Automated information procedure

(1) A person providing number-based interpersonal telecommunications services, or services consisting wholly or predominantly of the conveyance of signals, and, in doing so, assigning telephone numbers, must store the data collected under section 172(1), (2), and (4) without delay in customer files, in which telephone numbers and blocks of telephone numbers assigned to other providers of telecommunications services for further marketing or other use are also to be recorded, as well as, for ported telephone numbers, the current porting identifier. The obligated party may also engage another body, in accordance with Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1; L 314, 22.11.2016, p. 72; L 127, 23.5.2018, p. 2), to maintain the customer files. Section 172(4) and (6) apply correspondingly to correcting and deleting the data stored in the customer files. In cases of ported telephone numbers, the telephone number and the associated porting identifier are not to be deleted until the end of the year following the point in time at which the telephone number was returned to the network operator to which it was originally assigned.
(2) The obligated party must ensure that 1. the Federal Network Agency can retrieve data from the customer files at any time, by automated means, within Germany, and 2. data can be retrieved using incomplete query data, or a search can be conducted by means of a similarity search function. The obligated party and its agent must ensure, by technical and organisational measures, that the retrieved data cannot come to their knowledge.
(3) The Federal Network Agency may retrieve data from the customer files only insofar as knowledge of the data is necessary 1. for the prosecution of regulatory offences or infringements under this Act or under the Act Against Unfair Competition, or 2. for handling information requests by the bodies named in subsection (4). The requesting body examines, without delay, the extent to which it needs the data transmitted in response; it deletes data not needed without delay; this also applies to the Federal Network Agency for retrieval of data under the first sentence, point 1.
(4) Information from the customer files under subsection (1) is provided to the following bodies under subsection (7) at any time, insofar as the information is necessary for performing their statutory functions and the requests are submitted to the Federal Network Agency in the automated information procedure: 1. the courts and prosecuting authorities, 2. the police enforcement authorities of the Federation and the Länder, for purposes of hazard prevention, 3. the Customs Criminal Investigation Office and the customs investigation offices, for purposes of criminal proceedings, and the Customs Criminal Investigation Office for preparing and carrying out measures under section 72 of the Customs Investigation Service Act, 4. the authorities for the protection of the constitution of the Federation and the Länder, the Federal Office of Military Counter-Intelligence, the Federal Intelligence Service, 5. the emergency call answering points under section 164, and the answering point for the telephone number 124 124, 6. the Federal Financial Supervisory Authority, 7. the customs administration authorities, for the purposes named in section 2(1) of the Act to Combat Illicit Employment, via central inquiry points, 8. the authorities competent under Land law for prosecuting and penalising regulatory offences, for the purposes named in section 2(3) of the Act to Combat Illicit Employment, via central inquiry points, and 9. the competition authorities competent for prosecuting and penalising regulatory offences under section 81(1) to (3) of the Competition Act.
(5) The Federal Ministry for Digital Affairs and State Modernisation is empowered, in agreement with the Federal Chancellery, the Federal Ministry of the Interior, the Federal Ministry of Justice and Consumer Protection, the Federal Ministry of Finance, and the Federal Ministry of Defence, to issue a statutory instrument, with the consent of the Bundesrat, regulating: 1. the essential requirements for the technical procedures a) for transmitting the requests to the Federal Network Agency, b) for the Federal Network Agency's querying of the data from the obligated parties and their response to the Federal Network Agency, including the types of data to be used for the query, and c) for transmitting the results of the retrieval from the Federal Network Agency to the requesting bodies, 2. the security requirements to be observed, 3. for information and retrievals with incomplete query data and for searches by means of a similarity search function, a) the minimum requirements for the scope of the data to be entered, to determine the sought person as precisely as possible, b) the characters that may be used in requests, c) requirements for the use of linguistic procedures that ensure that different spellings of a person's, street's, or place's name, and deviations arising from the transposition, omission, or addition of name components, are included in the search and the search result, d) the permissible volume of response data sets to be transmitted to the Federal Network Agency, and 4. who, by way of derogation from subsection (1), first sentence, need not maintain customer files for the automated information procedure, for reasons of proportionality; in these cases, section 172(1), fourth sentence, applies correspondingly. In addition, the statutory instrument may also regulate restrictions on the querying capability for the bodies named in subsection (4), points 5 to 9, to the extent necessary for those bodies.
(6) The Federal Network Agency lays down the technical details of the automated information procedure, with the participation of the associations concerned and the entitled bodies, in a Technical Guideline, which is to be adapted to the state of the art as needed. The parties obligated under subsections (1) and (2), and the entitled bodies, must satisfy the requirements of the Technical Guideline no later than one year after its entry into force, unless a different implementation period has been set in the Technical Guideline. Technical facilities designed in accordance with this Guideline and free of defects must, in the event of an amendment of the Technical Guideline, satisfy the amended requirements no later than three years after its entry into force.
(7) On request by the bodies named in subsection (4), the Federal Network Agency must retrieve the corresponding data sets from the customer files under subsection (1) and transmit them as a result to the requesting body. It examines the permissibility of the transmission only insofar as there is particular cause to do so. Responsibility for the permissibility of the transmission lies with 1. the Federal Network Agency, in the cases under subsection (3), first sentence, point 1, and 2. the bodies named in subsection (4), in the cases under subsection (3), first sentence, point 2.
(8) The Federal Network Agency logs, for purposes of data protection oversight by the respective competent body, for each retrieval: 1. the time, 2. the data used in carrying out the retrieval, 3. the data retrieved, 4. a datum uniquely identifying the retrieving person, and 5. the requesting body, its file reference, and a datum uniquely identifying the requesting person. Use of the log data for other purposes is not permitted. The log data are to be deleted after one year.
(9) The obligated party under subsections (1) and (2) must take, at its own expense, all technical precautions within its area of responsibility necessary for providing the information under this provision. This also includes the acquisition of the devices necessary to ensure confidentiality and protection against unauthorised access, the setting up of a suitable telecommunications connection, and the ongoing provision of these precautions in accordance with the statutory instrument under subsection (5) and the Technical Guideline under subsection (6). No compensation is granted to the obligated parties for information provided in the automated information procedure.