Service provided by the Federal Ministry of Justice and the Federal Office of Justice ‒ www.gesetze-im-internet.de 5. where necessary, further information, in particular where the personal data were collected without the knowledge of the data subject. (2) In the cases of subsection 1, the controller may postpone, limit or refrain from notification if and so long as 1. the performance of the tasks listed in Section 45, 2. public security, or 3. the legally protected interests of third parties would otherwise be threatened, if the interest in avoiding these threats overrides the interest of the data subject in the information. (3) If the notification relates to the transfer of personal data to the authorities for the protection of the Constitution, the Federal Intelligence Service, the Military Counterintelligence Service and, as far as the security of the Federation is affected, other authorities of the Federal Ministry of Defence, such notification shall be permitted only with the approval of these bodies. (4) Section 57 (7) shall apply accordingly in case of restriction pursuant to subsection 2. Section 57 Right of access (1) The controller shall inform data subjects on request whether data concerning them are being processed. Data subjects shall also have the right to information about 1. the personal data being processed and the categories to which they belong; 2. the available information on the origin of the data; 3. the purposes of and legal basis for the processing; 4. the recipients or categories of recipients to whom the data have been disclosed, in particular recipients in third countries or international organizations; 5. the period for which the data will be stored, or if that is not possible, the criteria used to determine that period; 6. the existence of the right to rectification or erasure of data or restriction of processing of data by the controller; 7. the right pursuant to Section 60 to lodge a complaint with the Federal Commissioner, and 8. the contact details of the Federal Commissioner. (2) Subsection 1 shall not apply to personal data recorded only because they may not be erased due to legal or statutory provisions on retention, or only for purposes of monitoring data protection or safeguarding data, if providing information would require a disproportionate effort, and appropriate technical and organizational measures make processing for other purposes impossible. (3) No information shall be provided if the data subject does not provide information enabling the data to be located and if the effort required is therefore disproportionate to the data subject’s interest in the information. (4) Subject to the conditions of Section 56 (2), the controller may dispense with the provision of information pursuant to subsection 1, first sentence, or restrict, wholly or partly, the provision of information pursuant to subsection 1, second sentence. (5) If the information to be provided relates to the transfer of personal data to the authorities for the protection of the Constitution, the Federal Intelligence Service, the Military Counterintelligence Service and, as far as the security of the Federation is affected, other Page 29 of 43