Data subjects’ rights under German data protection law

Scientific/historical research, statistics

Sec. 27 (2) BDSG regulates data processing for purposes of scientific or historical research and for statistical purposes. Accordingly, the rights of the data subject provided in Art. 15 (access), 16 (rectification), 18 (restriction of processing) and 21 (objection) GDPR shall be limited to the extent that these rights are likely to render impossible or seriously impair the achievement of the research or statistical purposes, and such limits are necessary for the fulfilment of the research or statistical purposes. The right to access according to Art. 15 GDPR shall not apply if the data is necessary for purposes of scientific research and the provision of information would involve disproportionate effort.

Archiving in the public interest

In accordance with Sec. 28 BDSG, the right of the data subject of access (Art. 15 GDPR) shall not apply if the archival material is not identified with the person´s name or no information is given which would enable the archival material to be found with reasonable administrative effort. Further, the right of rectification, according to Art. 16 GDPR, shall not apply, if the personal data is processed for archiving purposes in the public interest. However, if the data subject disputes the accuracy of the personal data, the data subject has the opportunity to present his/her version. The right to restrict the processing and the right to data portability shall not apply as far as these rights are likely to render impossible or seriously impair the achievement of the archiving purposes in the public interest.

Secrecy obligations

Sec. 29 BDSG regulates rights of the data subject in case of secrecy obligations. Accordingly, no right to access applies, where an information must be kept secret, in particular because of overriding legitimate interests of a third party.

Right of erasure

If, in a non-automated data processing, the erasure of the personal data is not possible or only possible with a disproportionate effort, the data subject has only the right of restriction of processing instead of the right of erasure (Sec. 35 BDSG).