§ 33 BDSG
Obligation to provide information where personal data have not been obtained from the data subject
(1)The obligation of the controller under Article 14 Subsections (1), (2) and (4) of Regulation (EU) 2016/679 to inform the data subject shall not apply insofar as the provision of such informationand the interest of the controller in not providing the information outweighs the interest of the data subject in obtaining it. 1 would jeopardise the proper fulfilment of the tasks within the competence of the public body, in particular if it would jeopardise the aims of an investigation or a measure,; 2 would jeopardise the public security or public order or would otherwise be detrimental to the welfare of the Federation or a Land,; 3 must be kept secret by virtue of a legal provision or by their nature, in particular because of the overriding legitimate interests of a third party, or; 4 where the personal data are stored or transferred in compliance with legal provisions for the purpose of supervision and monitoring or where the data is transmitted pursuant to legal provisions for the prosecution of criminal offences or administrative offences, for the enforcement or execution of criminal sentences or for the enforcement of administrative fines, or for revenue collection purposes,
(2)Where the data subject is not informed pursuant to Subsection (1), the controller shall take appropriate measures to protect the rights, freedoms and legitimate interests of the data subject, including making the information referred to in Article 14 Subsections (1) and (2) of Regulation (EU) 2016/679 available to the public.
(3)Subsection (1) shall not apply where the interests of the data subject, including a possible interest in exercising the right of access under Article 15 of Regulation (EU) 2016/679, override the interest of the controller on account of the particular circumstances of the individual case.