Last Updated on July 4, 2021 by LawEuro
Federal Act on Registration. German law
Chapter 2
Rights of protection
Section 8
Legitimate interests of the data subject
The collection, processing or use of personal data shall not be permitted to harm the legitimate interests of the data subject. Legitimate interests are harmed in particular if the collection, processing or use constitute a burden for the data subject disproportionate to the data’s suitability and need for the purpose intended. No examination will be conducted as to whether the legitimate interests of the data subject will be harmed if the collection, processing or use is required by law.
Section 9
Rights of the data subject
With regard to the registration authority, in accordance with this Act the data subject has a right to the following free of charge:
1. information pursuant to Section 10,
2. correction and completion pursuant to Section 12,
3. deletion pursuant to Sections 14 and 15,
4. notification pursuant to Section 45 (2),
5. blocks on transfer pursuant to Section 36 (2), Section 42 (3), second sentence, and Section 50 (5), as well as blocks on releasing information pursuant to Section 51 and conditional blocks on releasing information pursuant to Section 52,
6. declarations pursuant to Section 44 (3), second sentence.
Rights of the data subject pursuant to other provisions shall remain unaffected.
Section 10
The data subject’s right to information
(1) The registration authority shall provide the data subject the following information on request:
1. stored data and remarks concerning the data subject and their source,
2. the recipients of regularly occurring data transfers and the type of data to be transferred, and
3. the purposes and legal basis for storing and regularly transferring data.
In the case of data transferred through automated retrieval or automated provision of information from the population register pursuant to Section 49 (1), the data subject shall be informed on request in the individual case of the type of data transferred and the recipients. This shall not apply if the body retrieving the data is one of the authorities listed in Section 34 (4), first sentence. The information pursuant to the second sentence shall be provided to the data subject only within the retention period for logging data pursuant to Section 40 (4).
(2) The information may also be provided electronically through data transfer via the Internet. In this case, it is necessary to ensure that state-of-the-art measures also for encryption and authentication are taken to ensure data protection and data security, in particular with regard to the confidentiality and integrity of the data stored in the population register and sent to the data subject.
(3) The identity of the person requesting the information shall be checked using the electronic identification function pursuant to Section 18 of the Act on Identity Cards or using an identity confirmation service pursuant to Section 6 (1) of the De-Mail Act of 28 April 2011 (Federal Law Gazette I p. 666) in the applicable version in conjunction with secure log-in pursuant to Section 4 (1) of the De-Mail Act. Alternatively, the identity of the person requesting the information may be checked using a qualified electronic signature.
Section 11
Restrictions on information
(1) Information pursuant to Section 10 shall not be provided if
1. it would endanger the proper performance of tasks for which the registration authority is responsible,
2. would threaten the public security or order or otherwise be detrimental to the welfare of the Federation or a Land,
3. would jeopardize criminal investigations, or
4. the data or the fact of their recording, in particular due to the overriding legitimate interests of a third party, must be kept secret by law or due to the nature of the data
and therefore the data subject’s interest in receiving the information must not take precedence.
(2) Nor shall information be provided
1. if the data subject shall not be permitted access to a civil status register pursuant to Section 63 (1) and (3) of the Civil Status Act,
2. in the cases of Section 1758 of the Civil Code, or
3. with regard to data concerning the legal representative, spouse, registered partner or minor children, if for these persons a block on releasing information pursuant to Section 51 or a conditional block on releasing information pursuant to Section 52 has been entered.
(3) Information about the source of data shall be permitted only with the consent of the body providing the data, if the data were provided to the registration authority by
1. the police forces of the Federation and the Länder,
2. public prosecutors,
3. public prosecutors at local courts,
4. the domestic intelligence agencies of the Federation and the Länder,
5. the Federal Intelligence Service,
6. the Military Counterintelligence Service,
7. the Customs Investigations Service,
8. the main customs offices or
9. the tax authorities where they perform law enforcement tasks.
The same applies to information about the recipient of the data if they are transferred to the authorities listed in the first sentence. Consent may be refused only on the conditions described in subsections 1 and 2.
(4) No reasons for refusing to provide information shall be given if providing the reasons in law and in fact on which the decision is based would undermine the intended purpose of refusing to provide the information. In this case, the data subject shall be referred to the body responsible for overseeing compliance with data protection law at the registration authority. The notification from this body to the data subject shall not permit any conclusions to be drawn concerning the information held by the controller unless the latter agrees to the provision of more extensive information.
(5) If no information is provided to the data subject, at his or her request the information shall be provided to the body referred to in subsection 4, second sentence. If the responsible supreme Land authority determines in the individual case that this would threaten the security of the Federation or of a Land, the Land data protection commissioner shall be informed in person.
Section 12
Correction and completion of data
If stored data are inaccurate or incomplete, the registration authority shall correct or complete the data at the request of the data subject. Section 6 ( 1), second sentence, shall apply accordingly.
Section 13
Data storage
(1) After a resident has died or moved away, the registration authority shall continue to store the data listed in Section 3 (1) nos. 1 to 10, 12 to 16, 18 and 19 to carry out its tasks. In these cases, it may also store the data pursuant to Section 3 (2) nos. 1 and 2 in the population register. If a resident moves away, the registration authority shall also store the fact pursuant to Section 3 (2) no. 5.
(2) Five years after the end of the calendar year in which the resident died or moved away, the data referred to in subsection 1 shall be retained for 50 years and secured using technical and organizational measures. During this time, the data shall no longer be processed or used. This shall not apply to the surname and given names, previous names, date and place of birth including country, if other than Germany; current and previous addresses; date moved out, date and place of death including country for persons who died abroad. The second sentence shall not apply if
1. the data subject has provided written consent to processing and using the data, or
2. it is essential to process or use the data
a) for scientific purposes,
b) to remedy a need for evidence,
c) to carry out the tasks of the authorities referred to in Section 34 (4), first sentence,
d) for voting purposes pursuant to Section 3 (2) no. 1,
e) to carry out the procedure under nationality law pursuant to Section 3 (2) no. 5 of this Act and to Section 29 (6) and Section 30 of the Nationality Act.
Section 14
Deletion of data
(1) The registration authority shall delete data if they are no longer needed for its tasks. The same shall apply if the data were stored unlawfully.
(2) Data referred to in Section 3 (2) no. 6 shall be deleted immediately after their transfer to tracing services. Data referred to in Section 3 (1) no. 11 and subsection 2 no. 2 shall be deleted at the end of the calendar year after the year in which the resident died or moved away. Other data of residents who have died or moved away which are not retained pursuant to Section 13 (1) shall be deleted 30 days after the resident has moved away and the response has been evaluated, or after the resident’s death.
(3) If deleting the data would be impossible or would involve a disproportionate effort due to the specific mode of storage in the population register, the data shall be blocked.
(4) The registration authority shall delete data stored pursuant to Section 3 (1) no. 17a as soon as the length of validity has been exceeded by more than three months.
Section 15
Storage and deletion of remarks
Sections 13 and 14 shall apply accordingly to remarks stored to establish the accuracy of the relevant data.
Section 16
Offering data to archives
(1) After the retention period referred to in Section 13 (2), first sentence has expired, before deleting them the registration authority shall offer to turn over the data and remarks stored to verify their accuracy to the archives designated by Land law in accordance with the relevant provisions of archival law.
(2) Within the retention period referred to in Section 13 (2), first sentence, the registration authority may offer to turn over the data and remarks to the archives designated by Land law, as far as the performance of the registration authority’s tasks pursuant to Section 13 (2), second and third sentences, continues to be ensured. Until this period has expired, the archive may process and use the data and remarks turned over to it only in accordance with Section 13 (2), second to fourth sentences.
Leave a Reply