Citizens' offices: Data protection information

In the Federal Republic of Germany, every German over the age of 16 must have either an identity card or a passport (§§ 1 ff. PAuswG). In addition, every time you cross the border, you must carry a valid identity document that complies with the relevant entry regulations (§ 1 PassG). Your data is required in order to issue you with an identity document. The legal basis is derived from the Passport Act (PassG), the Act on Identity Cards and Electronic Proof of Identity (PAuswG), the Ordinance on the Implementation of the Passport Act (PassV), the Ordinance on Identity Cards and Electronic Proof of Identity (PAuswV) and the General Administrative Regulation on the Implementation of the Passport Act (Passverwaltungsvorschrift - PassVwV). The data is processed on the basis of Art. 6 para. 1 sentence 1 letter c), e) GDPR in conjunction with §§ 22 ff. PassG and §§ 14 ff. of the PAuswG.

The personal data will only be processed in the procedure for which it was collected, unless there is a legal exception or obligation to transfer data.

Personal data will be transmitted to Bundesdruckerei GmbH in accordance with Sections 6a PassG and 12 PAuswG and to the blocking list operator and the IT processor (ITEOS, Anstalt des öffentlichen Rechts, Krailenshaldenstraße 44, 70469 Stuttgart) in accordance with Section 10 (5) PAuswG. In addition, data may be transmitted to domestic and foreign authorities responsible for the prosecution of criminal offenses, for the enforcement or execution of penalties, for the prosecution of administrative offenses and the enforcement of fines and their ancillary consequences, for administrative measures or for traffic and border controls.

In the context of appeal/complaint proceedings, the data may also be transmitted to the Stuttgart Regional Council, the Stuttgart Administrative Court or the Stuttgart Local Court or Regional Court as well as authorized parties to the proceedings in accordance with the statutory provisions.

Administrative activities under public law require recording and documentation so that the origin, workflow and current processing status of a process can be viewed at any time and as required. This obligation is derived from the principle of the rule of law. In this respect, all official records, including municipal records, are subject to a retention obligation.

Personal data is stored in accordance with the statutory regulations.

The personal data recorded in the passport and ID card registers must be stored in accordance with the statutory regulations (§§ 21 PassG, 23 PAuswG). They are stored at least until a new ID document is issued, but for a maximum of 5 years after the existing ID document expires. The fingerprints that are mandatory or optional for the purpose of issuing ID documents must be deleted at the latest after the ID document has been issued (§§ 16 PassG, 26 PAuswG). This data is also not stored by Bundesdruckerei GmbH

You are obliged to provide your data when applying for and issuing identity documents. This obligation arises from §§ 6 ff. PassG and 9 ff. PAuswG. If you provide incomplete or incorrect information that you are obliged to provide, this can be punished as an administrative offense.

The Office of Public Order is not responsible for the electronic functions of passports and ID cards as a passport and ID card authority. Information on this can be found on the website of the Federal Ministry of the Interior.

Anyone who moves into an apartment is generally obliged to register with the registration authority within two weeks of moving in (§ 17 Paragraph 1 of the Federal Registration Act - BMG) and to provide the information required for the proper maintenance of the registration register (§ 25 Number 1 BMG). Anyone who moves out of an apartment and does not move into a new apartment in Germany must deregister within two weeks of moving out (§ 17 Paragraph 2 BMG) and provide the information required for the proper maintenance of the registration register (§ 25 Number 1 BMG).

Pursuant to Section 2 (1) BMG, the registration authority must register personal data about the persons (residents) living in its area of responsibility in order to establish and verify their identity and residences. The personal data stored in the population registers is used by the registration authority to meet the legitimate information requirements of both public bodies and non-public bodies and private individuals in accordance with the provisions on information from the population register (Sections 44 et seq. BMG) and data transfers (Sections 33 et seq. BMG) and to assist in the performance of tasks by other public bodies (Section 2 (3) BMG).

On certain occasions, data is regularly transmitted (Sections 36, 43 BMG; 1st and 2nd Federal Registration Data Transmission Ordinance) to other public bodies and, in accordance with Section 42 BMG, to religious organizations under public law. Additional data transfers, including regular data transfers, are carried out in accordance with federal or state law, in which the respective underlying reasons and purposes of the data transfer, the recipients and the data to be transferred are specified.

The registration authority may transfer data from the register of residents to other public bodies in Germany (see Section 2 of the Federal Data Protection Act) and public religious organizations, or pass on data within the administrative unit (municipality), insofar as this is necessary to fulfill its own tasks or those of the recipient.

Data transfers are permitted in the following cases in particular:

• Private individuals and non-public bodies receive, upon request, information on individual personal data subject to a fee, provided that the person concerned can be clearly identified by the registration authority on the basis of the information provided by the applicant. Upon request, private individuals and non-public bodies can be provided with information about a large number of unidentified persons regarding their membership of a group (e.g. a specific year of birth) and certain personal data if a public interest can be established. Foreign bodies outside the European Union are treated in the same way as non-public bodies.
• Parties, voter groups and other supporters of election proposals may receive registration data in connection with elections and votes at state and municipal level.
• Elected representatives as well as the press and radio may receive the data directly related to this special purpose in the case of anniversaries.
• For the purpose of publication in printed address books, address book publishers may only receive individual, exhaustively listed data of all residents of legal age from the registration authority.
• The state broadcasters receive the data they need to collect the broadcasting fee. In accordance with § 8 Para. 1 of the Interstate Broadcasting Contribution Treaty, every resident is obliged to notify the responsible state broadcasting organization of their residence without delay. In principle, the broadcasting fee must be paid for each independent residential unit. In addition to the obligation to notify, registration authorities are permitted to transmit data to the state broadcasting organizations in accordance with Section 36 (1) of the Federal Registration Act (BMG) in conjunction with Section 13 MVO or Section 11 (5) of the Interstate Broadcasting Contribution Treaty. In accordance with § 13 Para. 1 MVO, the registration authority transmits to SWR or a body commissioned by it, among other things, the surname, first name, date of birth and current and previous addresses for the collection of broadcasting fees in the event of registration, deregistration or death.
  
  

  The transmission cannot be objected to.

  The legality of data transmission for the collection of the broadcasting fee has been confirmed by the data protection officers of the federal and state governments and by case law.

• The apartment owner/landlord is entitled to information about the residents registered in his apartment, provided he can credibly demonstrate a legal interest. In addition, they can check with the registration authority to ensure that the person whose move-in they have confirmed has registered with the registration authority.
• Data may be transferred to public bodies in other member states of the European Union and the European Economic Area (EEA) as well as to institutions and bodies of the European Union in the context of activities that fall wholly or partly within the scope of European Union law, insofar as this is necessary for the performance of public tasks for which the registration authority or the recipient is responsible. A prerequisite for the transfer within the EEA is that the EEA states adopt the content of the General Data Protection Regulation.

After the resident's departure or death, the registration authority must immediately delete all data that is not used to establish identity and proof of residence and is not required for electoral and income tax purposes or to carry out citizenship procedures. After five years have elapsed since the resident's departure or death, the data stored to fulfil the tasks of the registration authorities will be stored for a period of 50 years and secured by technical and organizational measures. During this period, the data may no longer be processed with the exception of the surname and first names as well as previous names, the date of birth, the place of birth and, in the case of birth abroad, also the country, the current and previous addresses, the date of departure as well as the date of death, the place of death and, in the case of death abroad, also the country. The prohibition of processing does not apply to the cases specified in Section 13 (2) sentence 3 BMG. Shorter deletion periods apply to certain data in accordance with Section 14 (2) BMG.

In addition to your rights as a data subject under the General Data Protection Regulation, you have the option under registration law to object to the transfer of data for certain purposes.

• Objection to the transfer of data to a religious organization under public law to which the person subject to the registration obligation does not belong, but to which family members of the person subject to the registration obligation belong pursuant to Section 42 para. 3 sentence 2 BMG in conjunction with Section 42 para. 2 BMG
• Objection to the transmission of data to parties, voter groups, etc. in elections and votes pursuant to Section 50 (5) BMG in conjunction with Section 50 (1) BMG
• Objection to the transmission of data on the occasion of anniversaries to elected officials, the press or radio in accordance with Section 50 (5) BMG in conjunction with Section 50 (2) BMG
• Objection to the transfer of data to address book publishers in accordance with Section 50 (5) BMG in conjunction with Section 50 (3) BMG
• Objection to the transfer of data to the Federal Office of Bundeswehr Personnel Management in accordance with Section 36 (2) sentence 1 BMG in conjunction with Section 58 c (1) sentence 1 of the Soldiers Act (only for persons who have German citizenship and have not yet reached the age of 18)

Anyone who fails to submit collection notifications, submits them incorrectly or late, fails to deregister or deregisters late or violates an obligation to cooperate is acting in breach of the regulations and may be fined up to 1,000 euros.

Every person has the following rights in particular under the General Data Protection Regulation (GDPR)

• Right of access to the personal data stored about them and its processing (Art. 15 GDPR)
• Right to data rectification if their data is incorrect or incomplete (Art. 16 GDPR)
• Right to erasure of the personal data stored about you if one of the conditions of Art. 17 GDPR applies.
• The right to erasure of personal data does not exist in addition to the exceptions mentioned in Art. 17 para. 3 GDPR if erasure is not possible or only possible with disproportionate effort due to the special type of storage. In these cases, the restriction of processing pursuant to Art. 18 GDPR takes the place of erasure.
• Right to restriction of data processing if the data has been processed unlawfully, the data is required for the establishment, exercise or defense of legal claims of the data subject or, in the event of an objection, it has not yet been determined whether the interests of the registration authority outweigh those of the data subject (Article 18 (1) (b), (c) and (d) GDPR)
• If the accuracy of the personal data is disputed, there is a right to restriction of processing for the duration of the accuracy check
• Right to object to certain data processing, provided that there is no overriding public interest in the processing that outweighs the interests of the data subject and there is no legal obligation to process (Art. 21 GDPR)

Every data subject has the right to lodge a complaint with the supervisory authority (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg; Postfach 10 29 32, 70025 Stuttgart;  poststellelfdi.bwlde if they believe that their personal data is being processed unlawfully.