Establishment of automated retrieval procedures

(1) The establishment of an automated procedure enabling the transmission of social data by retrieval is permissible between the bodies named in section 35 of the First Book, and with German Statutory Pension Insurance Bund as the central body for performing its functions under section 91(1), first sentence of the Income Tax Act, and German Statutory Pension Insurance Knappschaft-Bahn-See, insofar as it carries out functions under the Income Tax Act for marginally employed persons, insofar as this procedure is appropriate, having regard to the interests of the persons concerned worthy of protection, because of the multiplicity of transmissions or their particular urgency, and where the respective legal or specialist supervisory authorities have authorised the participation of the bodies subject to their supervision. The same applies as against the bodies named in section 69(2) and (3).
(1a) The establishment of an automated retrieval procedure for a filing system of the social insurance for agriculture, forestry and horticulture is permissible only as against the providers of statutory pension insurance, German Statutory Pension Insurance Bund as the central body for performing its functions under section 91(1), first sentence of the Income Tax Act, the health insurance funds, the Federal Employment Agency, and Deutsche Post AG, insofar as it is entrusted with the calculation or payment of social benefits; intermediary bodies may also be used for this.
(2) The participating bodies must ensure that the permissibility of the retrieval procedure can be checked. For this purpose they must lay down in writing or electronically: 1. the occasion and purpose of the retrieval procedure; 2. the third parties to whom transmission is made; 3. the nature of the data to be transmitted; 4. the technical and organisational measures required under Article 32 of Regulation (EU) 2016/679.
(3) The establishment of retrieval procedures must, in cases in which the bodies named in section 35 of the First Book that are subject to the control of the Federal Commissioner for Data Protection and Freedom of Information (Federal Commissioner) are involved, be notified to that Commissioner in good time beforehand, stating the determinations under subsection (2), and otherwise to the body competent under Land law for data-protection control.
(4) Responsibility for the permissibility of the individual retrieval is borne by the third party to whom transmission is made. The storing body examines the permissibility of retrievals only where there is occasion for this. It must log, in at least every tenth retrieval, the point in time, the data retrieved, and particulars for ascertaining the procedure and the person responsible for the retrieval; the logged data must be erased at the latest after six months. Where an entire holding of social data is retrieved or transmitted (batch processing), the guarantee of ascertainment and review relates only to the permissibility of the retrieval or the transmission of the entire holding.
(5) Subsections (1) to (4) do not apply to retrieval from filing systems that are set up with the consent of the persons concerned and that are open to use by anyone, whether without or after special admission.