§ 57 NDSG
Tasks and powers of the supervisory authority
(1)The authority headed by the Land Commissioner for Data Protection pursuant to § 18 shall also be the supervisory authority pursuant to Article 41(1) of Directive (EU) 2016/680.
(2)It shall have the task of
(3)monitoring and enforcing the application of the legal provisions enacted for the transposition of Directive (EU) 2016/680,
(4)raising public awareness and understanding of the risks, rules, safeguards and rights in connection with the processing of personal data,
(5)advising the Land Parliament, the Land Government and other institutions and bodies on legislative and administrative measures for the protection of the rights and freedoms of natural persons with regard to the processing of personal data,
(6)raising the awareness of controllers and processors with regard to their obligations arising from the transposition of Directive (EU) 2016/680,
(7)providing information, on request, to any data subject concerning the exercise of his or her rights pursuant to the legal provisions enacted for the transposition of Directive (EU) 2016/680 and, where appropriate, cooperating with the supervisory authorities of other Member States for this purpose,
(8)dealing with complaints lodged by a data subject, including where lodged by a body, organisation or association pursuant to Article 55 of Directive (EU) 2016/680, investigating the subject matter of the complaint to the extent appropriate and informing the complainant within a reasonable period of the progress and the outcome of the investigation, in particular where further investigation or coordination with another supervisory authority is necessary,
(9)cooperating with other supervisory authorities, including by sharing information, and providing mutual assistance in order to ensure the consistent application and enforcement of the legal provisions enacted for the transposition of Directive (EU) 2016/680,
(10)conducting investigations on the application of the provisions of this Part and other data protection provisions for the transposition of Directive (EU) 2016/680, including on the basis of information received from another supervisory authority or other public body,
(11)monitoring relevant developments, insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies and commercial practices,
(12)providing advice on the processing operations referred to in § 40, and
(13)contributing to the activities of the European Data Protection Board.
(14)1Supervision of the collection of personal data by criminal prosecution authorities in the course of investigation, detection or prosecution of criminal offences shall be permissible only after the conclusion of the criminal proceedings. 2Such supervision shall not extend to data processing that has been subject to judicial review. 3Sentences 1 and 2 shall apply mutatis mutandis to the enforcement of criminal penalties.
(15)1The controller shall cooperate with the authority headed by the Land Commissioner for Data Protection in the performance of its tasks and shall support it in the exercise of its tasks. 2In particular, the controller shall
(16)provide information and grant access to all documents which the authority headed by the Land Commissioner for Data Protection considers necessary for the performance of its tasks,
(17)submit the documents referred to in number 1 within a specified period upon request, and
(18)grant access to the official premises, including all data processing equipment and devices, as well as to all personal data and information,
(19)insofar as this is necessary for the performance of its tasks. 3The investigatory powers of the authority headed by the Land Commissioner for Data Protection shall also extend to personal data obtained by public bodies within the meaning of § 23(1) and (2) concerning the content and further circumstances of correspondence, postal and telecommunications traffic, and to personal data collected on the basis of measures which interfere with the right to inviolability of the home. 4The fundamental right to secrecy of correspondence, postal and telecommunications (Article 10 of the Basic Law) and the fundamental right to inviolability of the home (Article 13 of the Basic Law) shall be restricted to this extent.
(20)1Where there are indications that an intended processing of personal data violates the provisions of this Part or other legal provisions within the meaning of § 23(3) sentence 1, the authority headed by the Land Commissioner for Data Protection may warn the controller or the processor that the data processing is likely to violate the provisions of this Part or other legal provisions within the meaning of § 23(3) sentence 1. 2Where the authority headed by the Land Commissioner for Data Protection identifies such a violation in the course of ongoing processing of personal data, it may reprimand the violation
(21)in the case of a responsible public body of the Land within the meaning of § 23(1) and (2), vis-a-vis the competent supreme Land authority,
(22)in the case of a responsible municipality, vis-a-vis the municipality,
(23)with a request to submit comments within a specified period. 3In the cases of sentence 2 number 2, the competent municipal and technical supervisory authority shall be informed simultaneously.
(24)In other respects, § 20(5) and § 21 as well as Article 57(2) to (4) and Article 61(1) to (7) of the General Data Protection Regulation shall apply mutatis mutandis to the supervisory authority pursuant to paragraph 1.
(25)1Where a supreme Land authority determines in an individual case that the security of the Federation or a Land so requires, the rights pursuant to paragraph 4 may only be exercised by the Land Commissioner for Data Protection in person. 2In that case, the supreme Land authority shall decide whether personal data of a data subject to whom the controller has given a special assurance of confidentiality shall be disclosed to the Land Commissioner for Data Protection.
(26)1Authorities and other public bodies of the Land may also take legal action against binding decisions of the authority headed by the Land Commissioner for Data Protection that concern them. 2The action shall have suspensory effect.