§ 6 BbgDSG
Lawfulness of the processing of personal data for other purposes
(1)Processing of personal data for a purpose other than that for which the data were collected shall be permissible within the scope of the controller's task performance where
(2)The processing of special categories of personal data within the meaning of Article 9(1) of Regulation (EU) 2016/679 for a purpose other than that for which the data were collected shall be permissible only for the purposes referred to in sentence 1, numbers 1 and 3, and only insofar as it is indispensable for the achievement of those purposes.
(3)The data subject shall not be informed of the data processing pursuant to paragraph 1, numbers 1 to 4, insofar and for as long as the purpose of the processing would thereby be jeopardised.
(4)Where the personal data are subject to professional secrecy and have been transmitted to the responsible body by the person bound to secrecy in the exercise of his or her professional duty, paragraph 1 shall not apply.
(5)The transmission of personal data on the basis of paragraph 1 to non-public bodies shall be permissible only where the non-public body has undertaken to process the data only for the purpose for which they are to be transmitted to it.
(6)Where personal data are linked with other data of the data subject or of third parties in such a way that their separation into necessary and unnecessary data is not possible or is possible only with disproportionate effort, the taking note of, the internal forwarding within the controller and the transmission of the data that are not necessary for the performance of the respective task shall also be permissible, insofar as the legitimate interests of the data subject or of third parties do not prevail. The unnecessary data shall in that regard be subject to a processing prohibition.
(7)Einzelnorm