§ 5 BbgDSG
Lawfulness of the processing of personal data
(1)The processing of personal data by public bodies shall be lawful where it is necessary for the performance of a task within the competence of the controller or in the exercise of official authority vested in the controller.
(2)Personal data may also be processed for the purposes of the exercise of supervisory and control powers, audit or the conduct of organisational reviews. The processing of personal data shall be permissible only insofar as it is necessary for the exercise of these powers. Personal data may only be used for training and further education purposes where this is indispensable and the legitimate interests of the data subject do not oppose this; personal data may not be processed for test and examination purposes. The purposes referred to in sentences 1 and 3 shall be collection purposes within the meaning of Article 5(1)(b) of Regulation (EU) 2016/679.
(3)Paragraph 2 shall apply mutatis mutandis to personal data within the meaning of Article 9(1) of Regulation (EU) 2016/679, with the proviso that the processing of such data shall be permissible only where it is indispensable for the processing purposes and, insofar as the processing is for training and further education purposes, where such processing is carried out by persons referred to in Section 203(3), sentence 1, of the Criminal Code.
(4)Einzelnorm