§ 18 HmbDSG
Restriction of the notification obligation
(1)The controller may refrain from notifying the data subject affected by a personal data breach pursuant to Article 34 of Regulation (EU) 2016/679 to the extent and for as long as the notification 1. would endanger public safety or otherwise be detrimental to the welfare of the Federation or of a Land, or 2. is necessary for the prosecution of criminal offences or administrative offences, or 3. would lead to the disclosure of facts, personal data or the fact of their processing that must be kept secret pursuant to a legal provision or because of the rights and freedoms of other persons, or 4. would endanger the functionality of data processing systems of a public body.
(2)Where notification of the data subject is dispensed with pursuant to paragraph 1, the Hamburg Commissioner for Data Protection and Freedom of Information shall be informed. zur Einzelansicht § 18 Sechster Abschnitt Die beziehungsweise der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit