§ 33 LDSG SH
Right of access
(1)The controller shall, upon request, inform data subjects as to whether it processes data relating to them. Data subjects shall furthermore have the right to obtain the following information: 1. the personal data which are the subject of the processing and the category to which they belong, 2. the available information about the origin of the data, 3. the purposes of the processing and the legal basis thereof, 4. the recipients or categories of recipients to whom the data have been disclosed, in particular recipients in third countries or international organisations, 5. the storage period applicable to the data or, where this is not possible, the criteria for determining that period, 6. the existence of the right to rectification, erasure or restriction of processing of the data by the controller, 7. the right pursuant to § 36 to lodge a complaint with the Land Commissioner, and 8. the contact details of the Land Commissioner.
(2)Paragraph 1 shall not apply to personal data which are processed solely because they may not be erased under statutory retention provisions or which serve exclusively for data security or data protection control purposes, where providing access would require disproportionate effort and processing for other purposes is excluded by appropriate technical and organisational measures.
(3)The data subject should specify more precisely the nature of the personal data on which access is sought. Access may be refused where the data subject does not provide information enabling the data to be found and the effort required for providing access would therefore be disproportionate to the information interest asserted by the data subject.
(4)The controller may, subject to the conditions of § 32(2), refrain from granting access pursuant to paragraph 1 sentence 1 or restrict access pursuant to paragraph 1 sentence 2 in whole or in part.
(5)The controller shall inform the data subject without undue delay in writing of the refusal or restriction of access. This shall not apply where the provision of such information would itself give rise to a risk within the meaning of § 32(2). The notification pursuant to sentence 1 shall be accompanied by reasons, unless stating the reasons would defeat the purpose pursued by the refusal or restriction of access.
(6)Where the data subject is informed pursuant to paragraph 5 of the refusal or restriction of access, the data subject may also exercise his or her right of access through the Land Commissioner. The controller shall inform the data subject of this possibility and that he or she may, pursuant to § 36, lodge a complaint with the Land Commissioner or seek judicial redress. Where the data subject exercises his or her right pursuant to sentence 1, access shall, at the request of the data subject, be provided to the Land Commissioner. Where the supreme Land authority determines in an individual case that this would endanger the security of the Federation or a Land, the rights under paragraph 5 may be exercised only by the Land Commissioner for Data Protection in person or by persons specifically authorised in writing by him or her. The Land Commissioner shall at least inform the data subject that all necessary reviews have been carried out or that a review by him or her has taken place. This communication may contain information on whether data protection violations have been established. The communication of the Land Commissioner to the data subject shall not permit conclusions to be drawn about the state of knowledge of the controller, unless the controller consents to a more extensive disclosure. The controller may refuse consent only insofar as and as long as he or she could refrain from or restrict access pursuant to paragraph 4. The Land Commissioner shall furthermore inform the data subject of his or her right to seek judicial redress.
(7)The controller shall document the factual or legal reasons for the decision. zur Einzelansicht § 33