§ 33 HDSIG
Right of Access of the Data Subject
(1)The right of access of the data subject pursuant to Art. 15 of Regulation (EU) No 2016/679 shall not exist, in addition to the exceptions referred to in § 24 para. 2, § 25 para. 2 and § 26 para. 2, where 1. the data subject is not to be informed pursuant to § 32 para. 1 or 3, or 2. the data
a)are only stored because they may not be erased due to statutory or charter-based retention requirements, or
b)serve exclusively the purposes of data security, data protection monitoring or ensuring the proper operation of a data processing system.
(2)The reasons for refusing access shall be documented. The refusal of access shall be justified to the data subject, unless the communication of the factual and legal reasons on which the decision is based would jeopardise the purpose pursued by the refusal of access. The data stored for the purpose of providing access to the data subject and for the preparation thereof may only be processed for this purpose and for the purposes of data protection monitoring; for other purposes, processing shall be restricted in accordance with Art. 18 of Regulation (EU) No 2016/679.
(3)Where the data subject is not provided with access, he or she may also exercise the right of access through the Hessian Data Protection Commissioner. The controller shall inform the data subject of this possibility and of the fact that he or she may call upon the Hessian Data Protection Commissioner pursuant to Art. 77 of Regulation (EU) No 2016/679 or seek judicial remedy. The Hessian Data Protection Commissioner shall inform the data subject that all necessary checks have been carried out or that a review by him or her has taken place. The communication of the Hessian Data Protection Commissioner to the data subject may not allow conclusions to be drawn about the state of knowledge of the controller, unless the controller consents to further disclosure. The Hessian Data Protection Commissioner shall also inform the data subject of his or her right to judicial remedy.
(4)The right of the data subject to obtain access to personal data that are neither processed by automated means nor processed by non-automated means and stored in a filing system shall only exist insofar as the data subject provides information enabling the data to be found and the effort required to provide the access is not disproportionate to the information interest of the data subject. Instead of access to personal data, the data subject may be granted inspection of the files. zur Einzelansicht § 33