§ 42 ThürDSG
Right of access of the data subject
(1)(Article 14 of Directive (EU) 2016/680)
(2)The data subject shall have the right to obtain from the controller confirmation as to whether personal data concerning him or her are being processed and, where that is the case, to obtain access to the personal data and the following information: 1. the purposes of the processing and the legal basis, 2. the categories of personal data being processed, 3. the recipients or categories of recipients to whom the personal data have been disclosed, in particular recipients in third countries or international organisations, 4. where possible, the envisaged period for which the personal data will be stored or, if not possible, the criteria used to determine that period, 5. the existence of the right to request rectification or erasure of personal data or restriction of the processing of personal data by the controller, 6. the right to lodge a complaint with the State Commissioner for Data Protection and his or her contact details, and 7. the origin of the personal data.
(3)The right of access pursuant to paragraph 1 shall not exist where the data are stored exclusively for purposes of data security or data protection supervision and processing for other purposes is excluded by appropriate technical and organisational measures.
(4)The controller may restrict or refuse access pursuant to paragraph 1 under the conditions of Section 41(2).
(5)The controller shall inform the data subject in writing without delay about the refusal to provide or the restriction of access. The notification shall be accompanied by a statement of reasons, unless the communication of the reasons would jeopardise the purpose pursued by the refusal or restriction. This shall not apply where the provision of this information itself would give rise to a risk within the meaning of Section 41(2).
(6)Where the provision of access relates to the transmission of personal data to law enforcement and intelligence authorities, the provision of access shall be permissible only with the consent of these bodies.
(7)Where access is restricted or refused, the data subject shall be informed of the possibility of exercising the right of access through the State Commissioner for Data Protection and of lodging a complaint with the State Commissioner for Data Protection pursuant to Section 8 or seeking judicial redress pursuant to Section 9. Where the data subject exercises his or her right of access through the State Commissioner for Data Protection, the information shall be provided to the State Commissioner, unless the competent supreme Land authority determines in the individual case that this would jeopardise the security of the Federation or a Land. The State Commissioner for Data Protection shall inform the data subject that all necessary checks have been carried out. This communication may contain information as to whether data protection violations have been found. The information of the State Commissioner for Data Protection to the data subject shall not allow inferences as to the state of knowledge of the controller, unless the controller consents to more detailed information.
(8)The controller shall document the factual or legal reasons for the decision. zur Einzelansicht § 42