§ 28 DSG NRW
Powers
(1)The State Commissioner for Data Protection and Freedom of Information shall be empowered to process personal data that have come to his or her knowledge through complaints, enquiries, referrals and requests for advice, insofar as this is necessary for the fulfilment of his or her tasks. He or she may, in the course of supervisory measures, also collect personal data without the knowledge of the data subject. Notification of the data subject may be dispensed with at the discretion of the Commissioner.
(2)Where the State Commissioner for Data Protection and Freedom of Information concludes that there are violations of the provisions of this Act or of other provisions on data protection or other deficiencies in the processing of personal data, he or she may report them to
(3)1. in the case of the Land administration, the competent supreme Land authority; in the case of the State Court of Auditors, the President thereof,
(4)2. in the case of municipal administration, the respective responsible municipality or municipal association,
(5)3. in the case of universities and universities of applied sciences, the university president or rector; in the case of public schools, the school management, or
(6)4. in the case of other public-law corporations, institutions and foundations, the board or other body authorised to represent them
(7)and may, before exercising the powers of Article 58(2)(b) to (g), (i) and (j) of Regulation (EU) 2016/679, grant an opportunity to submit a statement within a reasonable period. In the cases of sentence 1, numbers 2 to 4, the State Commissioner for Data Protection and Freedom of Information shall simultaneously notify the competent supervisory authority. The opportunity to submit a statement may be dispensed with where an immediate decision is necessary due to imminent danger or in the public interest, or where a compelling public interest precludes it.
(8)The statement pursuant to paragraph 2, sentence 1, should also contain a description of the measures taken as a result of the objection raised by the State Commissioner for Data Protection and Freedom of Information. The bodies referred to in paragraph 2, numbers 2 to 4, shall forward a copy of their statement to the State Commissioner for Data Protection and Freedom of Information to the competent legal or specialist supervisory authority without delay.