Service provided by the Federal Ministry of Justice and the Federal Office of Justice ‒ www.gesetze-im-internet.de processing. If necessary in the individual case or on request, the data subject shall also be informed of the consequences of withholding consent. (5) If special categories of personal data are to be processed, the consent must explicitly refer to these data. Section 52 Processing on instructions from the controller Any person acting under the authority of the controller or of the processor who has access to personal data shall not process those data except on instructions from the controller, unless required to do so by law. Section 53 Confidentiality Persons employed in data processing shall not process personal data without authorization (confidentiality). They shall be obligated when taking up their duties to maintain confidentiality. The obligation of confidentiality shall continue after their employment ends. Section 54 Automated individual decision (1) A decision based solely on automated processing which produces an adverse legal effec t concerning the data subject or significantly affects him or her shall be permitted only when authorized by law. (2) Decisions referred to in subsection 1 shall not be based on special categories of personal data unless suitable measures to safeguard the data subject's legally protected and legitimate interests are in place. (3) Profiling that results in discrimination against natural persons on the basis of special categories of personal data shall be prohibited. Chapter 3 Rights of the data subject Section 55 General information on data processing The controller shall provide general and publicly accessible information on 1. the purposes of the processing, 2. the rights of data subjects with regard to the processing of their personal data to access, rectification, erasure and restriction of processing, 3. the names and contact details of the controller and the data protection officer, 4. the right to lodge a complaint with the Federal Commissioner, and 5. the contact details of the Federal Commissioner. Section 56 Notification of data subjects (1) If special legislation provides for or requires notifying data subjects of the processing of their personal data, especially in the case of undercover operations, such notification shall include at least the following information: 1. the information listed in Section 55; 2. the legal basis for the processing; 3. the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period; 4. the categories of recipients of the personal data, if any; Page 28 of 43