§ 48 BDSG
Processing of special categories of personal data
(1)The processing of special categories of personal data shall be permissible only where it is strictly necessary for the performance of the task.
(2)Where special categories of personal data are processed, appropriate safeguards for the rights and interests of the data subjects shall be provided. Appropriate safeguards may in particular include 1 specific requirements for data security or data protection monitoring,; 2 the setting of special review periods for erasure,; 3 awareness-raising of those involved in processing operations,; 4 restriction of access to personal data within the responsible body,; 5 separate processing from other data,; 6 pseudonymisation of personal data,; 7 encryption of personal data or; 8 specific procedural rules which, in the case of a transfer or processing for other purposes, ensure the lawfulness of processing.