§ 85 BDSG
Processing of personal data in the context of activities falling outside the scope of Regulation (EU) 2016/679 and Directive (EU) 2016/680
(1)The transfer of personal data to a third country or to supra-national or inter-governmental bodies or international organisations in the context of activities falling outside the scope of Regulation (EU) 2016/679 and Directive (EU) 2016/680 shall, in addition to the cases already permissible under Regulation (EU) 2016/679, also be permissible where it is necessary for the fulfilment of own tasks for compelling reasons of defence or for the fulfilment of supra-national or inter-governmental obligations of a public body of the Federation in the field of crisis management or conflict prevention or for humanitarian measures. The recipient shall be informed that the transferred data may be used only for the purpose for which they were transferred.
(2)For processing operations in the context of activities falling outside the scope of Regulation (EU) 2016/679 and Directive (EU) 2016/680 by agencies within the portfolio of the Federal Ministry of Defence, Section 16 Subsection (4) shall not apply insofar as the Federal Ministry of Defence determines in the individual case that the fulfilment of the obligations referred to therein would jeopardise the security of the Federation.
(3)For processing operations in the context of activities falling outside the scope of Regulation (EU) 2016/679 and Directive (EU) 2016/680 by public bodies of the Federation, the obligation to provide information pursuant to Article 13 Subsections (1) and (2) of Regulation (EU) 2016/679 shall not apply whereWhere the data subject is not to be informed in the cases of the first sentence, the right of access shall also not apply. Section 32 Subsection (2) and Section 33 Subsection (2) shall not apply. 1 the cases of Section 32 Subsection (1) Nos. 1 to 3 apply or; 2 their fulfilment would reveal information which must be kept secret pursuant to a legal provision or by its nature, in particular because of the overriding legitimate interests of a third party, and therefore the interest of the data subject in obtaining the information must yield.