§ 43 BlnDSG
Right of Access
(1)The controller shall, upon request, inform data subjects whether it processes data concerning them. Data subjects shall furthermore have the right to obtain the following information: 1. the personal data that are the subject of the processing and the category to which they belong, 2. the available information on the origin of the data, 3. the purposes of the processing and its legal basis, 4. the recipients or categories of recipients to whom the data have been disclosed, including, in the case of transmissions to recipients in third countries or international organisations, information thereon, 5. the storage period applicable to the data or, where this is not possible, the criteria for determining that period, 6. the existence of a right to rectification, erasure or restriction of the processing of the data by the controller, 7. the right pursuant to Section 46 to lodge a complaint with the Berlin Commissioner for Data Protection and Freedom of Information, 8. the contact details of the Berlin Commissioner for Data Protection and Freedom of Information, and 9. the existence of automated decision-making and information about the logic involved.
(2)Paragraph 1 shall not apply to personal data that are subject to a restriction of processing and are only processed because they may not be erased on the basis of statutory retention requirements, or that serve exclusively purposes of data security or data protection control, where the provision of access would require a disproportionate effort and processing for other purposes is excluded by suitable technical and organisational measures.
(3)The right of the data subject to access personal data that are processed by a public body by non-automated means shall only exist insofar as the data subject provides information that enables the data to be located and the effort required to provide access is not disproportionate to the information interest asserted by the data subject.
(4)The controller may, under the conditions of Section 42(2), refrain from providing information pursuant to paragraph 1 sentence 1 or restrict the provision of information pursuant to paragraph 1 sentence 2 in whole or in part.
(5)Where the provision of access relates to the transmission of personal data to the Office for the Protection of the Constitution, the Federal Intelligence Service, the Military Counter-Intelligence Service and, insofar as the security of the Federation is concerned, other authorities of the Federal Ministry of Defence, it shall only be permissible with the consent of those bodies.
(6)The controller shall inform the data subject without undue delay and in writing of the refusal or restriction of access. This shall not apply where the provision of such information would itself give rise to a risk within the meaning of Section 42(2). The information pursuant to sentence 1 shall state reasons, unless the provision of reasons would jeopardise the purpose pursued by the refusal or restriction of access.
(7)Where the data subject is informed pursuant to paragraph 6 of the refusal or restriction of access, they may also exercise their right of access through the Berlin Commissioner for Data Protection and Freedom of Information. The controller shall inform the data subject of this possibility and of their right to lodge a complaint with the Berlin Commissioner for Data Protection and Freedom of Information pursuant to Section 46 or to seek judicial remedy. Where the data subject exercises their right pursuant to sentence 1, access shall, at their request, be provided to the Berlin Commissioner for Data Protection and Freedom of Information, unless the competent supreme Land authority determines in the individual case that this would jeopardise the security of the Federation or a Land. The Berlin Commissioner for Data Protection and Freedom of Information shall at least inform the data subject that all necessary reviews have been carried out or that a review by the Commissioner has taken place. This communication may contain the information whether data protection violations have been established. The communication of the Berlin Commissioner for Data Protection and Freedom of Information to the data subject shall not allow conclusions to be drawn about the state of knowledge of the controller, unless the latter has consented to more extensive disclosure. The controller may refuse consent only insofar and for as long as they could refrain from or restrict access pursuant to paragraph 4. The Berlin Commissioner for Data Protection and Freedom of Information shall also inform the data subject of their right to seek judicial remedy.
(8)The controller shall document the factual and legal reasons for the decision. zur Einzelansicht § 43