§ 27 DSG NRW
Tasks
(1)In addition to the other tasks listed in Article 57 of Regulation (EU) 2016/679, the State Commissioner for Data Protection and Freedom of Information shall advise and inform public bodies on data protection matters.
(2)Public bodies shall be obliged to support the State Commissioner for Data Protection and Freedom of Information in the fulfilment of his or her tasks and powers in accordance with Articles 57 and 58 of Regulation (EU) 2016/679 and to provide administrative assistance. Access to all offices and access to electronic services shall be granted to the State Commissioner for Data Protection and Freedom of Information at all times. Statutory confidentiality provisions may not be invoked against a request for information or inspection.
(3)By way of derogation from paragraph 2, the investigative powers of the State Commissioner for Data Protection and Freedom of Information pursuant to Article 58(1)(e) and (f) of Regulation (EU) 2016/679 shall not exist vis-a-vis the persons referred to in Section 203(1) and (3) and paragraph 4, sentence 1, of the Criminal Code or their processors, insofar as the exercise of the powers would lead to a breach of the duty of confidentiality of these persons.
(4)Insofar as the provision of the requested information would substantially jeopardise the performance of the controller's tasks, the jeopardy shall be notified and justified in writing to the State Commissioner for Data Protection and Freedom of Information. Where the respective competent supreme Land authority determines in individual cases that the security of the Federation or of a Land so requires, the powers of the State Commissioner for Data Protection and Freedom of Information may be exercised only by him or her in person. In this case, personal data of a data subject to whom the data processing body has given a particular assurance of confidentiality need not be disclosed to him or her either.
(5)The State Commissioner for Data Protection and Freedom of Information shall be informed at an early stage about plans for the development, establishment or material modification of automated data processing and information systems insofar as personal data are to be processed in the respective system. The same shall apply to drafts of legal or administrative provisions of the Land insofar as they provide for the processing of personal data.