Duty to inform when collecting personal data

(1) The duty to inform under Articles 13 and 14 of Regulation (EU) 2016/679 does not exist, in addition to the exceptions named in Article 13(4) and Article 14(5) of Regulation (EU) 2016/679, where 1. giving the information would endanger the proper performance of the tasks within the BSI's competence, or 2. giving the information would otherwise endanger public security or order or the safeguarding of network and information security, or would otherwise cause disadvantages to the welfare of the Federation or of a Land, and the data subject's interest in being given the information must therefore give way.
(2) Where information is not given to the data subject under subsection (1), the BSI takes suitable measures to protect the data subject's legitimate interests, including providing the public with the information named in Article 13(1) and (2) and Article 14(1) and (2) of Regulation (EU) 2016/679 in a precise, transparent, comprehensible and easily accessible form, in clear and plain language. The BSI records in writing the reasons for which it dispensed with informing the data subject.