Art. 23 BayDSG
Administrative Offences, Criminal Provision (on Art. 84 GDPR)
(1)A fine of up to thirty thousand euros may be imposed on any person who, with respect to personal data that are processed by a public body within the meaning of Art. 1 paras. 1, 2 or para. 4 and that are not publicly known,
(2)stores, alters or transmits them,
(3)makes them available for retrieval by automated procedures, or
(4)retrieves them or procures them for himself or another person from files, or
(5)obtains them by providing false information.
(6)Any person who commits one of the acts referred to in para. 1 for remuneration or with the intention of enriching himself or another person or of harming another person shall be punished with imprisonment of up to two years or with a fine. The offence shall only be prosecuted upon application. The data subject, the controller, the processor and the supervisory authority shall be entitled to file an application.
(7)Administrative fines pursuant to para. 1 shall not be imposed on public bodies within the meaning of Art. 1 paras. 1 and 2.
(8)A notification pursuant to Art. 33 or Art. 34 GDPR may only be used in criminal or administrative fine proceedings against the controller or one of his relatives designated in Section 52 para. 1 StPO with his consent.