§ 14 HDSIG
Powers
(1)Within the scope of application of Regulation (EU) No 2016/679, the Hessian Data Protection Commissioner shall exercise the powers pursuant to Art. 58 of Regulation (EU) No 2016/679. Where the Hessian Data Protection Commissioner concludes that there are violations of the data protection provisions or other deficiencies in the processing of personal data, he or she shall inform the public body thereof and give it the opportunity to comment within a reasonable period before exercising the powers of Art. 58 para. 2 letters b to g, i and j of Regulation (EU) No 2016/679. The opportunity to comment may be dispensed with where an immediate decision is necessary due to imminent danger or is in the public interest or where a compelling public interest precludes it. The statement should also contain a description of the measures taken as a result of the communication by the Hessian Data Protection Commissioner. The Hessian Data Protection Commissioner shall notify the respective competent legal and technical supervisory authority of the exercise of the powers pursuant to Art. 58 para. 2 letters b to g, i and j of Regulation (EU) No 2016/679.
(2)Where the Hessian Data Protection Commissioner identifies violations of the provisions of this Act or other data protection provisions or other deficiencies in the processing or use of personal data in the case of data processing for purposes outside the scope of application of Regulation (EU) No 2016/679, he or she shall object to this in the case of a public body 1. of the Land vis-a-vis the competent supreme Land authority, 2. of a municipality or county vis-a-vis the respective body authorised to represent it, and shall request a statement within a period to be determined by him or her. In the cases of sentence 1 no. 2, the Hessian Data Protection Commissioner shall simultaneously inform the competent supervisory authority. The statement should also contain a description of the measures taken as a result of the objection by the Hessian Data Protection Commissioner. The Hessian Data Protection Commissioner may refrain from an objection or waive a statement, in particular where the deficiencies are minor or have since been remedied. The Hessian Data Protection Commissioner may also warn the controller that intended processing operations are likely to violate the provisions on data protection contained in this Act and other applicable data protection provisions.
(3)In the case of violations under para. 2 sentence 1, the Hessian Data Protection Commissioner may furthermore order that 1. processing operations be brought into compliance with the provisions of this Act or other data protection provisions, where applicable in a specific manner or within a specific period, 2. personal data be rectified, 3. the processing of personal data be restricted, 4. personal data be erased where this is necessary to remedy a significant violation of data protection provisions.
(4)Public bodies shall be obliged to support the Hessian Data Protection Commissioner in the performance of his or her tasks. In particular, they shall 1. provide information on all matters and present all documents relating to the processing of personal data, 2. grant access to all personal data that are being processed, 3. grant access to the premises and official rooms including all data processing equipment and devices, insofar as this is necessary for the performance of his or her tasks.
(5)Where a supreme Land authority establishes in the individual case that the security of the Federation or a Land so requires, the rights under para. 3 may only be exercised by the Hessian Data Protection Commissioner personally. In this case, personal data of a data subject to whom the controller has given a special assurance of confidentiality may not be disclosed even to the Hessian Data Protection Commissioner. zur Einzelansicht § 14