Sec. 42 BDS foresees a punishment with imprisonment of up to three years or a fine for transferring data to a third party or otherwise making the data accessible. Moreover, imprisonment of up to two years or a fine may be imposed for processing data without authorization or fraudulently acquiring data and doing so in return for payment or with the intention of enriching oneself or someone else or harming someone.
For imposition of administrative fines, the German Act on Regulatory Offenses apply.
Public bodies are not subject to penalties.