Subject Matter and Scope (EVEDS)

1. This Regulation governs the implementation of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purpose of preventing, investigating, detecting or prosecuting criminal offenses or executing criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA.

2. It applies to authorities responsible for the processing of personal data for the purpose of preventing, investigating, detecting or prosecuting criminal offenses or executing criminal penalties, including the protection against and prevention of threats to public security (Article 1, Paragraph 1 of Directive (EU) 2016/680).

1. Profiling is the assessment of certain characteristics of an individual based on automated processing of personal data, particularly to analyze or predict work performance, economic circumstances, health, behavior, preferences, location, or mobility.

2. It is permissible under the conditions set forth in Article 5 of the Data Protection Act of February 19, 1986 (KDSG)[3].

3. If it results in a serious infringement of the fundamental rights of the affected individual, it is permissible under the conditions set forth in Article 6 KDSG.

4. The provisions of Articles 10 to 14a KDSG regarding the disclosure of personal data also apply to the results of profiling, insofar as they contain personal data.

1. The responsible authority must be able to demonstrate that it complies with the data protection provisions of Article 4 paragraphs 1 to 3 of the EU Directive 2016/680.

1. **The Responsible Authority Informs the Affected Person about Any Data Acquisition.** This obligation to provide information also applies if the data is acquired from third parties.

2. **The information shall particularly include details on**

a) the responsible authority along with contact details,

b) the processed data or categories of processed data,

c) the legal basis and purpose of the processing,

d) the data recipients or categories of data recipients, in case the data is disclosed to third parties, and

e) the rights of the affected person.

3. **The information is provided**

a) through appropriate entries in the publicly accessible register of data collections in accordance with Article 18 KDSG,

b) on the website of the responsible authority, or

c) by notification to the affected person.

1. The information may be waived if

a) the data subject already possesses the information pursuant to Article 4, Paragraph 2,

b) the processing of personal data is explicitly provided by law, or

c) providing the information is impossible or only possible with disproportionate effort.

2. The transmission of the information may also be restricted under the same conditions as access to one's personal data.

1. The responsible authority shall inform the authorities or private individuals to whom it had disclosed personal data (Art. 10 to 14a KDSG) if data have been corrected or destroyed pursuant to Articles 23 or 24 KDSG.

2. The notification may be omitted if it is not possible or would involve disproportionate effort.

1. Any person who processes personal data on behalf of an authority within the meaning of Article 16 KDSG (data processors) may not transfer the data processing to another data processor without the prior written consent of the authority.

**Article 1: Notification of Data Protection Breach**

The responsible authority shall report a data protection breach to the competent data protection supervisory authority (supervisory authority) without delay, that is, preferably within 72 hours. The report shall consist of a description of the breach and its impacts, as well as the measures taken and planned to restore protection or to mitigate the consequences of the breach.

A data protection breach occurs when data security is compromised, resulting in personal data being irretrievably destroyed or lost, unintentionally or unlawfully altered or disclosed, or when unauthorized individuals gain access to such personal data.

There is no obligation to report if the data protection breach is unlikely to result in a risk to the fundamental rights of the affected person.

1. The responsible authority shall inform the affected individuals if circumstances require or if the supervisory body demands it. Notification shall particularly be made if the affected individuals can take measures to prevent the damage.

2. Notification may be omitted if

a. the responsible authority has implemented technical and organizational security measures that, in the specific case, have prevented damage from occurring to the affected individual,

b. it can be ensured through subsequent measures that there is likely to be no longer a high risk to the fundamental rights of the affected individuals, or

c. it would involve disproportionate effort; in this case, notification shall be made through a public announcement.

3. The notification of the affected individuals can also be restricted or postponed wholly or partially if public or private confidentiality interests prevail.

1. Any person who processes personal data on behalf of a public authority shall promptly inform the contracting authority of any data protection breach. Article 8 paragraph 1 sentence 2 and paragraph 2 apply mutatis mutandis.

1. Non-profit organizations that, according to their statutes, deal with data protection concerns, are authorized to represent parties in legal proceedings.

1. The supervisory authority shall inform the affected persons of the results or the status of the investigations within no more than three months from the receipt of a supervisory notification.

This regulation shall enter into force on September 1, 2018, and shall remain in effect until August 31, 2026.