§ 49 DSG NRW
Right of access
(1)The controller shall, upon application, provide data subjects with information as to whether he or she processes data concerning them. Data subjects shall furthermore have the right to obtain information on
(2)1. the personal data that are the subject of the processing and the category to which they belong,
(3)2. the available information on the origin of the data,
(4)3. the purposes of the processing and its legal basis,
(5)4. the recipients or the categories of recipients to whom the data have been disclosed, in particular recipients in third countries or international organisations,
(6)5. the storage period applicable to the data or, where that is not possible, the criteria for determining that period,
(7)6. the existence of a right to rectification, erasure or restriction of processing of the data by the controller,
(8)7. the right, pursuant to Section 60, to lodge a complaint with the State Commissioner for Data Protection and Freedom of Information, and
(9)8. the contact details of the State Commissioner for Data Protection and Freedom of Information.
(10)The data subject may not request access to the processing of personal data concerning them pursuant to paragraph 1 insofar as the data are stored exclusively for purposes of data security or data protection supervision and processing for other purposes is excluded by appropriate technical and organisational measures.
(11)Where the controller processes large volumes of information about the data subject, the controller may, in the event of a request for access, require the data subject to specify which information or which processing operations the access request relates to.
(12)The controller may, under the conditions of Section 48(2), refrain from providing access pursuant to paragraph 1, sentence 1, or restrict the provision of access pursuant to paragraph 1, sentence 2, in whole or in part.
(13)Where the provision of access relates to the transmission of personal data to constitutional protection authorities, the Federal Intelligence Service, the Military Counter-Intelligence Service, or, insofar as the security of the Federation is concerned, other authorities of the Federal Ministry of Defence, it shall be permissible only with the consent of these bodies.
(14)The controller shall inform the data subject in writing without delay about the refusal to provide or the restriction of access. This shall not apply where the provision of this information itself would give rise to a risk within the meaning of Section 48(2). The notification pursuant to sentence 1 shall be accompanied by a statement of reasons, unless the communication of the reasons would jeopardise the purpose pursued by the refusal to provide or the restriction of access.
(15)Where the data subject is informed pursuant to paragraph 6 about the refusal to provide or the restriction of access, the data subject may also exercise his or her right of access through the State Commissioner for Data Protection and Freedom of Information. The controller shall inform the data subject that, pursuant to Section 60, he or she may lodge a complaint with the State Commissioner for Data Protection and Freedom of Information, exercise his or her right of access through him or her, or seek judicial redress. Where the data subject exercises his or her right under sentence 1, access shall, upon request, be provided to the State Commissioner for Data Protection and Freedom of Information unless the competent supreme Land authority determines in the individual case that this would jeopardise the security of the Federation or of a Land. The State Commissioner for Data Protection and Freedom of Information shall inform the data subject that all necessary checks have been carried out or that a review by him or her has taken place. This communication may include information as to whether data protection violations have been found. The communication of the State Commissioner for Data Protection and Freedom of Information to the data subject shall not allow inferences as to the state of knowledge of the controller, unless the controller consents to more detailed information. The controller may refuse consent only insofar as and for as long as he or she could refrain from or restrict access pursuant to paragraph 4. The State Commissioner for Data Protection and Freedom of Information shall also inform the data subject of his or her right to judicial redress.
(16)The controller shall document the factual or legal reasons for the decision.