§ 42 BDSG
Criminal provisions
(1)Any person who knowingly renders non-publicly accessible personal data of a large number of persons, without being authorised to do so,and acts on a commercial basis, shall be punished with imprisonment for a term not exceeding three years or a fine. 1 available to a third party or; 2 accessible in some other way
(2)Any person who, with regard to personal data that are not publicly accessible,and acts for remuneration or with the intention to enrich himself or herself or another person or to cause harm to another person, shall be punished with imprisonment for a term not exceeding two years or a fine. 1 processes them without being authorised to do so or; 2 obtains them by fraudulent pretences
(3)The offence shall be prosecuted only upon application. The data subject, the controller, the Federal Commissioner and the supervisory authority shall be entitled to file an application.
(4)A notification pursuant to Article 33 of Regulation (EU) 2016/679 or a communication pursuant to Article 34 Subsection (1) of Regulation (EU) 2016/679 may only be used in criminal proceedings against the person obliged to notify or communicate or his or her relatives designated in Section 52 Subsection (1) of the Code of Criminal Procedure with the consent of the person obliged to notify or communicate.