Ok, after some learning phase I could solve my problem. I used getfacl and setfacl to set the correct (and wanted) rights for the required directory.
And I understood, that the ACL rules are stored in special blocks of the filesystem. So far, so clear. But ne thing I could not understand, maybe someone can answer this: When Plasma5 (KDE) or any other application is creating a new mount below /media/, where does this new folder gets its ACL rules? Is there any configuration file I can look at? Or is there a default rule set by the kernel? Is there any configuration file for ACLs at all? If yes, where is it? And if no, how can one define default rules for ACL? I found no satisfying answer in the doc and the web. Thanks for any hints. Best regards Hans