§ 24 BDSG
Processing for other purposes by non-public bodies
(1)The processing of personal data for a purpose other than that for which the data were collected by non-public bodies shall be permissible whereprovided that the interests of the data subject in the exclusion of the processing do not override.
1.it is necessary to avert dangers to national or public security or for the prosecution of criminal offences or
2.it is necessary for the establishment, exercise or defence of civil law claims
(2)The processing of special categories of personal data within the meaning of Article 9 Subsection (1) of Regulation (EU) 2016/679 for a purpose other than that for which the data were collected shall be permissible where the conditions of Subsection (1) are met and a derogation under Article 9 Subsection (2) of Regulation (EU) 2016/679 or under Section 22 applies.