Disclosure procedure for passwords and other access data

(1) By way of derogation from section 22, a person who provides digital services on a commercial basis, participates in providing them, or mediates access to their use, may use passwords or other data collected as subscriber data, by means of which access to terminal equipment or to storage facilities used within such terminal equipment or separately from it is protected, in accordance with this provision to fulfil duties of disclosure towards the bodies named in paragraph 2. All data sources internal to the undertaking must be taken into account for the disclosure.
(2) The information under paragraph 1, first sentence may be disclosed only to 1. authorities responsible for the prosecution of criminal offences, insofar as they demand the transmission in the individual case, stating a statutory provision that permits them to collect and use the data named in paragraph 1 for the prosecution of particularly serious criminal offences under section 100b(2) no. 1(a), (c), (e), (f), (g), (h) or (m), no. 3(b) first alternative, no. 5, 6, 9 or 10 of the Code of Criminal Procedure, following an order by a court, or 2. authorities responsible for averting dangers to public security or order, insofar as they demand the transmission in the individual case, stating a statutory provision that permits them to collect and use the data named in paragraph 1 to avert a concrete danger to life, limb or personal liberty, to sexual self-determination, to the existence of the Federation or of a Land, to the free democratic basic order, or to interests of the general public whose endangerment affects the foundations of human existence, following an order by a court. Data under paragraph 1 may not be transmitted to other public or non-public bodies. Responsibility for the permissibility of the disclosure lies with the bodies requesting the information.
(3) A person who provides digital services on a commercial basis, participates in providing them, or mediates access to their use, must transmit the data to be disclosed without delay and in full. Any encryption of the data remains unaffected. Persons under the duty must maintain silence towards the persons concerned and towards third parties regarding the request for information and the disclosure of information.
(4) A person who provides digital services on a commercial basis, or participates in providing them, must, at their own expense, take the precautions necessary within their area of responsibility for providing information. Every request for information must be examined by a responsible specialist for compliance with the formal requirements named in paragraph 2. Further processing of the request for information may be released only after a positive result of that examination.