Logging

(1) The party obligated under section 175(1) must ensure that, for purposes of data protection oversight, every access, in particular reading, copying, altering, deleting, and blocking, of the data stored under the storage obligation of section 176(1) is logged. The following are to be logged:
1. the time of access,
2. the persons accessing the data,
3. the purpose and nature of the access.
(2) The log data may not be used for purposes other than data protection oversight.
(3) The party obligated under section 175(1) must ensure that the log data are deleted after one year.