These documents constitute personal data and - in principle - you, as the subject, have the right to get a copy of them by issuing a "subject access request".
The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form. (Art. 15 (3) GDPR)
GDPR applies to controllers of any kind, including government organisations.
The subject access request can usually be a simple email. The ICO has a template for this: https://ico.org.uk/your-data-matters/your-right-of-access/ (but keep it simple, you can literally just ask for "all personal data" they have on you; no need to speculate on what kind of data they may have).
The subject access request is sent to the actual controller, but if you don't get a response to your request after 30 days, you can file a complaint with the supervisory authority (see here for Germany; note that federal institutions are supervised by the BFDI, not the data protection authorities of the Länder).
Also note that you may have to go through some trouble to be properly authenticated by the controller. They do need to be certain that you are the data subject.
There are also reasons why a controller can refuse to provide some or all of the information (e.g. if your request is clearly excessive or unfounded, if it's impossible to comply without violating another data subject's rights), but I would be surprised if any of those applied in your case.
Your rights can also be restricted depending on the legal basis for processing. This includes rights that are illogical as well as some that provide special protection for processors:
- You can't object to processing based on consent (but you can revoke your consent), fulfilment of contract (but you can cancel your contract), a legal obligation on the part of the processor, or a vital interest (but you still have the right to erasure)
- Your right to portability and right to erasure does not apply if processing is based on a legal obligation or a public task (justice, parliamentary or government functions, statutory functions etc.)
- your right to portability also doesn't apply if processing is based on vital interest (e.g to protect someone's life) or legitimate interest of the processor.
It is possible that processing all or some of your data was based on the performance of a public task, in which case they will refuse your request.
