§ 32 HDSIG
Obligation to Inform Where Personal Data
(1)Were Not Collected from the Data Subject
(2)The obligation to inform the data subject pursuant to Art. 14 para. 1, 2 and 4 of Regulation (EU) No 2016/679 shall not exist, in addition to the exceptions referred to in Art. 14 para. 5 of Regulation (EU) No 2016/679 and § 26 para. 1, where the provision of the information would 1. jeopardise the proper performance of the tasks within the competence of the controller within the meaning of Art. 23 para. 1 letters a to e of Regulation (EU) No 2016/679, 2. jeopardise public security or order, 3. jeopardise the rights or freedoms of third parties, or 4. otherwise cause disadvantage to the interests of the Federation or a Land, and the interest of the controller in not providing the information outweighs the information interest of the data subject. The decision shall be taken by the head of the public body or by a person designated by the head and employed at the public body.
(3)Where information to the data subject is withheld in accordance with para. 1, the controller shall take appropriate measures to protect the legitimate interests of the data subject, including making the information referred to in Art. 14 para. 1 and 2 of Regulation (EU) No 2016/679 available to the public in a precise, transparent, intelligible and easily accessible form using clear and plain language. The controller shall record in writing the reasons why information was withheld.
(4)Where the provision of information relates to the transfer of personal data by public bodies to constitutional protection authorities, the Federal Intelligence Service, the Military Counter-Intelligence Service and, insofar as the security of the Federation is affected, other authorities of the Federal Ministry of Defence, it shall only be permissible with the consent of those bodies. zur Einzelansicht § 32