Exceptions to the informing requirements
Data stored in analog form
Informing requirements do not apply where further processing of data concerns data in analogue form and: (1) the controller directly contacts the data subject through the further processing (e.g., by mail), (2) the purpose of the further processing is compatible with the original purpose, (3) the communication with the data subject does not take place in digital form and (4) the interest of the data subject in receiving the information can be regarded as minimal.
Exceptions for public bodies
… when informing data subjects about the processing would endanger the proper performance of tasks related to
national security, defence, public security, criminal offences and penalties, threats to public security or other important objectives of general public interest of the EU or Germany (in particular an important economic or financial interest, including monetary, budgetary and taxation matters, public health and social security). Moreover, the informing requirements are not applicable where they would endanger a confidential transfer of data to public bodies.
Public security
The informing obligations also do not apply if its provision would endanger public security or would be otherwise detrimental to the welfare of Germany, and if the controllers’ interests in not providing the information outweigh the interests of the data subjects.
Legal claims
Where informing data subjects would interfere with the establishment, exercise or defence of legal claims, data controllers are not obliged to provide the information required by Art. 13 and 14 GDPR.
Further exceptions
The informing obligations also do not apply in the following situations:
- video surveillance of public areas (Sec. 4 (2) and (4) BDSG)
- customer loans (Sec. 30 (1) BDSG)
- scoring and credit assessments (Sec. 31 (1) 4. BDSG)
in the context of an attorney-client relationship, the data of third persons are transferred to a lawyer–unless the data subject has an overriding interest in being informed (Sec. 29 (2) BDSG).
