Duties to inform on the collection of social data from the person concerned

(1) The duty to inform the person concerned under Article 13(1), letter e) of Regulation (EU) 2016/679, on categories of recipients, exists, in addition to the exception named in Article 13(4) of Regulation (EU) 2016/679, only insofar as 1. the person concerned need not, by the circumstances of the individual case, expect the use or the transmission of social data to those categories of recipients; 2. it does not concern the storage, alteration, use, transmission, restriction of processing or erasure of social data within a body named in section 35 of the First Book, or within an organisational unit within the meaning of section 67(4), second sentence; or 3. it does not concern a category of bodies named in section 35 of the First Book, or of organisational units within the meaning of section 67(4), second sentence, that are obliged to close cooperation by statute.
(2) The duty to inform the person concerned under Article 13(3) of Regulation (EU) 2016/679, in addition to the exception named in Article 13(4) of Regulation (EU) 2016/679, does not exist where giving the information on the intended further processing would 1. endanger the proper performance of the functions falling within the competence of the controller within the meaning of Article 23(1), letters a) to e) of Regulation (EU) 2016/679, and the interests of the controller in not giving the information predominate over the interests of the person concerned; 2. endanger public security or order, or otherwise cause disadvantage to the welfare of the Federation or of a Land, and the interests of the controller in not giving the information predominate over the interests of the person concerned; or 3. endanger a confidential transmission of data to public bodies.
(3) Where information is not given to the person concerned under subsection (2), the controller takes appropriate measures to protect the legitimate interests of the person concerned, including making available to the public the information named in Article 13(1) and (2) of Regulation (EU) 2016/679, in a precise, transparent, intelligible and easily accessible form, in clear and plain language. The controller records in writing the reasons for which it refrained from giving information. The first and second sentences do not apply in the cases of subsection (2), no. 3.
(4) Where notice is not given in the cases of subsection (2) because of a temporary obstacle, the controller complies with the duty to inform, having regard to the specific circumstances of the processing, within a reasonable period after the obstacle ceases, but at the latest within two weeks.
(5) Where the giving of information relates to the transmission of social data by public bodies to the public prosecution offices and courts in the field of criminal prosecution, to police authorities, the authorities for the protection of the constitution, the Federal Intelligence Service and the Military Counter-Intelligence Service, it is permissible only with the consent of that body.