§ 34 BDSG
Right of access of the data subject
(1)The right of access of the data subject pursuant to Article 15 of Regulation (EU) 2016/679 shall not apply insofar asand the interest of the controller in not providing the information outweighs the interest of the data subject in obtaining it. 1 the data subject is not to be informed pursuant to Section 33 Subsection (1) Nos. 1 to 3,; 2 the data are stored or transferred only because they may not be erased due to statutory or contractual retention requirements, or serve exclusively for the purpose of data protection monitoring or data security, and the provision of information would require a disproportionate effort, or; 3 the data are stored for the purposes of the public body and are processed in the records of the public body and the provision of information would require a disproportionate effort.
(2)The reasons for the refusal of information shall be documented. The refusal of information shall be justified to the data subject unless, by providing the factual and legal reasons on which the decision is based, the purpose pursued by the refusal of information would be jeopardised. The data stored for the purpose of providing information to the data subject and for its preparation may only be processed for this purpose and for the purposes of data protection monitoring; processing for other purposes shall be restricted in accordance with Article 18 of Regulation (EU) 2016/679.
(3)Where the data subject is not provided with information by a public body of the Federation, the information shall, at the data subject's request, be provided to the Federal Commissioner, unless the competent supreme federal authority determines in the individual case that this would jeopardise the security of the Federation or a Land. The notification by the Federal Commissioner to the data subject regarding the result of the data protection review may not allow any conclusions to be drawn about the state of knowledge of the controller, unless the controller consents to more extensive information.
(4)The right of access of the data subject to personal data which are processed by a public body neither by automated means nor are non-automatically processed and stored in a filing system shall only exist insofar as the data subject provides information enabling the data to be retrieved and the effort required to provide the information is not disproportionate to the information interest asserted by the data subject.