GermanyBDSG Sections 32, 33 and 36, Limits on the Duty to Inform and the Right to Object in Germany
Bundesdatenschutzgesetz (BDSG) §§ 32, 33, 36
In force since .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- You need not give a person in Germany the information General Data Protection Regulation (GDPR) Article 13(3) requires about a further processing of data you collected from them where it concerns analog data, you write to the person directly, the purpose is compatible with the original one, the contact is not digital and their interest in the information is minor in the circumstances, under BDSG Section 32(1) number 1.
- You need not give that Article 13(3) information where, as a public body, giving it would endanger the proper performance of your tasks, or where giving it would endanger public security or order or otherwise harm the Federation or a Land, and in either case your interest in withholding it outweighs the person's, under BDSG Section 32(1) numbers 2 and 3.
- You need not give that Article 13(3) information where giving it would impair the assertion, exercise or defense of legal claims and your interest in withholding it outweighs the person's, or where it would endanger a confidential transmission of data to public bodies, under BDSG Section 32(1) numbers 4 and 5.
- Where you obtained a person's data in Germany from someone else and, as a public body, giving the information GDPR Article 14(1), (2) and (4) requires would endanger the proper performance of your tasks or public security or order, or otherwise harm the Federation or a Land, so that the person's interest in being informed must give way, you need not give it, under BDSG Section 33(1) number 1.
- If you are a private body, you need not give that Article 14 information where giving it would impair the assertion, exercise or defense of civil-law claims, or where the processing contains data from civil-law contracts and serves to prevent damage from crimes, unless the person's legitimate interest in being informed outweighs yours, or where the competent public authority has found that disclosure would endanger public security or order or otherwise harm the Federation or a Land, under BDSG Section 33(1) number 2.
- Where you withhold information under BDSG Section 32(1) or 33(1), take suitable measures to protect the person's legitimate interests, including making the information named in GDPR Article 13(1) and (2), or Article 14(1) and (2), available to the public in precise, transparent, intelligible and easily accessible form in clear and plain language, and write down why you withheld it; for withholding under Section 32(1) numbers 4 and 5 neither duty applies, under BDSG Section 32(2) and Section 33(2).
- Where you withhold information under BDSG Section 32(1) only because of a temporary obstacle, give it within a reasonable time after the obstacle ends, taking into account the specific circumstances of the processing, and within two weeks at the latest, under BDSG Section 32(3).
- If you are a public body, you need not honor an objection under GDPR Article 21(1) where a compelling public interest in the processing outweighs the person's interests or a legal provision obliges you to process the data, under BDSG Section 36.
These lines are LexLint's reading of the law's text.
What it makes you log
What the log must hold
Decision basis
Logging duty
A controller that withholds information under Section 32(1) or Section 33(1) must record in writing why it did so. Section 32(2) lifts that duty for withholding in the legal-claims and confidential-transmission cases of Section 32(1) numbers 4 and 5. The provisions say nothing of who may inspect the record or how long it is kept.
- Kind
- Explicit
- As of
- Provision
- BDSG Section 32, paragraph 2, sentence 2, and Section 33, paragraph 2, sentence 2
- Trigger
- personal_data_processing
What this law does
BDSG Sections 32 and 33 add exceptions to the duty to tell a person about the processing of their data, beyond those in General Data Protection Regulation (GDPR) Articles 13(4) and 14(5).
Under Section 32, a controller that collected the data from the person need not give the Article 13(3) information about a further processing of analog data where it writes to the person directly, the purpose is compatible, the contact is not digital and the person's interest is minor, and in four other cases: a public body whose tasks would be endangered, a danger to public security, harm to legal claims, and a danger to a confidential transmission of data to public bodies.
Under Section 33, where the data came from someone else, a public body need not give the Article 14 information if it would endanger its tasks or public security and the person's interest must give way.
A private body need not give it if it would impair the assertion, exercise or defense of civil-law claims, or if the data come from civil-law contracts and serve to prevent damage from crimes, unless the person's legitimate interest in being informed outweighs, or where the competent public authority has found that disclosure would endanger public security.
Where it withholds information, the controller must take suitable measures to protect the person's legitimate interests, including making the Article 13 or 14 information available to the public in plain language, and must record in writing why it withheld the information. Section 32 lifts both duties for the legal-claims and confidential-transmission cases.
A controller that withholds information only because of a temporary obstacle must give it within a reasonable time after the obstacle ends, and within two weeks at the latest. Section 36 removes the right to object under Article 21(1) against a public body where a compelling public interest in the processing outweighs the person's interests or a law obliges the processing.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .