Service provided by the Federal Ministry of Justice and the Federal Office of Justice ‒ www.gesetze-im-internet.de the request. In the case of subsection 3, he or she shall provide reasons for refusing to comply with the request. (5) The Federal Commissioner shall, as a rule, supply the information requested by the other state’s supervisory authority by electronic means and using a standardized format. (6) The Federal Commissioner shall not charge a fee for action taken pursuant to a request for mutual assistance unless he or she has agreed with the other state’s supervisory authority in the individual case on the reimbursement of expenses incurred. (7) The Federal Commissioner’s requests for assistance shall contain all the necessary information, including in particular the purpose of and reasons for the request. Information exchanged shall be used only for the purpose for which it was requested. Chapter 7 Liability and penalties Section 83 Compensation (1) If a controller has caused a data subject to suffer damage by processing personal data in violation of this Act or other law applicable to this processing, the controller or its legal entity shall be obligated to provide compensation to the data subject. This obligation to provide compensation shall not apply if, in the case of non-automated processing, the damage was not the result of fault by the controller. (2) The data subject may request appropriate financial compensation for non-material damage. (3) If, in the case of automated processing of personal data, it is not possible to determine which of several controllers caused the damage, each controller or its legal entity shall be liable. (4) Section 254 of the Civil Code shall apply to contributory negligence on the part of the data subject. (5) The limitation provisions stipulated for tortious acts in the Civil Code shall apply accordingly with regard to statutory limitation. Section 84 Penal provisions Section 42 shall apply accordingly to the processing of personal dat a by public bodies in the context of activities pursuant to Section 45, first, third or fourth sentences. Part 4 Special provisions for processing in the context of activities outside the scope of Regulation (EU) 2016/679 and Directive (EU) 2016/680 Section 85 Processing of personal data in the context of activities outside the scope of Regulation (EU) 2016/679 and Directive (EU) 2016/680 (1) The transfer of personal data to a third country, to supranational or intergovernmental bodies or to international organizations in the context of activities outside the scope of Regulation (EU) 2016/679 and Directive (EU) 2016/680 shall be permitted in addition to the cases permitted under Regulation (EU) 2016/679 also if the processing is necessary to perform tasks for urgent reasons of defence or to fulfil supra- or intergovernmental obligations of a public body of the Federation in the field of crisis management or conflict pre-vention or for humanitarian measures. The recipient shall be instructed that the transferred data may be used only for the purpose for which they were transferred. (2) Section 16 (4) shall not apply to processing in the context of activities outside the scope of Regulation (EU) 2016/679 and Directive (EU) 2016/680 by workplaces within the remit of the Federal Ministry of Defence if the Federal Ministry of Defence determines in the individual case that meeting the obligations referred to in that provision would endanger the security of the Federation. Page 42 of 43