§ 23 BlnDSG
Duty to Inform When Collecting Personal Data
(1)In addition to the exceptions set out in Articles 13(4) and 14(5) of Regulation (EU) 2016/679, there shall be no duty to inform the data subject of the collection of their personal data where the provision of information must yield to the public interest in confidentiality or to an overriding interest of third parties in confidentiality for compelling reasons. A case within the meaning of sentence 1 shall exist in particular where the provision of information 1. would jeopardise public safety or would otherwise cause substantial disadvantages to the interests of the Federation or a Land, 2. would jeopardise the prosecution of criminal offences and administrative offences, or 3. would lead to the disclosure of facts that, pursuant to a legal provision serving the public interest or for the protection of the rights and freedoms of other persons, must be kept confidential.
(2)The decision to refrain from providing information shall be taken by the head of the public body or a person employed at the public body designated by the head. The reasons for refraining from providing information shall be documented and communicated to the official data protection officer. The controller shall also take other appropriate measures to protect the legitimate interests of the data subject, including making the information referred to in Articles 13(1) and (2) and 14(1) and (2) of Regulation (EU) 2016/679 available to the public in a precise, transparent, intelligible and easily accessible form using clear and plain language.
(3)Where the provision of information is omitted in the cases of paragraph 1 on account of a temporary impediment, the controller shall comply with the duty to inform within a reasonable period after the impediment ceases, taking into account the specific circumstances of the processing, but no later than within two weeks.
(4)The Court of Auditors shall not be obliged to provide information pursuant to Article 14 of Regulation (EU) 2016/679 insofar as it processes personal data in the context of its independent activities. zur Einzelansicht § 23