§ 37 HDSIG
Criminal Provisions
(1)Whoever processes personal data that are not publicly accessible 1. without being authorised to do so, or 2. obtains them by providing incorrect information, and in doing so acts for remuneration or with the intent to enrich himself or herself or another person or to cause harm to another person, shall be punished with imprisonment of up to two years or a fine.
(2)Para. 1 shall only apply insofar as the offence is not subject to a more severe penalty under other provisions.
(3)The offence shall only be prosecuted upon complaint. The data subject, the controller and the Hessian Data Protection Commissioner shall be entitled to file a complaint.
(4)A notification pursuant to Art. 33 of Regulation (EU) No 2016/679 or a notification pursuant to Art. 34 para. 1 of Regulation (EU) No 2016/679 may only be used in criminal proceedings against the person obliged to notify or his or her relatives designated in § 52 para. 1 of the Code of Criminal Procedure with the consent of the person obliged to notify. zur Einzelansicht § 37