§ 24 BDSG
Processing for other purposes by non-public bodies
(1)The processing of personal data for a purpose other than that for which the data were collected by non-public bodies shall be permissible whereprovided that the interests of the data subject in the exclusion of the processing do not override. 1 it is necessary to avert dangers to national or public security or for the prosecution of criminal offences or; 2 it is necessary for the establishment, exercise or defence of civil law claims,
(2)The processing of special categories of personal data within the meaning of Article 9 Subsection (1) of Regulation (EU) 2016/679 for a purpose other than that for which the data were collected shall be permissible where the conditions of Subsection (1) are met and a derogation under Article 9 Subsection (2) of Regulation (EU) 2016/679 or under Section 22 applies.