Part 1
Teil 2
Sub-chapter 1
- § 22Processing of special categories of personal data
- § 23Processing for other purposes by public bodies
- § 24Processing for other purposes by private bodies
- § 25Transfer of data by public bodies
- § 26Data processing for employment-related purposes
- § 27Data processing for purposes of scientific or historical research and for statistical purposes
- § 28Data processing for archiving purposes in the public interest
- § 29Rights of the data subject and powers of the supervisory authorities in the case of secrecy obligations
- § 30Consumer loans
- § 31Protection of commercial transactions in the case of scoring and credit reports
Sub-Chapter 2
- § 32Information to be provided where personal data are collected from the data subject
- § 33Information to be provided where personal data have not been obtained from the data subject
- § 34Right of access by the data subject
- § 35Right to erasure
- § 36Right to object
- § 37Automated individual decision-making, including profiling
Teil 3
- § 55General information on data processing
- § 56Notification of data subjects
- § 57Right of access
- § 58Right to rectification and erasure and to restriction of processing
- § 59Modalities for exercising the rights of the data subject
- § 60Right to lodge a complaint with the Federal Commissioner
- § 61Legal remedies against decisions of the Federal Commissioner or if he or she fails to take action
- § 62Processing carried out on behalf of a controller
- § 63Joint controllers
- § 64Requirements for the security of data processing
- § 65Notifying the Federal Commissioner of a personal data breach
- § 66Notifying data subjects affected by a personal data breach
- § 67Conducting a data protection impact assessment
- § 68Cooperation with the Federal Commissioner
- § 69Prior consultation of the Federal Commissioner
- § 70Records of processing activities
- § 71Data protection by design and by default
- § 72Distinction between different categories of data subjects
- § 73Distinction between facts and personal assessments
- § 74Procedures for data transfers
- § 75Rectification and erasure of personal data and restriction of processing
- § 76Logging
- § 77Confidential reporting of violations
Teil 4
FDPA Part 3 - § 66
Notifying data subjects affected by a personal data breach
- If a personal data breach is likely to result in a substantial risk to the legally protected interests of natural persons, the controller shall notify the data subject of the personal data breach without delay.
- The notification of the data subject pursuant to subsection 1 shall describe in clear and plain language the nature of the personal data breach and contain at least the information and measures referred to in Section 65 (3) nos. 2 to 4.
- Notification shall not be required if any of the following conditions are met:
- the controller has implemented appropriate technical and organizational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorized to access them, such as encryption;
- the controller has taken subsequent measures which ensure that the substantial risk referred to in subsection 1 is no longer likely to exist;
- it would involve a disproportionate effort; in this case, a public communication shall be made or a similar measure taken to inform the data subjects in an equally effective manner.
- If the controller has not informed the data subjects of a personal data breach, the Federal Commissioner may formally determine that, in his or her opinion, the conditions referred to in subsection 3 have not been met. In doing so, the Federal Commissioner shall consider the likelihood of the personal data breach resulting in a high risk as referred to in subsection 1.
- The notification of data subjects pursuant to subsection 1 may be delayed, restricted or omitted under the conditions referred to in Section 56 (2) unless the interests of the data subjects outweigh those of the controller owing to the high risk resulting from the personal data breach as referred to in subsection 1.
- Section 42 (4) shall apply accordingly.
Quelle: Bundesamt für Justiz
