity or important entity, where facts permit the conclusion that an event has occurred, at least specific as to its type and foreseeable in time, that will be directed at the information technology systems of determinable infrastructures or undertakings, and where the data to be included in the disclosure is necessary in the individual case to warn the persons concerned under subsection (4) of that impairment, to inform them of it, or to advise or support them in eliminating it.
(2) Disclosure under subsection (1) may also be required by reference to an internet protocol address assigned at a particular time (section 174(1), third sentence, section 177(1), no. 3 of the Telecommunications Act). The legal and factual bases of the request for disclosure must be recorded in the files.
(3) The person obliged on the basis of a request for disclosure must transmit the data necessary for the disclosure without delay and in full.
(4) After disclosure has been made, the BSI advises the essential entity or important entity of the impairments threatening it. As far as possible, the BSI advises the essential entity or important entity of technical means by which the impairments found can be eliminated by the essential entity or important entity itself.
(5) The BSI may transmit personal data that it processes within the framework of this provision in accordance with section 8(6) and (7).
(6) In the cases of subsection (2), the data subject must be notified of the disclosure. In the case of the passing on of the information under section 8(6), or where facts justify the assumption that the conditions for a passing on under section 8(6) exist, no notification of the data subject is given, insofar as and for so long as predominant interests of third parties worthy of protection preclude it. Where notification is deferred or dispensed with under the second sentence, the reasons must be recorded in the files.
(7) The BSI informs the Federal Commissioner for Data Protection and Freedom of Information, each by 30 June of the year following the reporting year, of 1. the total number of cases in which data under subsection (1) or subsection (2) was transmitted to the BSI, and 2. the transmissions under subsection (5).
(8) The BSI must grant compensation to the persons obliged for disclosures given to it. The amount of the compensation is assessed under section 23 and Annex 3 of the Judicial Remuneration and Compensation Act; the provisions on limitation in section 2(1) and (4) of the Judicial Remuneration and Compensation Act apply accordingly.