Service provided by the Federal Ministry of Justice and the Federal Office of Justice ‒ www.gesetze-im-internet.de Section 43 Provisions on administrative fines (1) Intentionally or negligently engaging in the following shall be deemed an administrative offence: 1. in violation of Section 30 (1) failing to treat a request for information properly, or 2. in violation of Section 30 (2), first sentence, failing to inform a consumer or doing so incorrectly, incompletely or too late. (2) An administrative offence may be punished by a fine of up to fifty thousand euros. (3) Authorities and other public bodies as referred to in Section 2 (1) shall not be subject to any administrative fines. (4) A notification pursuant to Article 33 of Regulation (EU) 2016/679 or a communication pursuant to Article 34 (1) of Regulation (EU) 2016/679 may be used in proceedings pursuant to the Administrative Offences Act against the person required to provide a notification or a communication or relatives as referred to in Section 52 (1) of the Code of Criminal Procedure only with the consent of the person required to provide a notification or a communication. Chapter 6 Legal remedies Section 44 Proceedings against a controller or processor (1) Proceedings against a controller or a processor for a violation of data protection law within the scope of Regulation (EU) 2016/679 or the rights of the data subject contained therein may be brought by a data subject before the court in the place where the controller or processor has an establishment. Proceedings pursuant to the first sentence may also be brought before the court in the place where the data subject has his or her habitual residence. (2) Subsection 1 shall not apply to proceedings against public authorities acting in the exercise of their sovereign powers. (3) If the controller or processor has designated a representative pursuant to Article 27 (1) of Regulation (EU) 2016/679, this representative shall also be an authorized recipient in civil law proceedings pursuant to subsection 1. Section 184 of the Code of Civil Procedure shall remain unaffected. Part 3 Implementing provisions for processing for purposes in accordance with Article 1 (1) of Directive (EU) 2016/680 Chapter 1 Scope, definitions and general principles for processing personal data Section 45 Scope The provisions of this Part shall apply to the processing of personal data by public bodies competent for the prevention, investigation, detection or prosecution of criminal or administrative offences or the execution of criminal or administrative penalties, as far as they process data for the purpose of carrying out these tasks. The public bodies shall be regarded in that case as controllers. The prevention of criminal offences as referred to in the first sentence shall include protection against and prevention of threats to public security. The first and second sentences shall also apply to those public bodies responsible for executing penalties, measures as referred to in Section 11 (1) no. 8 of the Criminal Code, educational or disciplinary measures as referred to in the Juvenile Court Act or fines. As far as this Part contains provisions for processors, it shall also apply to them. Page 24 of 43