Information pursuant to Art. 13 of the General Data Protection Regulation for persons subject to reporting requirements

Anyone moving into a dwelling is generally obliged to register with the registration office within two weeks of moving in (Section 17 (1) of the Federal Registration Act - BMG) and to provide the information required for the proper maintenance of the registration register (Section 25 (1) BMG). Anyone who moves out of a dwelling and does not move into a new dwelling in Germany must deregister within two weeks of moving out (Section 17 (2) BMG) and provide the information required for the proper maintenance of the population register (Section 25 Number 1 BMG). Anyone who fails to submit move-in notifications, or submits them incorrectly or late, or fails to deregister or deregisters late, or violates a duty to cooperate, is acting irregularly and may be fined up to 1,000 euros.

City of Wolfsburg
Citizen Services Division 01-12
Porschestrasse 49
38440 Wolfsburg
E-mail: info-buergerdienste@stadt.wolfsburg.de

City of Wolfsburg
Office for Data Protection and IT Security
Porschestrasse 49
38440 Wolfsburg
E-mail: datenschutz@stadt.wolfsburg.de

According to para.

2 (1) BMG, the registration authority has to register personal data on the persons (residents) residing in its area of responsibility in order to establish and prove their identity and residences. The personal data stored in the population registers are used by the registration authority to meet the legitimate information needs of non-public bodies and private individuals as well as public bodies in accordance with the provisions on information from the population register (Sections 44 ff. BMG) and data transfers (Sections 33 ff. BMG), and to assist in the performance of tasks of other public bodies (Section 2 (3) BMG). On certain occasions, regular data transfers (Sections 36, 43 BMG; 1st and 2nd Federal Reporting Data Transfer Ordinance) are made to other public bodies and, pursuant to Section 42 BMG, to religious societies under public law. Additional data transfers, including regular transfers, are carried out on the basis of federal or state law, which specifies the underlying reasons for and purposes of the data transfer, the recipients and the data to be transferred.

a) The registration authority may transmit data from the population register to other public bodies in Germany (see Section 2 of the Federal Data Protection Act), religious societies under public law and the tracing service, or pass on data within the administrative unit (municipality), insofar as this is necessary for the fulfillment of its own tasks or those of the recipient.

b) Upon request, private individuals and non-public bodies shall receive information, subject to a fee, on individual personal data, provided that the person concerned can be clearly identified by the registration office on the basis of the information provided by the applicant. Upon request, private individuals and non-public bodies can be provided with information about a large number of persons not identified by name, about membership of a group (e.g. a specific birth cohort) and about specific personal data, if a public interest can be established.
Foreign bodies outside the European Union are treated in the same way as non-public bodies.

c) Political parties, voter groups and other election proposal bodies may receive registration data in connection with elections and votes at the state and municipal level.

d) In the case of anniversaries of age and marriage, elected officials, the press and radio may receive data directly related to this special purpose.

e) Address book publishers are only permitted to receive individual, conclusively listed data of all adult residents from the registration office for the purpose of publication in printed address books.

e) The owner/provider of a dwelling has a right to information about the residents registered in his/her dwelling, insofar as he/she can credibly demonstrate a legal interest. In addition, he/she may satisfy himself/herself by enquiring at the registration office that the person whose move-in he/she has confirmed has registered with the registration office.

f) Data may be transferred to public bodies in other member states of the European Union and the European Economic Area (EEA) as well as to institutions and bodies of the European Union or the European Atomic Energy Community within the scope of activities that fall wholly or partly within the scope of European Union law, insofar as this is necessary for the performance of public duties that fall within the competence of the registration authority or within the competence of the recipient. The prerequisite for transfer within the EEA is that the EEA states adopt the content of the General Data Protection Regulation.

After the departure or death of the resident, the registration authorities must immediately delete all data that is not used to establish identity and proof of residence and is not required for election and income tax purposes or to carry out procedures under nationality law. After five years have elapsed since the resident moved away or died, the data stored to fulfill the tasks of the registration authorities are retained for a period of 50 years and secured by technical and organizational measures. During this period, the data may no longer be processed with the exception of the surname and first names and previous names, date of birth, place of birth and, in the case of birth abroad, also the state, current and previous addresses, date of departure and date of death, place of death and, in the case of death abroad, also the state. The ban on processing does not apply to the cases specified in Section 13 (2) sentence 3 BMG. Shorter deletion periods apply to certain data pursuant to Section 14 (2) BMG.

According to the General Data Protection Regulation (GDPR), every person affected by data processing has the following rights in particular:

a) Right to information about the data stored about him or her and how it is processed (Article 15 DS-GVO).

b) Right to have data corrected if their data is incorrect or incomplete (Article 16 DS-GVO).

c) The right to have personal data stored about you deleted if one of the conditions of Article 17 of the GDPR applies.

In addition to the exceptions listed in Article 17(3) of the GDPR, the right to erasure of personal data does not exist if, due to the special nature of the storage, erasure is not possible or is possible only with disproportionate effort. In these cases, erasure is replaced by restriction of processing pursuant to Article 18 of the GDPR.

d) Right to restriction of data processing if the data have been processed unlawfully, the data are needed for the assertion, exercise or defense of legal claims of the data subject or, in the event of an objection, it has not yet been determined whether the interests of the registration authority outweigh those of the data subject (Article 18(1)(b), (c) and (d) DS-GVO).

The transfer of personal data for purposes of advertising or address trading is only permitted if the data subject has consented (Article 6(1)(a) DS-GVO). Consent may be revoked at any time in accordance with Article 7(3) DS-GVO vis-à-vis the entity to which consent was previously given.

Every data subject has the right to lodge a complaint with the supervisory authority
(Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, phone: 49 511 120-4500, e-mail: poststelle@lfd.niedersachsen.de) if they believe that their personal data is being processed unlawfully.