Section 37 GwG – Rectification, restriction of processing and deletion of personal data in the case of automated processing and in the case of storage in automated files

(1) The German Financial Intelligence Unit rectifies stored personal data which is inaccurate and which it processes by automated means.
(2) The German Financial Intelligence Unit deletes stored personal data if the storage of this data is impermissible or knowledge of this data is no longer necessary for the performance of its functions.
(3) 1Instead of the data being deleted, the processing of the stored personal data is restricted if

  1. there are indications that deletion would adversely affect legitimate interests of a data subject,
  2. the data is required for ongoing research work, or
  3. deletion is only possible with disproportionate effort because of the special nature of the storage.
    2Data which is subject to a restriction of processing may only be processed for the purpose which prevented its deletion. 3It may also be processed if this is essential for the conduct of ongoing criminal proceedings or the data subject consents to the processing.
    (4) The German Financial Intelligence Unit reviews, when dealing with individual cases and within defined time limits, whether stored personal data must be rectified or deleted or if its processing must be restricted.
    (5) The time limits begin on the day when the German Financial Intelligence Unit completes the operational analysis under section 30.
    (6) 1The German Financial Intelligence Unit takes reasonable steps to ensure that personal data which is inaccurate, incomplete or subject to restriction of processing is not transmitted. 2For this purpose it verifies, where feasible, the quality of the data prior to transmission. 3As far as possible, in all transmissions of personal data, it adds information enabling the recipient to assess the accuracy, completeness and reliability of the personal data.
    (7) If the German Financial Intelligence Unit determines that it has transmitted personal data which is inaccurate, has to be deleted or is subject to restriction of processing, it notifies the data recipient of the rectification, deletion or restriction of processing if notification is necessary to protect legitimate interests of the data subject.