§ 12 DSG NRW
Restriction of the right of access of the data subject pursuant to Article 15 of Regulation (EU) 2016/679
(1)Where the controller processes large volumes of information about the data subject, the controller may, in the event of a request for access, require the data subject to specify which information or which processing operations the access request relates to. The right of access shall require the data subject to provide information enabling the data to be located with reasonable effort.
(2)The provision of access may be refused insofar as and for as long as
(3)1. this is necessary for the prosecution of criminal offences, administrative offences or breaches of professional rules,
(4)2. the access would jeopardise public safety or otherwise be detrimental to the welfare of the Federation or of a Land, or
(5)3. the personal data or the fact of their processing must be kept confidential pursuant to a legal provision or on account of the rights and freedoms of other persons.
(6)The data subject may not request access to the processing of personal data concerning them pursuant to Article 15 of Regulation (EU) 2016/679 insofar as the data are stored exclusively for purposes of data security or data protection supervision and processing for other purposes is excluded by appropriate technical and organisational measures.
(7)Where the provision of access relates to the transmission of personal data to public prosecution authorities, police authorities, financial administration authorities insofar as they store personal data for the purposes of prevention, investigation, detection or prosecution of criminal offences, constitutional protection authorities, the Federal Intelligence Service, the Military Counter-Intelligence Service and, insofar as the security of the Federation is concerned, other authorities of the Federal Ministry of Defence, the provision of access shall be permissible only with the consent of these bodies. The same shall apply to the transmission of personal data from these authorities.
(8)The refusal of access shall not require a statement of reasons insofar as the purpose of the refusal would be jeopardised by the statement of reasons. The reasons for the refusal shall be documented in the files.