§ 47 BDSG
General principles for the processing of personal data
(1)Personal data shall be 1 processed lawfully and fairly,; 2 collected for specified, explicit and legitimate purposes and not processed in a manner that is incompatible with those purposes,; 3 adequate, relevant and not excessive in relation to the purposes for which they are processed,; 4 accurate and, where necessary, kept up to date; every reasonable step shall be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay,; 5 kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which they are processed, and; 6 processed in a manner that ensures appropriate security of the personal data; this shall include protection, to be ensured by appropriate technical and organisational measures, against unauthorised or unlawful processing, accidental loss, accidental destruction or accidental damage.