Processing of Personal Data by Supervisory Authorities

(1) The supervisory authorities competent under this Act are authorised to process personal data, insofar as this is necessary for the performance of their statutory tasks.
(2) Where the supervisory authorities competent under this Act process personal data in the course of a supervisory measure under this Act or on the basis of the statutory instruments issued under this Act, the data subjects do not have the rights under Articles 15 to 18 and 20 to 22 of Regulation (EU) 2016/679, insofar as the fulfilment of the data subjects' rights would jeopardise: 1. the purpose of the measure, 2. the stability of the financial markets of the Federal Republic of Germany or of one or more Member States of the European Economic Area, 3. some other important objective of general public interest of the Federal Republic of Germany or of one or more Member States of the European Economic Area, in particular an important economic or financial interest, or 4. the prevention, investigation, detection or prosecution of criminal offences or the enforcement of criminal penalties, including protection against and the prevention of threats to public security. Under these conditions the competent supervisory authority is also exempt from the obligations under Articles 12 to 14, 19 and 34, and from the transparency obligations under Article 5, of Regulation (EU) 2016/679. The first and second sentences apply correspondingly to persons and bodies which the competent supervisory authority engages in the performance of its tasks, and to the body operating the register.
(3) The data subject shall be informed of the lapse of the restriction, unless this would be detrimental to the purpose of the restriction.
(4) Where, in the cases under subsection (2), first to third sentences, no information is given to the data subject, information shall, at the data subject's request, be given, depending on competence, to the Federal Commissioner for Data Protection and Freedom of Information or to the authority competent for data protection under Land law, unless it is established in the individual case that this would jeopardise the public security of the Federation or of a Land, or the stability and integrity of the financial markets. The communication by the Federal Commissioner for Data Protection and Freedom of Information, or by the authority competent for data protection under Land law, to the data subject on the outcome of the data-protection review, may not permit any inference to be drawn as to the state of knowledge of the competent supervisory authority, and of the persons and bodies which the competent supervisory authority engages in the performance of its tasks, unless the latter consents to more extensive disclosure.