§ 32 BDSG
Obligation to provide information when collecting personal data from the data subject
(1)The obligation of the controller to provide information to the data subject pursuant to Article 13 Subsections (1) and (2) of Regulation (EU) 2016/679 shall not apply where the informationand the interest of the controller in not providing the information outweighs the interest of the data subject in obtaining it. 1 would jeopardise the proper fulfilment of the tasks within the competence of the public body, in particular if it would jeopardise the aims of an investigation or a measure,; 2 would jeopardise the public security or public order or would otherwise be detrimental to the welfare of the Federation or a Land or; 3 must be kept secret by virtue of a legal provision or by their nature, in particular because of the overriding legitimate interests of a third party,
(2)Where Section 33 Subsection (1) is not applied, the obligation to provide the information referred to therein shall apply at such time as the conditions referred to in Section 33 Subsection (1) no longer apply, but in any case no later than the storage of the personal data or the disclosure to another recipient.
(3)The obligation of the controller to provide information to the data subject pursuant to Article 13 Subsection (4) of Regulation (EU) 2016/679, where it is intended to further process the personal data for a purpose other than that for which the data were collected, shall not apply where the provision of such information would be incompatible with the further processing purpose.