§ 14 BlnDSG
Processing of Special Categories of Personal Data
(1)In addition to the exceptions to the prohibition on processing directly set out in Article 9(2) of Regulation (EU) 2016/679, special categories of personal data within the meaning of Article 9(1) of Regulation (EU) 2016/679 may, in implementation of Article 9(2)(b), (h) and (i), be processed where this is necessary 1. to enable the controller or the data subject to exercise the rights and fulfil the obligations arising from employment and service law and the law of social security and social protection, 2. for the purposes of preventive healthcare or occupational medicine, for the assessment of the working capacity of employees, for medical diagnostics, the provision of care or treatment in the health or social sector, or for the management of systems or services in the health or social sector, subject to the conditions of Article 9(3) of Regulation (EU) 2016/679, or 3. for reasons of public interest in the field of public health, such as protection against serious cross-border health threats or ensuring high standards of quality and safety in healthcare and in relation to medicinal products and medical devices; in addition to the measures referred to in paragraph 3, in particular the professional and criminal law requirements for maintaining professional secrecy shall be observed.
(2)The processing of special categories of personal data shall also be permissible, beyond paragraph 1, in implementation of Article 9(2)(g) of Regulation (EU) 2016/679, where it is necessary 1. to avert a substantial threat to public safety, or 2. to avert substantial disadvantages to the public interest or to safeguard substantial interests of the public interest, and the interests of the controller in the data processing outweigh the interests of the data subject.
(3)In the processing of special categories of personal data within the meaning of Article 9(1) of Regulation (EU) 2016/679, appropriate and specific measures to safeguard the interests of the data subject shall be provided for. Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the varying likelihood and severity of the risks to the rights and freedoms of natural persons posed by the processing, such measures may include in particular: 1. the measures pursuant to Section 26, 2. sensitisation of those involved in processing operations, 3. restriction of access to personal data for persons subordinate to the controller or the processor, and 4. specific procedural rules which, in the event of transmission or processing for other purposes, ensure compliance with the provisions of this Act and of Regulation (EU) 2016/679. zur Einzelansicht § 14