§ 49 BDSG
Processing for other purposes
(1)The processing of personal data for a purpose other than that for which they were collected shall be permissible where the other purpose is one of the purposes referred to in Section 45, the controller is authorised to process data for that purpose, and the processing for that purpose is necessary and proportionate. The processing of personal data for another purpose not referred to in Section 45 shall be permissible where it is provided for in a legal provision.