Data protection

(1) Without prejudice to other legal bases, trust service providers may process personal data, including data held by third parties, insofar as this is necessary for the provision — including the examination and assurance of the legal validity — of the respective trust service.
(2) The trust service provider may transmit personal data of a person using trust services to the competent bodies, 1. insofar as the competent bodies require the transmission in accordance with the provisions applicable to them, because the transmission is necessary a) for the prosecution of criminal offences or regulatory offences, b) to avert dangers to public security or order, or c) for the performance of the statutory tasks of the constitutional protection authorities of the Federation and the Länder, the Federal Intelligence Service, the Military Counter-Intelligence Service, or the tax authorities, or 2. insofar as courts order the transmission in the course of pending proceedings in accordance with the provisions applicable to them. The authorisation to transmit data under sentence 1 number 1 does not apply insofar as it is expressly excluded by other statutes.
(3) Trust service providers must document the transmission. The documentation must be retained for twelve months.
(4) Where the competent body has made a request for data transmission under subsection (2) number 1, it shall inform the data subject that the transmission has taken place. Such information may be withheld for as long as it would jeopardise the performance of the statutory tasks and for as long as the data subject's interest in being informed does not outweigh this. Five years after the transmission, notification may be permanently omitted where it is virtually certain that the conditions for notification will also not arise in the future.
(5) The general data-protection requirements remain unaffected.