§ 29 BDSG
Rights of the data subject and supervisory powers in the case of confidentiality obligations
(1)Where the exercise of the right of access of the data subject to information pursuant to Article 15 of Regulation (EU) 2016/679 would entail a disclosure of information which is subject to an obligation of secrecy by virtue of a legal provision or by its nature, in particular because of the overriding legitimate interests of a third party, and the interest of the data subject in obtaining the information does not override, the data subject shall not have the right of access.
(2)The obligation to provide information under Article 15 of Regulation (EU) 2016/679 shall not apply insofar as the data subject is to be kept secret pursuant to a legal provision or by their nature, in particular because of the overriding legitimate interests of a third party, and the interest of the data subject in obtaining the information does not override. The right to rectification under Article 16 of Regulation (EU) 2016/679 and the right to restriction of processing under Article 18 of Regulation (EU) 2016/679 shall not apply insofar as a disclosure of the information concerned would involve a risk within the meaning of the first sentence. The obligation to provide information under Article 34 of Regulation (EU) 2016/679 shall not apply insofar as the interest in avoiding such a risk outweighs the interest of the data subject in obtaining the information.
(3)Data subjects may exercise their rights under Article 82 of Regulation (EU) 2016/679 also through the competent supervisory authorities. For the proceedings before the supervisory authority, the provisions of the Voluntary Jurisdiction Act shall apply.