office.
(4) The sender and recipient of the communication shall be notified at the latest after the harmful software
or the threat arising from it has been recognized and averted if the sender and recipient are known or can
be identified without unreasonable investigative efforts, and if notifying them would not conflict with
overriding interests of third parties. Notification shall not be necessary if the person to be notified was not
significantly affected and it can be assumed that he/she has no interest in being notified. The Federal
Office shall present for inspection those cases in which no notification was made to its data protection
official and to another Federal Office employee who is qualified to hold judicial office. The data protection
official of the Federal Office shall not be bound by any instructions in carrying out this work and may not
be discriminated against as a result of performing this work (Section 4f (3) of the Federal Data Protection
Act). If the Federal Office's data protection official disagrees with the decision of the Federal Office, the
notification shall be made after the fact. The decision not to notify shall be documented. The
documentation may be used solely for purposes of data protection monitoring. It shall be destroyed after
12 months. In the cases of subsections 5 and 6, notification shall be made by the authorities referred to in
those subsections in accordance with the provisions applicable to these authorities. If these provisions do
not cover notification requirements, the provisions of the Code of Criminal Procedure shall be applied
accordingly.
(5) The Federal Office may transmit the personal data used in accordance with subsection 3 to the law
enforcement authorities for the purpose of prosecuting a criminal offence committed using harmful
software under Sections 202a, 202b, 303a or 303b of the Criminal Code. Further, the Federal Office may
transmit such data
1. to the federal and Länder police in order to prevent an immediate threat to public security arising from
harmful software,
2. to the Federal Office for the Protection of the Constitution to inform it of evidence indicating
intelligence activities or other activities on behalf of a foreign power which constitute a security threat.
(6) In other cases, the Federal Office may transmit such data
1. to the law enforcement authorities for the purpose of prosecuting a serious criminal offence, even in a
single instance, especially an offence listed in Section 100a (2) of the Code of Criminal Procedure,
2. to the federal and Länder police to avert a threat to the existence or security of the state, or to the life,
limb, or liberty of an individual, or to property of substantial value, the preservation of which is in the
public interest,
3. to the federal and Länder offices for the protection of the Constitution, when there are concrete
indications of activities within the Federal Republic of Germany directed against the protected interests
listed in Section 3 (1) of the Act Regulating the Cooperation between the Federation and the Federal
States in Matters Relating to the Protection of the Constitution and on the Federal Office for the
Protection of the Constitution by means of violence or preparing to use violence.
Transmission of data in accordance with the first sentence nos. 1 and 2 shall require prior judicial
approval. For the procedure under the first sentence nos. 1 and 2, the provisions of the Act on
6/10