§ 52 BlnDSG
Notification of Data Subjects in the Event of Personal Data Breaches
(1)of Personal Data
(2)Where a personal data breach is likely to result in a substantial risk to the rights of data subjects, the controller shall notify the data subjects of the incident without undue delay.
(3)The notification pursuant to paragraph 1 shall describe in clear and plain language the nature of the personal data breach and shall contain at least the information and measures referred to in Section 51(3) nos. 2 to 4.
(4)The notification pursuant to paragraph 1 may be dispensed with where 1. the controller has implemented appropriate technical and organisational security measures and those measures have been applied to the personal data affected by the breach; this shall apply in particular to measures that render the data inaccessible to unauthorised persons; 2. the controller has taken subsequent measures that ensure that the substantial risk within the meaning of paragraph 1 is, in all likelihood, no longer likely to materialise, or 3. this would involve a disproportionate effort; in this case, a public announcement or a similar measure shall instead be made by which the data subjects are informed in an equally effective manner.
(5)Where the controller has not notified the data subjects of a personal data breach, the Berlin Commissioner for Data Protection and Freedom of Information may formally determine that, in their view, the conditions referred to in paragraph 3 are not met. In doing so, the Commissioner shall take into account the likelihood that the breach will result in a substantial risk within the meaning of paragraph 1.
(6)The notification of data subjects pursuant to paragraph 1 may, under the conditions referred to in Section 42(2), be postponed, restricted or omitted, insofar as the interests of the data subject on account of the substantial risk arising from the breach within the meaning of paragraph 1 do not prevail. zur Einzelansicht § 52