It depends on whether the police are requesting personal data from you or demanding data under a legal regulation.
Police request data
The police may ask you to provide data about your customers, employees or students, for example. The basic principle is that you are not obliged to provide data if the police ask for it. The General Data Protection Regulation (AVG) applies to the data of your customers, employees or students. Are the police asking for data? If so, assess whether you are allowed to do so under the AVG.
Police requisition data
The police can requisition personal data from you. This is different from requesting data. The police may only demand data in situations listed in the Code of Criminal Procedure. For example, to solve certain types of crimes. If the police demand data, you are obliged to cooperate. In this situation, a number of requirements from the AVG are waived. For example, you do not have to judge whether the provision of data is compatible with the purposes for which you collected it.
Duty to inform after asking
Do you provide information requested by the police about certain people? Then you must usually inform these people about it. Even if the police ask you not to. You do not have to inform those involved if, for example, this is necessary to prevent, detect and prosecute criminal offenses. This is one of the exceptions to the information obligation mentioned in Articles 13 and 14 of the AVG. You must assess for each situation whether such an exception applies.
Duty of disclosure after requisition
Do you provide information after the police had requisitioned it? Then there are a number of situations in which the law stipulates that you have a duty of confidentiality. This means that you may not let those involved know that you have passed on their data to the police.
Does no duty of confidentiality apply? Then you must usually inform the data subjects that you have provided their data. You do not have to inform the data subjects if, for example, this is necessary to prevent, detect and prosecute criminal offenses. This is one of the exceptions to the information obligation mentioned in Articles 13 and 14 of the AVG. You must assess for each situation whether such an exception applies.
Right of access
People whose personal data you process may ask you for access to their data. Among other things, you must then let them know to whom you have provided someone's data. It is therefore wise to do this in writing when you provide data to the police. And record in your own records which data you have provided to the police.
Note: Is there a statutory duty of confidentiality? Then you may not let people who request access know that you have provided their data to the police. Even if you believe that Articles 13 and 14 of the AVG apply, you do not have to let the data subject know about the disclosure.
