关键词不能为空

当前您在: 主页 > 英语 >

《德国联邦数据保护法》2015最新修订版-BDSG2015

作者:高考题库网
来源:https://www.bjmy2z.cn/gaokao
2021-02-08 09:29
tags:

-

2021年2月8日发(作者:landway)


Federal Data Protection Act (Act)



Unofficial Contents


BDSG



Date of issue: 20.12.1990



Full Quote:




Law Gazette I, p. 66), last amended by Article 1 of the Law of 25 February 2015


(Federal Law Gazette I, p. 162) has been changed



Was standing:




For details on the status information you can find in the menu under Notices


footnote



(+++ Text detection from: 1.6.1991 +++)




The G was 20.12.1990 I decided in 2954 as Article 1 of G v by the Bundestag with


the consent of the Bundesrat..; § 10 para. 4 sentence 3 and 4, according to the first


day of the twenty-fourth calendar month following promulgation in the rest of the first


day of the sixth calendar month following promulgation. Art. 6 para. 2 sentence 1 u. 2


G v. 20.12.1990 I 2954 came into force. The G was announced on 29.12.1990.


Unofficial Contents


Site



first section



§ 1



General and common provisions


Purpose and Scope of the Law


Revised by Bek v 14.1.2003 I. 66th.


Last amended by Art. 1 G v. 02.25.2015 I 162


§ 2



§ 3



§ 4



Public and non-public bodies


Other definitions


Admissibility of data collection, processing and use


§ 3a



Data reduction and data economy


§ 4a



consent


§ 4b



Transfer of personal data abroad and to supranational and intergovernmental


bodies


§ 4c



Exceptions


§ 4d



Reporting obligation


§ 4e



Content of the reporting obligation


§ 4f



§ 5



§ 6



Commissioner for Data Protection


Data secrecy


Rights of the person concerned


§ 4g



Tasks of the Commissioner for Data Protection


§ 6a



Automated individual decisions


§ 6b



Observation of publicly accessible areas with optic-electronic devices


§ 6c



Mobile personal storage and processing media


§ 7



§


9


Damages


Technical and organizational measures


§ 8th



Compensation in the case of automated data processing by public bodies


§ 9a



Privacy Audit


§ 10



Establishment of automated retrieval procedures


§ 11



Collection, processing or use of personal data on behalf


Second Section





Data processing by public bodies




First subsection



Legal basis of the data processing


§ 12



scope of application


§ 13



Data collection


§ 14



Data storage, and use -change


§ 15



Transfer of data to public bodies


§ 16



Transmission of data to private parties


§ 17



(repealed)


§ 18



Implementation of data protection in the Federal Administration






Second subsection



Rights of the person concerned


§ 19



Information to the person concerned


§ 19a



Notification


§ 20



Rectification, erasure and blocking of data; Right of appeal


§ 21



Appeal to the Federal Commissioner for Data Protection and Freedom of


Information






Third subsection



Federal Commissioner for Data Protection and Freedom of


Information


§ 22



Election of the Federal Commissioner for Data Protection and Freedom of


Information


§ 23



Legal status of the Federal Commissioner for Data Protection and Freedom of


Information


§ 24



Monitoring by the Federal Commissioner for Data Protection and Freedom of


Information


§ 25



Complaints by the Federal Commissioner for Data Protection and Freedom of


Information


§ 26



Further duties of the Federal Commissioner for Data Protection and Freedom


of Information


Third Section





Data processing non-public bodies and public service competitive companies




First subsection



Legal basis of the data processing


§ 27



scope of application


§ 28



Data collection and storage for its own business purposes


§ 28a



Transfer of data to credit bureaus


§ 28b



Scoring


§ 29



Commercial data collection and storage for the sending


§ 30



Commercial data collection and storage for the sending anonymous


§


30a


Commercial data collection and storage for the purpose of market or opinion


research


§ 31



Special earmarking


§ 32



Data collection, processing and use for purposes of employment






Second subsection



Rights of the person concerned


§ 33



Notification of the person concerned


§ 34



Information to the person concerned


§ 35



Rectification, erasure and blocking of data






Third subsection



Authority


§§ 36 and 37


(repealed)


§ 38



Authority


§ 38a



Code of conduct to promote the implementation of data protection provisions


Section Four



Special provisions


§ 39



Limited use of personal data subject to professional or special official secrecy


§ 40



Processing and use of personal data by research institutes


§ 41



Collection, processing and use of personal data by the media


§ 42



Data Protection Officer of Deutsche Welle


§ 42a



Disclosure in case of unlawful obtaining knowledge of data


Section Five



Final Provisions


§ 43



Fines


§ 44



Criminal provisions


Section Six



Transitional provisions


§ 45



Current uses


§ 46



Continued validity of definitions


§ 47



Transitional arrangements


§ 48



Federal Government Report


Conditioning (§ 9 sentence 1)



Section One


General and common provisions



Unofficial Contents


§ 1 Purpose and Scope of the Law




(1) The purpose of this Act is to protect individuals from that he is affected by the


handling of their personal data in his personal rights.


(2) This Act applies to the collection, processing and use of personal data by


1.


public bodies of the Federation,


. 2


public authorities of the countries to the extent the Notice is not governed by state


law and provided that they


a)


Execute federal law or


b)


as organs of justice act and it does not concern administrative matters,


. 3


private parties, so far as they process the data using data processing systems, use


or collect it or process, use or collect it, unless the collection, processing or use of


the data are only for the data to or from non-automated files personal or family


activities.


(3) As far as other legislation of the Federal apply to personal data including their


publication, they take precedence over the provisions of this Act. The obligation to


respect the legal confidentiality obligations or of professional or special official


confidentiality not based on legal regulations remains unaffected.


(4) The provisions of this Act take precedence over those of the Administrative


Procedure Act, in so far as in determining the facts personal data are processed.


(5) This Act shall not apply unless a charge in another Member State of the


European Union or in another signatory to the Agreement on the European


Economic Area establishment situated site collects personal data in Germany,


processes or uses, unless this is done by a establishment domestically. This Act


shall apply unless a responsible entity that is not situated in a Member State of the


European Union or in another signatory to the Agreement on the European


Economic Area, collects personal data in Germany, processes or uses. Insofar as


the responsible entity under this Act is to be mentioned, also provide information on


domestic-based representatives are to make. Sentences 2 and 3 do not apply if


disks are used only for the purpose of transit through the country. § 38 para. 1


sentence 1 remains unaffected.


Unofficial Contents


§ 2 Public


and private parties



(1) Public bodies of the Federation are the authorities, the administration of justice


and other public-law institutions of the Federation, the federal corporations,


institutions and foundations under public law as well as their associations


irrespective of their legal form. As public bodies that emerged from the special fund


German Federal Post Office by law companies apply as long as they have an


exclusive right under the Postal Act.


(2) Public authorities of the country, the authorities, the administration of justice and


other public law institutions of a Land, a municipality, an association of municipalities


and other supervision of the country under standing of legal entities of public law as


well as their associations irrespective of their legal form.


(3) private-law associations of public authorities of the federal and state governments,


carry out the tasks of public administration, apply notwithstanding the participation of


non-public entities as public bodies of the Federation, if


1.


they operate over the range of a country or addition


. 2


the federal government is one of the absolute majority of the shares or the absolute


majority of the votes entitled to.


Otherwise, they are considered public bodies of the countries.


(4) Non-public bodies, natural and legal persons, companies and other associations


of persons of private law as they do not fall under paragraphs 1 to. 3 Takes a private


body performs sovereign public administration duties, it is the extent of public


authority within the meaning of this Act.


Unofficial Contents


§ 3 Other definitions




(1) Personal data is specific information about personal or factual circumstances of


an identified or identifiable natural person (data subject).


(2) Automated processing is the collection, processing or use of personal data using


data processing equipment. A non- automated file is not any automated collection of


personal data which is similarly structured and which by its characteristics is


available and can be evaluated.


(3) data collection is the acquisition of data on the person concerned.


(4) processing, the storage, modification, transfer, blocking and deletion of personal


data. Specifically, regardless of the procedures applied:


1.


Save capturing, recording or preservation of personal data on a disk for the purpose


of their further processing or use,


. 2


Changing the content Remodel stored personal data,


. 3


Submitting the announce stored or obtained by data processing of personal data to a


third party in such a way that


a)


the data is passed to the third party or


b)


the third parties for inspection or held ready for retrieval data, or retrieves,


. 4


Lock to restrict the marking of stored personal data of their further processing or use,


. 5


Delete the deletion of stored personal data.


(5) Make each use of personal data to the extent it does not concern processing.


(6) make anonymous the change of personal data is such that the details of personal


or material circumstances can no longer or only be associated with a


disproportionate investment of time, cost and labor of an identified or identifiable


natural person.


(6a) Pseudonymisation is to replace the name and other identification features of an


indicator for the purpose preclude the determination of the person concerned or


substantially more difficult.


(7) Responsible party is any person or body, collects personally identifiable


information for yourself, processes or uses or this can make other commissioned.


(8) receiver is a person or body to whom data. Third is any person or body other than


the controller. Third parties are not the person or persons or bodies that collect,


process or use within the country, in another Member State of the European Union


or in another signatory to the Agreement on the European Economic Area personal


data on behalf.


(9) Special types of personal data are data concerning racial or ethnic origin, political


opinions, religious or philosophical beliefs, trade union membership, health or sex life.


(10) Mobile personal storage and processing media are media,


1.


which are issued to the person concerned,


. 2


on which personal data about the storage addition can be processed automatically


by the issuing body or another body,


. 3


where the person concerned, this processing can influence only through the use of


the medium.


(11) employees are:


1.


Workers,


. 2


to their VET employees,


. 3


Participants at services for participation in working life as well as clarifications of


professional qualification or testing work (in need of rehabilitation and rehabilitation)


. 4


in recognized workshops for the disabled employees,


. 5


after the Youth Volunteer Service Act employees,


. 6


Persons who are to be regarded as workers like people because of their economic


dependence; These include the cottage industry workers and assimilated,


. 7


Applicants for an employment relationship and persons whose employment


relationship has ended,


8th.


Officials, civil servants, judges of the Federal, soldiers and civilian service.


Unofficial Contents


§ 3a Data reduction and data economy




The collection, processing and use of personal data and the selection and design of


data processing systems shall be benchmarked against the goal, so to raise little


personal data as possible to process or use. In particular, personal data must be


anonymized or pseudonymized, to the extent possible on the intended use and does


not require disproportionate in relation to the desired level of protection effort.


Unofficial Contents


§ 4 Admissibility of data collection, processing and use




(1) The collection, processing and use of personal data is permitted only if this law or


another law permits or orders or the individual has consented.


(2) Personal data shall be collected from the person concerned. Without his


involvement, they may only be collected when


1.


a legal provision prescribes or peremptorily presupposes or


. 2


a)


the administrative task to be fulfilled by their nature or the business purpose requires


a survey of other persons or entities, or


b)


bringing the person concerned would involve a disproportionate effort


and there are no indications that overriding legitimate interests of the person


concerned will be affected.


(3) If personal data are collected from the data subject, so he is, unless he has


already attained otherwise learned, over by the party responsible


1.


the identity of the responsible body,


. 2


the purpose of the collection, processing or use, and


. 3


the categories of beneficiaries only if the data subject does not have the expected


submission of these to the circumstances of the individual case,


to teach. If personal data are collected from the party concerned, whether by law, the


obligation to provide information, or is providing the information requirements for the


granting of legal benefits, then it is the person, otherwise draw attention to the


voluntary nature of his allegations. Unless the circumstances of the case required or


upon request, he must be informed of the law and the consequences of denial of


information.


Unofficial Contents


§ 4a consent




(1) The consent is effective only if it is based on the free decision of the person


concerned. He is, so far as to indicate the intended purpose of the collection,


processing or use, as well as to the circumstances of the case required or upon


request, to the consequences of withholding consent. The consent must be in writing,


unless a different form is appropriate due to special circumstances. If consent is in


writing, together with other statements, it is particularly noteworthy.


(2) In the area of scientific research, a special circumstance within the meaning of


paragraph 1, sentence 3 is present even if the specific research purpose would be


significantly affected by the writing. In this case the information pursuant to


paragraph 1 sentence 2 and the reasons giving rise to substantial impairment of the


defined purpose of research should be documented.


(3) As far as special categories of personal data (§ 3 para. 9) is collected, processed


or used, the consent must also explicitly refer to this data.


Unofficial Contents


§ 4b Transfer of perso


nal data abroad and to supranational or intergovernmental


bodies



(1) For the transfer of personal data to bodies


1.


in other Member States of the European Union,


. 2


other parties to the Agreement on the European Economic Area or


. 3


the institutions and bodies of the European Communities


apply § 15 para. 1, § 16 para. 1 and §§ 28 to 30a in accordance with the rules


applicable to such transmission laws and agreements, as far as the transmission in


the context of activities carried out, in whole or in part within the scope of the law of


the European Communities fall.


Paragraph 1 in accordance with (2) applies to the transfer of personal data to bodies


referred to in paragraph 1 that are not made in the context of activities which fall


wholly or partly within the scope of the law of the European Communities, as well as


to other foreign or supranational or government entities , The transmission shall, if


the data subject has a legitimate interest in excluding such transmission, particularly


when the assessments mentioned in sentence 1 Set an adequate level of data


protection is not guaranteed. Sentence 2 shall not apply if the transmission for its


own account by a public authority of the federal exceeded for compelling reasons of


defense or the performance or intergovernmental commitments in the field of crisis


management or conflict prevention or for humanitarian action is required.


(3) The adequacy is assessed taking into account all the circumstances that are at a


data transfer operation or set of data transfer is important; in particular, the nature of


the data, the purpose, the duration of the intended processing, the country of origin


and country of final destination, the rules applicable to the beneficiary in question as


well as the legal standards applicable to him professional rules and security


measures are used.


(4) In the cases of § 16 para. 1 no. 2 the supplying body shall inform the person of


the transmission of his data. This does not apply if it can be expected that he


becomes aware of it in some other way, or if the disclosure would jeopardize public


safety or otherwise be detrimental to the Federation or a Land.


(5) Responsibility for the permissibility of the transmission transmits the forwarding


authority.


(6) The body to which the data is transmitted is to draw attention to the purpose of


the fulfillment of the data are disclosed.


Unofficial Contents


§ 4c Exceptions




(1) Within the scope of activities which fall wholly or partly within the scope of the law


of the European Communities, is a transfer of personal data to authorities other than


in § 4b, para. 1 points referred to, even if you have an adequate level of data


protection is not ensured allowed provided


1.


the data subject has given his consent,


. 2


the transfer is necessary for the performance of a contract between the data subject


and the data controller or the implementation of pre-contractual measures which


have been taken at the instigation of the person concerned, is necessary,


. 3


the transmission for the conclusion or performance of a contract is needed, which


was in the interests of the person concerned entered into by the responsible entity


with a third party or is to be closed,


. 4


the transfer is necessary for the protection of an important public interest or for the


establishment, exercise or defense of legal claims in court is required,


. 5


the transmission for safeguarding the vital interests of the person concerned is


required or


. 6


the transmission of a register which is intended to inform the public and the public in


general or all either persons who can prove a legitimate interest for inspection is


open to the extent that the legal requirements are fulfilled in the particular case.


The body to which the data is transmitted is to point out that the transmitted data


may be processed or used only for the purpose for which they are received.


(2) Notwithstanding paragraph 1, sentence 1, the competent authority shall approve


individual transfers or certain types of transfers of personal data to other than those


in § 4b, para. 1 m


entioned points, if the controller sufficient guarantees concerning


the protection of personal rights and the exercise the associated rights adduced;


such safeguards may in particular result from contractual clauses or binding


corporate rules. The postal and telecommunications companies, the Federal


Commissioner is responsible for Data Protection and Freedom of Information. If the


transmission is to be carried out by public bodies, this will evaluate according to


sentence 1.


(3) notify to the covenant with the countries taken pursuant to paragraph 2 sentence


1 decisions.


Unofficial Contents


§ 4d reporting requirement




(1) automated data processing must be reported 4e of non-public bodies responsible


of the competent authority and of public responsible bodies of the Federation and


from the postal and telecommunications companies to the Federal Commissioner for


Data Protection and Freedom of Information in accordance with § prior to their


commissioning.


(2) The reporting requirement does not apply if the responsible party has appointed a


data protection officer.


(3) The reporting requirement also does not apply if the responsible entity collects


personal information for their own purposes, processes or uses, this is usually not


more than nine people constantly engaged in the collection, processing or use of


personal data and either there is a consent of the person concerned or the collection,


processing or use for the establishment, implementation or termination of a legal


transaction or legal transaction similar obligation to the person concerned is required.


(4) Paragraphs 2 and 3 do not apply when it comes to automated processing, in


which business-personally identifiable information from the respective location


1.


for the purpose of transmission,


. 2


for the purpose of anonymous transmission or


. 3


for the purpose of market or opinion research


being saved.


(5) As far as automated processing operations present specific risks to the rights and


freedoms of data subjects, they are subject to audit before processing begins (prior


checking). A preliminary inspection is carried out in particular if


1.


special categories of personal data (§ 3 para. 9) to be processed or



. 2


the processing of personal data is intended to assess the personality of the person


concerned, including his abilities, his performance or his conduct,


unless that is a legal obligation or an approval of the concerned or the collection,


processing or use for the establishment, implementation or termination of a legal


transaction or legal transaction similar obligation to the person concerned is required.


(6) Responsibility for prior checking of the Commissioner for Data Protection. This


assumes the prior checking after receiving the summary in accordance with § 4g,


para. 2 sentence 1 before. He has to contact in case of doubt, the supervisor or at


the postal and telecommunications companies to the Federal Commissioner for Data


Protection and Freedom of Information.


Unofficial Contents


§ 4e Contents of the reporting obligation




Unless automated data processing are reportable are to provide the following


information:


1.


Name or business name of the responsible body,


. 2


Owners, directors, managers or other legal or appointed according to the constitution


of the company director and the persons responsible for the management of data


processing,


. 3


Address of the responsible entity,


. 4


Purpose of data collection, processing or use,


. 5


a description of the groups of people concerned and the related data or data


categories,


. 6


Recipients or categories of recipients to whom the data might be disclosed,


. 7


Standard periods for the deletion of data,


8th.


proposed transfers of data to third countries,


. 9


a general description that allows a preliminary assessment whether the measures


pursuant to § 9 are appro


priate to ensure the security of processing.


§ 4d Para. 1 and 4 apply mutatis mutandis to the amendment of the information


communicated pursuant to sentence 1 information, or for the time of recording and


the completion of the reportable activity.


Unofficial Contents


§ 4f Commissioner for Data Protection




(1) Public and private bodies, automatically process the personal data have to


appoint a data protection officer in writing. Non-public bodies are obliged for this


purpose no later than within one month after taking up their duties. The same applies


when personal data is collected in other ways, processed or used and thus generally


at least 20 people are employed. Sentences 1 and 2 do not apply to non-public


bodies that constantly usually employ a maximum of nine individuals with regard to


automatic processing of personal data. Where necessary because of the structure of


a public body, the appointment of a data protection officer for several areas is


sufficient. Unless private parties make automated processing operations subject to


prior checking, or process businesslike automated for the sending, the anonymous


submission or for the purpose of market or opinion research personal data they have


regardless of the number of employees with the automated processing of persons to


appoint a data protection officer.


(2) For data protection officer may only be appointed if they possess the necessary


expertise to perform its tasks and reliability. The extent of the required technical


qualification shall be determined in particular on the level of data processing of the


data controller and the need for protection of personal data which raises the


responsible entity or used. For data protection officer and a person can be appointed


other than the controller; control also extends to personal data that is subject to


professional or special official secrecy, especially tax secrecy under § 30 of the Tax


Code. Public authorities can order with the approval of their supervisor a staff


member from another public body for data protection officer.


(3) The Data Protection Commissioner is to submit to the head of the public or non-


public site immediately. He is not bound by instructions in the exercise of its


expertise in the field of data protection. He must not be discriminated against


because of the performance of its duties. The appointment to the Data Protection


Commissioner may also, at the request of the supervisory authority, revoked in


corresponding application of § 626 of the Civil Code, for non


-public entities. Is


referred to in paragraph 1 a representative to order for data protection, the


termination of employment is not permitted, unless that facts exist which justify the


responsible body for termination for cause without notice. After its dismissal, the


Commissioner for Data Protection, the termination within one year after the


termination of the appointment is inadmissible, unless the responsible party shall be


entitled to termination for good cause without notice. To maintain the necessary


expertise to perform its tasks, the agency is to allow the Data Protection Officer to


take part in further training events and take over their costs.


(4) The Data Protection Commissioner is to maintain secrecy about the identity of


the data subject and on circumstances permitting conclusions to the person


concerned, committed, so far as it is not exempt from the interested party.


(4a) As far as the Data Protection Commissioner in his work knowledge of data


obtained for the conductor or employed by public or private body person entitled to


refuse to give evidence for professional reasons, this right is also the Commissioner


for Data Protection and its support staff to. About the exercise of this right, the


person entitled to the right to refuse to testify for professional reasons, unless that


this decision can not be brought about in the foreseeable future will decide. As far as


the evidentiary privilege Commissioner for Data Protection enough subject his files


and other documents a seizure prohibition.


(5) The public and non-public bodies have to assist the Data Protection Officer in the


performance of his duties and he, as far as this is particularly necessary to perform


its tasks to provide support staff and premises, facilities, equipment and resources.


Stakeholders may contact the data protection officer at any time.


Unofficial Contents


§ 4g duties of the Commissioner for Data Protection




(1) The Commissioner for Data Protection works to ensure that this Act and other


rules governing the way data protection. To this end, the Commissioner for Data


Protection in case of doubt, consult the authority responsible for data protection


control in the office responsible authority. He can offer advice according to § 38 para.


1 sentence 2 take to complete. He has particular


1.


to monitor the proper use of data processing programs by which personal data are to


be processed; To this end, he shall be informed in good time of projects for


automatic processing of personal data,


. 2


the persons engaged in the processing of personal data to take appropriate


measures with the provisions of this Act and other regulations on data protection and


with the specific challenges of data protection trusts.


(2) The data protection officer shall be submitted by the responsible body an


overview in § 4e Sentence 1 inform


ation referred to above, as well as persons


authorized to access available. The Data Protection Commissioner shall make the


information according to § 4e sentence 1 no. 1 to 8 at the request of anyone in an


appropriate manner available.


(2a) Insofar as a non-public body is no obligation to appoint a data protection officer


is the head of the private body shall ensure the fulfillment of the tasks set out in


paragraphs 1 and 2 in a different manner.


(3) referred to in § 6 para. 2 sentence 4 authorities finds


paragraph 2, sentence 2


shall not apply. Paragraph 1 sentence 2 shall apply with the proviso that the official


Data Protection Commissioner manufactures consultation with the head of agency;


in case of discrepancies between the official data protection officer and the head of


agency decides the supreme federal authority.


Unofficial Contents


§ 5 Data Confidentiality




The employed in data processing people is forbidden to collect personal data without


authorization, to process or to use (data secrecy). These people are, if they are


employed by non-public bodies to undertake when taking up their duties to maintain


data confidentiality. This undertaking shall continue even after termination of their


activities.


Unofficial Contents


§ 6 Rights of the person conc


erned



(1) The rights of the person concerned to receive information (§§ 19, 34) and to


rectification, erasure or blocking (§§ 20, 35) can not be excluded or limited by legal


transaction.


(2) If the data of the person concerned in the automated manner saved that several


bodies are entitled to store and the person concerned can not be determined in a


position which body has stored the data, he can turn to each of these points. This is


bound to the body that has stored the data, to pass the arguments of the person


concerned. The person concerned shall be informed of the forwarding and that place.


The in § 19 para. 3 points mentioned, the authorities of the public prosecutor and the


police and public bodies of the tax authorities, insofar as they store personal data in


fulfillment of its statutory duties within the scope of the Tax Code on the supervision


and inspection, may take the person concerned to the Federal Commissioner for


Privacy and Freedom of Information teach. In this case the further procedure 6


go


verned by § 19 para..



(3) Personal data relating to exercise of a right of the person concerned, the results


from this Act or from any other provision on data protection, may only be used to


meet the benefits arising from the exercise of the right obligations of the responsible


body.


Unofficial Contents


§ 6a Automated individual decision




(1) decisions which give rise to the person concerned a legal consequence by itself


or affect him significantly may not be based solely on automated processing of


personal data, which serve to evaluate certain personality traits. A solely on


automated processing based decision is given in particular if there is no substantive


review, it supported decision has been made by a natural person.


(2) This does not apply if


1.


the decision in the context of entering into or performance of a contract or other legal


relationship has been made and the desire of the person concerned was granted or


. 2


to protect the legitimate interests of the person concerned is ensured through


appropriate measures, the body responsible to the person concerned notifies the fact


of the existence of a decision within the meaning of paragraph 1 and at the request


notifies the main reasons of this decision and explained.


(3) The right of the person concern


ed to be informed in accordance with §§ 19 and


34 also extends to the logic involved in any automatic processing of data concerning


him.


Unofficial Contents


§ 6b Monitoring of publicly accessible areas with optic


-electronic devices



(1) The observation of publicly accessible areas with optic-electronic devices (video


surveillance) is only permissible if they


1.


the fulfillment of tasks of public authorities,


. 2


the perception of the house rules or


. 3


for safeguarding legitimate interests for specifically defined purposes


is required and there are no indications that the legitimate interests of those affected


outweigh.


(2) The fact of observation and the responsible entity are to be made recognizable


by appropriate measures.


(3) The processing or use of information collected under paragraph 1, data is


permissible if it is necessary to attain the objective pursued and there are no


indications that the legitimate interests of those affected outweigh. For another


purpose, they should only be processed or used, to the extent necessary to prevent


threats to the state and public security and the prosecution of criminal offenses.


(4) assigned by video surveillance data collected to a particular person, this must be


notified through a process or use according to §§


19a and 33rd


(5) The data must be deleted immediately when they are no longer necessary to


achieve the purpose or conflict with the legitimate interests of the person concerned


of any further storage.


Unofficial Contents


§ 6c Mobile personal storage and p


rocessing media



(1) The agency issuing a mobile person-related storage and processing medium or a


method for the automated processing of personal data that will expire in whole or in


part on such a medium, is applied to the medium, changes or this holds, should the


person concerned


1.


about their identity and address,


. 2


in general terms about the functioning of the media, including the nature of the


personal data processed,


. 3


about how he can exercise his rights in accordance with §§ 19, 20, 34 and 35,


and


. 4


on the appropriate event of loss or destruction of the medium action


inform if the data subject has not already gained knowledge.


(2) The person required under paragraph 1 point has to take care that the necessary


for the performance of the right of access equipment or facilities are to a reasonable


extent for gratuitous use.


(3) communications that trigger on the media data processing must be clearly


identifiable for the person concerned.


Unofficial Contents


§ 7 Damages




Adds a responsible entity to the person concerned by a by this Act or other data


protection provisions invalid or incorrect collection, processing or use of personal


data damage to you or your carrier is committed to the person concerned to pay


damages. The obligation to pay compensation does not apply if the responsible


authority has complied with the required by the circumstances of the case carefully.


Unofficial Contents


§ 8 Compensation for automated data processing by public bodies




(1) Adds a responsible public authority to the person concerned by this law or by


other provisions on data protection improper or incorrect automated collection,


processing or use of personal data damage to, their support to the person concerned


committed irrespective of any fault for damages ,


(2) In the case of a serious violation of your right is the victim of the damage, which


is not financial loss to adequately replace in money.


(3) The claims referred to in paragraphs 1 and 2 are limited to a total amount of


130,000 euros. Decrease is due to the same event to several people to afford


compensation, the total exceeds the maximum amount of 130,000 euros, then the


individual compensation payments in the proportion in which their total amount is at


the maximum.


(4) Are entitled to store a plurality of locations in an automated processing and is not


the victim in a position to determine the filing system, so each body shall be liable.


(5) contributory negligence by the person concerned at the occurrence of the


damage, apply § 254 of the Civil Code.



(6) the provisions in force for torts limitation rules of the Civil Code shall apply


mutatis mutandis to the limitation period.


Unofficial Contents


§ 9 Technical and organizational measures




Public and private bodies that collect personal data itself or on behalf of, process or


use, have to meet the technical and organizational measures that are necessary to


the execution of the provisions of this Act, in particular those mentioned in the Annex


to this Act requirements to ensure. Measures shall be required only if the effort


involved is reasonable in relation to the desired level of protection.


Unofficial Contents


§ 9a Data protection audit




In order to improve data protection and data security provider of data processing


systems and programs and data processing sites may have their data protection


concept and its technical equipment by independent and accredited appraisers, and


evaluate and publish the results of the audit. The detailed requirements for the


testing and evaluation, the process and the selection and approval of the experts


shall be regulated by special law.


Unofficial Contents


§ 10 Establishment of automated retrieval procedures




(1) The establishment of an automated procedure that allows the transmission of


personal data by polling is permissible as long as this process of agencies involved


is reasonable taking into account the legitimate interests of those concerned and the


responsibilities or business purposes. The rules on the admissibility of retrieval


remain unaffected.


(2) The parties involved have to ensure that the admissibility of the retrieval


procedure can be monitored. For this purpose, they shall specify in writing:


1.


Occasion and purpose of the retrieval process,


. 2


Third, is transmitted to the,


. 3


Type of information to be transferred,


. 4


§ 9 required technical and organizational measures.



In the public sector the necessary definitions can be made by the technical


supervision authorities.


(3) concerning the establishment of retrieval procedures in cases where the in § 12


para. 1 mentioned bodies participate to inform the Federal Commissioner for Data


Protection and Freedom of Information Communication under the provisions of


paragraph 2. The establishment of retrieval procedures in which the in § 6 para. 2


and in § 19 para. 3 p


oints referred to are involved, is only permitted if the Board


approved for storing and retrieving body each relevant federal or provincial ministry.


(4) Responsibility for the admissibility of retrieval carries the third party, is transmitted


to the. The storing body must examine the admissibility of retrieval only if there is


occasion. The filing system has to ensure that the transfer of personal data can be


ascertained and checked at least by means of appropriate sampling techniques. If a


total stock of personal data, accessed or transmitted (batch), so refers to ensure the


identification and verification only to the admissibility of the call or the transmission of


the total portfolio.


(5) Paragraphs 1 to 4 shall not apply to the retrieval of generally accessible data.


Generally accessible is information that anyone, whether it can be used with or


without prior notification, authorization or payment of a fee.


Unofficial Contents


§ 11 collection, processing or use of personal data on behalf




(1) If personal data are collected on behalf of other bodies, processed or used, the


client is responsible for compliance with the provisions of this Act and other


regulations governing data protection. The rights referred to in §§ 6, 7 and 8 are to


be made against him asserted.


(2) The Contractor shall be paying particular attention to adequacy of measures it


has technical and organizational measures to carefully select. The order must be


issued in writing, in particular, are laid down in detail:


1.


the subject and the duration of the contract,


. 2


the scope, nature and the purpose of the proposed collection, processing or use of


data, the type of data and the circle of victims,


. 3


in accordance with § 9 to be taken technical and organizational measures,



. 4


the rectification, erasure and blocking of data


. 5


existing obligations under paragraph 4 of the contractor, in particular, to be


conducted by him checks,


. 6


the possible justification for reasons of subcontracting relationships,


. 7


the control rights of the client and the corresponding toleration and cooperation


obligations of the contractor,


8th.


Information to be violations of the contractor or the persons employed by him


persons against regulations on the protection of personal data or against the


measures taken in order specifications,


. 9


the scope of the authority to issue, which reserves the authority to the contractor,


10th


the return on authorized media and the deletion of stored data by the contractor after


termination of the contract.


It can be granted by public authorities and by the technical supervision authority. The


principal must regularly ensure before commencement of data processing and then


to compliance with the measures taken by the contractor technical and


organizational measures. The result must be documented.


(3) The contractor may use the data we collect, process or use only as directed by


the client. If it considers that a transfer of authority of this Act or other regulations


regarding data breach, he must inform the principal without delay it.


(4) For the Contractor shall apply in addition to §§ 5, 9, 43 para. 1 no. 2, 10 and 11,


para. 2 no. 1 to 3 and para. 3 and § 44, only the rules on the data protection control


or the supervision, namely for


1.


a)


public bodies,


b)


private parties, in which the public sector includes the majority of the shares or the


majority of votes and where the contracting authority is a public body,


the §§ 18, 24 to 26 or the corresponding provisions of the privacy laws of the


countries,


. 2


the other non-public places, provided they collect personal data on behalf of a


service company businesslike, process or use the §§ 4f, 4g and 38th



(5) Paragraphs 1 to 4 shall apply mutatis mutandis, if the examination or


maintenance of automated procedures or of data processing systems is carried out


by other bodies on behalf and it can not be excluded, access to personal data.


Section Two


data processing by public bodies



First Subsection


legal bases for data processing



Unofficial Contents


§ 12 Scope




(1) The provisions of this section apply to public bodies of the Federation, to the


extent they do not participate as a public company in the competition.


(2) If the Notice is not governed by state law, §§ 12 to 16, 19 till 20 for the public


authorities of the country, insofar as they


1.


Execute federal law and will not participate as a public company on competition or


. 2


to act as organs of justice and it does not concern administrative matters.


(3) For country representative for data protection applies to § 23 para. 4 accordi


ngly.


(4) Where personal data for historical, existing or future employment collected,


processed or used, apply § 28 paragraph 2 point 2 and §§ 32 to 35 instead of §§ 13


to 16 and 19 to the 20th


Unofficial Contents


§ 13 Data collection




(1) The collection of personal data is allowed if their knowledge to meet the tasks of


the responsible body is required.


(1a) Where personal data held when affected at a non-public body, the notice is the


location on the legislation that obliged to provide information, otherwise draw


attention to the voluntary nature of their information.


(2) The collection of special categories of personal data (§ 3 para. 9) is only


permissible to the extent


1.


a legal provision prescribes or for reasons of substantial public interest requires


mandatory


. 2


the individual has consented pursuant to § 4a para. 3,



. 3


This to protect the vital interests of the data subject or a third party is required,


unless the person concerned from physical or legal reasons is unable to give his


consent,


. 4


this is data which has manifestly made public by the data subject,


. 5


this is necessary to avert a substantial threat to public safety,


. 6


this is absolutely necessary to avert substantial detriment to the public interest or to


protect substantial interests of the common good,


. 7


this is necessary for the purposes of preventive medicine, medical diagnosis, the


care or treatment or the management of health services and the processing of such


data is performed by medical staff or by another person also subject to an equivalent


obligation of secrecy,


8th.


this is necessary for carrying out scientific research, greatly outweighs the scientific


interest in performing the research project the interest of the person concerned to the


exclusion of the collection and the purpose of the research can be achieved in other


ways, or only with disproportionate effort or


. 9


This exceeded by overriding reasons of defense or the performance or


intergovernmental obligations of any public office of the Federal in the field of crisis


management or conflict prevention or for humanitarian action is required.


Unofficial Contents


§ 14 Data Storage,


-change and use



(1) The storage, modification or use of personal data is permissible if it is necessary


for the performance of the areas under the responsibility of the data controller tasks


and it is carried out for the purposes for which the data were collected. If no survey


preceded the data may be modified or used only for the purposes for which they


have been stored.


(2) The storage, modification or use for other purposes is permitted only if


1.


a legal provision prescribes or peremptorily presupposes


. 2


the data subject has consented,


. 3


it is obvious that it is in the interests of the person concerned, and no reason to


believe that he would deny having regard to the other purpose his consent,


. 4


Details of the person concerned must be checked, because actual evidence of their


falsity exist,


. 5


the data are generally accessible or the controller it is likely to publish it unless the


legitimate interest of the data subject in excluding the change of purpose outweighs


obvious


. 6


it is necessary to avert substantial detriment to the common good or a threat to


public safety or to protect substantial interests of the common good,


. 7


it is necessary for the prosecution of criminal or administrative offenses, the


enforcement or execution of penalties or measures within the meaning of § 11 para.


1 no. 8 of the Criminal Code or of educative or disciplinary measures within the


meaning of the Juvenile Court Act or to enforce decisions imposing fines,


8th.


it is necessary to prevent a serious deterioration of another person's rights or


. 9


it is necessary to conduct scientific research, greatly outweighs the scientific interest


in performing the research project the interest of the person concerned to the


exclusion of the change of purpose and the purpose of the research can be achieved


in other ways, or only with disproportionate effort.


(3) Processing or use for other purposes does not exist if it serves the exercise of


supervisory and control powers, the audit or performance of organizational studies


for the corresponding agency. This also applies to the processing or use for training


and testing purposes by the responsible body, unless overriding legitimate interests


of the person concerned preclude.


(4) Personal data are stored exclusively for purposes of monitoring data protection,


data security or to ensure the proper operation of a data processing system may be


used only for those purposes.


(5) The storage, modification or use of special types of personal data (§ 3 para. 9) for


other purposes is permitted only if


1.


the conditions exist which would permit a survey in accordance with § 13 para. 2 no.


1 to 6 or 9 or


. 2


this is necessary for carrying out scientific research, substantially outweighs the


public interest in carrying out the research project the interest of the person


concerned to the exclusion of the change of purpose and the purpose of the


research can be achieved in other ways, or only with disproportionate effort.


When weighing after sentence 1 no. 2 in the context of the public interest, scientific


interest in the research project requires special consideration.


(6) The storage, modification or use of special types of pers


onal data (§ 3 para. 9) to


in § 13 para. 2 no. 7 purposes specified depends on the for in § 13 para. 2 no. 7


mentioned persons recognized confidentiality obligations.


Unofficial Contents


§ 15 Disclosure of data to public bodies




(1) The transfer of personal data to public bodies shall be admissible if


1.


it is necessary to fulfill the responsibility of the transferring body or the third party to


whom the data are disclosed, lying and tasks


. 2


the conditions exist which would permit a use in accordance wit


h § 14th



(2) Responsibility for the permissibility of the transmission transmits the forwarding


authority. Failure to submit the request of the third party to whom the data are


disclosed, this is responsible. In this case, the forwarding authority checks only


whether the transfer request within the framework of the tasks of the third party to


whom the data are disclosed, is unless that specific reasons exist to consider the


admissibility of the supply. § 10 Abs. 4 remains unaffected.



(3) The third party to whom the data are disclosed, these may process or use for


which they are forwarded to it for the purpose. Processing or use for other purposes


is admissible only if the requirements of § 14 para. 2,.



(4) For the transfer of personal data to bodies of public religious societies,


paragraphs 1 to 3 in accordance with provided it is ensured that these are taken


adequate data protection measures apply.


(5) Unless Are personal data which may be communicated in accordance with


paragraph 1, further personal data of the person concerned or a third party


connected such that a separation or only with unjustifiable effort is possible, so the


transmission and this data is permitted, legitimate interests of the data subject or a


third party outweigh obviously keeping them secret; Any use of this data is not


permitted.


(6) Paragraph 5 shall apply mutatis mutandis where personal data are forwarded


within a public authority.


Unofficial Contents


§ 16 Disclosure of data to private parties




(1) The transfer of personal data to non-public bodies shall be admissible if


1.


it is the fulfillment of the areas under the responsibility of supplying agency tasks


required and the conditions exist which would permit a use in accordance with § 14,


or


. 2


the third party to whom the data are disclosed, a legitimate interest in knowing the


information to be transmitted data credibly proves and the person concerned has no


legitimate interest in excluding such transmission. The transmission of specific types


of personal data (§ 3 para. 9) Notwi


thstanding sentence 1 no. 2 only permitted if the


conditions exist which would permit a use in accordance with § 14 para. 5 and 6, or


the extent to assert, exercise or defense of legal claims is required.


(2) Responsibility for the permissibility of the transmission transmits the forwarding


authority.


(3) In the cases referred to in paragraph 1 no transmission. 2 the supplying body


shall inform the person of the transmission of his data. This does not apply if it can


be expected that he becomes aware of it in some other way, or if the disclosure


would jeopardize public safety or otherwise be detrimental to the Federation or a


Land.


(4) The third party to whom the data are disclosed, these may process or use for


which they are forwarded to it for the purpose. The transmitting body shall advise


him on it. Processing or use for other purposes is permissible if a submission


pursuant to paragraph 1 would be admissible and has agreed to the forwarding


authority.


Unofficial Contents


§ 17




(repealed)


Unofficial Contents


§ 18 Implementation of data protection in the Federal Administration




(1) The supreme federal authorities, the President of the Federal Railroad Fund as


well as the federal corporations, institutions and foundations under public law, on the


by the Federal Government or a supreme federal authority only for the legal


supervision is carried out have, for their business through the implementation of this


Act and other legislation ensure data protection. The same applies to the boards of


the products resulting from such fund German Federal Post Office by law companies,


as long as these have an exclusive right under the Postal Act.


(2) The public authorities shall maintain a register of the data processing equipment


used. For their automated processing they


define the information according to § 4e


and the legal basis of the processing in writing. In general administrative purposes


were automated processing, in which the right of the person concerned is not in


accordance with § 19 para. 3 or 4 is restricted, c


an be dispensed therefrom. For


automated processing, which are performed repeatedly in the same or similar


manner, the provisions can be summarized.


Second subsection


rights of the person concerned



Unofficial Contents


§ 19 Provision of information to th


ose concerned



(1) The persons concerned shall be granted on request, information on


1.


the stored personal data, including those relating to the origin of the data,


. 2


the recipients or categories of recipients to whom the data are disclosed, and


. 3


the purpose of storage.


The request should specify the type of personal data is to be granted on the


information to be referred to in more detail. Where the personal data neither


automated nor stored in non-automated files which information will be issued only if


the person provides information that allows identification of the data, and not made


the requisite for providing the information effort disproportionate to the the person


concerned claims interest in information stands. The responsible authority shall


determine the procedures, in particular the form of exchange of information, after


due consideration.


(2) Paragraph 1 shall not apply to personal data which are only therefore saved,


because they are allowed by law, statutory or contractual retention requirements not


be deleted, or exclusively serve purposes of data security or data protection control


and an exchange of information would require a disproportionate effort.


(3) Refers to the provision of information on the transfer of personal data to


constitutional protection authorities, the Federal Intelligence Service, the Military


Counterintelligence Service and insofar as the security of the Federation is touched,


other authorities of the Ministry of Defense, it is only with the consent of those bodies


allowed.


(4) The Access shall be refused to the extent


1.


the information would jeopardize the proper performance of the areas under the


responsibility of the responsible office tasks,


. 2


the information would jeopardize public order or security or otherwise be detrimental


to the Federation or a country or


. 3


the data or the fact of their storage according to a legal provision or by its very nature,


in particular because of the overriding legitimate interests of a third party, must be


kept secret


and therefore the interest of the person concerned must resign at the exchange of


information.


(5) The refusal to provide information does not require a statement of reasons, in so


far as. By the statement of the factual and legal grounds on which the decision is


based, the objective pursued by the refusal to supply information purpose would be


jeopardized In this case, the person concerned is to be noted that he may appeal to


the Federal Commissioner for Data Protection and Freedom of Information.


(6) If the person concerned does not provide information, so they must be issued at


his request the Federal Commissioner for Data Protection and Freedom of


Information, unless noted the relevant competent supreme federal authority in an


individual case that characterized the security of the Federation or of a country would


be jeopardized. The statement by the Federal Commissioner to the person


concerned must not allow any conclusions about the state of knowledge of the


responsible entity, provided that the latter consents to further information.


(7) The information provided is free of charge.


Unofficial Contents


§ 19a Notification




(1) Where objections are data without knowledge of the person concerned, it shall be


informed of the storage, the identity of the controller and on the purpose of the


collection, processing or use. The person concerned has data to inform also on the


recipients or categories of recipients to the extent that it does not have the expected


submission of this. If a submission is provided, the information must be made not


later than the first transmission.


(2) An obligation to notify does not apply if


1.


the person concerned has acquired in other ways aware of the storage or


transmission,


. 2


informing the person concerned requires a disproportionate effort or


. 3


the storage or transmission of personal data is expressly provided by law.


The controller shall stipulate in writing, is the conditions under which, apart from a


notification in accordance with paragraph 2 or. 3


(3) § 19 para. 2 to 4 shall appl


y mutatis mutandis.


Unofficial Contents


§ 20 rectification, erasure and blocking of data; Right of appeal




(1) Personal data shall be corrected if they are inaccurate. If it is determined that


personal data which are not processed automatically been saved in non-automated


files are incorrect, or if their correctness is contested by the person concerned, this


should be noted in an appropriate manner.


(2) Personal data are processed by automated procedures or stored in non-


automated files should be deleted when


1.


their storage is inadmissible or


. 2


their knowledge of the entity responsible for the performance of the underlying in its


jurisdiction tasks is no longer necessary.


(3) In place of a cancellation a blockage, insofar


1.


a deletion conflicts with legal, statutory or contractual retention periods,


. 2


Reason to believe that legitimate interests of the person concerned would be


affected by a cancellation, or


. 3


deletion due to the specific type of storage or only with disproportionate effort.


(4) Personal data are processed by automated procedures or stored in non-


automated files, also be blocked if their accuracy is contested by the person


concerned and can be determined neither the accuracy nor their inaccuracy.


(5) Personal data may not be collected, processed or used for automated processing


or processing in non-automated files, if the data subject contradicts this in the


controller and an examination reveals that the legitimate interests of the person


concerned that because of its special personal situation interest of the data controller


to the collection, processing or use predominates. Sentence 1 shall not apply if a


legal provision for the collection, processing or use of obligation.


(6) Personal data which are not processed automatically been saved in a non-


automated file are to terminate if the authority establishes in an individual case that


without blocking legitimate interests of the person concerned would be compromised


and the data for the completion of the authority no longer required are.


(7) Blocked data shall only be transmitted or used without the consent of the person


concerned, if


1.


it is for scientific purposes, for use as evidence or for other reasons in the overriding


interest of the data controller or a third party underlying reasons essential and


. 2


likely to be transmitted or used the data for this purpose if it were not blocked.


(8) The correction of incorrect data, the blocking of disputed data and the erasure or


blocking on grounds of inadmissibility of storage are the places to communicate,


which the information was passed on for storage in the context of a data transfer, if


this does not require a disproportionate effort and legitimate interests of do not


preclude the person concerned.


(9) § 2 para. 1 to 6, 8 and 9 of the


Federal Archives Act shall apply.


Unofficial Contents


§ 21 invocation of the federal Commissioner for Data Protection and Freedom of


Information



Anyone may appeal to the Federal Commissioner for Data Protection and Freedom


of Information if he believes to have been injured in the collection, processing or use


of personal data by public authorities of the Federation's rights. This is only valid for


the collection, processing or use of personal data by the federal courts, where they


are acting in administrative matters.


Third subsection


Federal Commissioner for Data Protection and Freedom of Information



Unofficial Contents


§ 22 Election of the Federal Commissioner for Data Protection and Freedom of


Information



(1) The German Bundestag shall elect the proposal from the Federal Government


the Federal Commissioner for Data Protection and Freedom of Information, with


more than half of the statutory number of its members. The Federal Commissioner


must be at least 35 years old at his discretion. The person elected shall be appointed


by the Federal President.


(2) The Federal Commissioner makes to the Federal Minister of the Interior following


oath:



their welfare, protect them from harm, uphold the Basic Law and the laws of the


Federation and defend, fulfill my duties conscientiously, and do justice to all. To me


God help.


The oath may be made even without religious affirmation.


(3) The term of office of the Federal Commissioner shall be five years. One re-


election is permitted.

-


-


-


-


-


-


-


-



本文更新与2021-02-08 09:29,由作者提供,不代表本网站立场,转载请注明出处:https://www.bjmy2z.cn/gaokao/613632.html

《德国联邦数据保护法》2015最新修订版-BDSG2015的相关文章

《德国联邦数据保护法》2015最新修订版-BDSG2015随机文章