Right of access of the persons concerned

(1) The right of access of the person concerned under Article 15 of Regulation (EU) 2016/679 does not exist insofar as 1. the person concerned is not to be informed under section 82a(1), (4) and (5); or 2. the social data a) are stored only because they may not be erased under statutory or constitutional retention provisions; or b) serve exclusively purposes of data security or of data-protection control, and giving access would require disproportionate effort, and processing for other purposes is excluded by appropriate technical and organisational measures.
(2) The person concerned should, in the application for access under Article 15 of Regulation (EU) 2016/679, describe in more detail the nature of the social data on which access is to be given. Where the social data are not stored in automated fashion, or not in non-automated filing systems, access is given only insofar as the person concerned makes particulars enabling the data to be found, and the effort required to give access is not disproportionate to the interest in information asserted by the person concerned. Insofar as Articles 15 and 12(3) of Regulation (EU) 2016/679 contain no rules, the controller determines the procedure, in particular the form of giving access, in the exercise of due discretion. Section 25(2) applies correspondingly.
(3) The reasons for refusing access must be documented. Refusal of access requires no statement of reasons insofar as the purpose pursued by the refusal of access would be endangered by communicating the factual and legal reasons on which the decision is based. In that case the person concerned must be informed that he or she may approach the Federal Commissioner, where the bodies named in section 35 of the First Book are subject to the control of the Federal Commissioner, and otherwise the body competent under Land law for data-protection control.
(4) Where a person concerned is not given access, the Federal Commissioner, insofar as bodies named in section 35 of the First Book subject to the control of the Federal Commissioner are concerned, and otherwise the body competent under Land law for data-protection control, may, on the demand of the person concerned, examine whether the refusal of access was lawful.
(5) Where the giving of information relates to the transmission of social data by public bodies to public prosecution offices and courts in the field of criminal prosecution, to police authorities, the authorities for the protection of the constitution, the Federal Intelligence Service and the Military Counter-Intelligence Service, it is permissible only with the consent of those bodies.