§ 23 BDSG
Processing for other purposes by public bodies
(1)The processing of personal data for a purpose other than that for which the data were collected by public bodies in the course of performing their tasks shall be permissible where 1 it is obvious that it is in the interest of the data subject and there is no reason to assume that the data subject would withhold consent in knowledge of the other purpose,; 2 information provided by the data subject must be checked because there are factual indications that it is inaccurate,; 3 it is necessary to avert substantial disadvantages to the common good or a threat to public security, defence or national security, to safeguard substantial interests of the common good or to secure tax and customs revenue,; 4 it is necessary for the prosecution of criminal offences or administrative offences, for the enforcement or execution of sentences or measures within the meaning of Section 11 Subsection (1) No. 8 of the Criminal Code, or of educational measures or disciplinary measures within the meaning of the Youth Courts Act or for the enforcement of administrative fines,; 5 it is necessary to avert a serious prejudice to the rights of another person or; 6 it serves the exercise of supervisory and control powers, auditing or the conduct of organisational reviews of the controller; this shall also apply to processing for training and examination purposes by the controller, insofar as the legitimate interests of the data subject do not preclude this.
(2)The processing of special categories of personal data within the meaning of Article 9 Subsection (1) of Regulation (EU) 2016/679 for a purpose other than that for which the data were collected shall be permissible where the conditions of Subsection (1) are met and a derogation under Article 9 Subsection (2) of Regulation (EU) 2016/679 or under Section 22 applies.