Art. 5 (5a) DGA:

"[...] Re-users shall be prohibited from reidentifying any data subject to whom the data relates and shall take technical and operational measures to prevent reidentification and to notify any data breach resulting in the reidentification of the data subjects concerned to the public sector body. [...]"