§ 15 BlnDSG
Processing for Other Purposes
(1)The processing of personal data for a purpose other than the one for which the personal data were collected shall be permissible on the basis of Article 6(4) first sentence, first half-sentence of Regulation (EU) 2016/679 in conjunction with the objectives referred to in Article 23(1) of Regulation (EU) 2016/679, where 1. it is necessary for the protection of the vital interests of a natural person and the data subject is unable to give consent for legal or factual reasons; 2. it is necessary to avert substantial disadvantages to the public interest or an imminent threat to public safety or to safeguard tax and customs revenue; 3. in the course of the lawful performance of tasks, indications of criminal offences or administrative offences emerge and the notification of the authorities competent for prosecution or enforcement appears necessary; 4. the data can be obtained from publicly accessible sources or the controller would be entitled to publish them, provided that the legitimate interests of the data subject do not manifestly preclude this; 5. it serves the exercise of supervisory and control powers, internal audit, external audit or the conduct of organisational reviews; access to personal data in this context shall only be permissible insofar as it is necessary for the exercise of these powers; 6. it is necessary for training and continuing education purposes and the legitimate interests of the data subject do not preclude this; personal data shall not be processed for test and examination purposes. Personal data that are stored exclusively for purposes of data protection control, data security or for ensuring the orderly operation of a data processing system shall not be processed for other purposes.
(2)Paragraph 1 sentence 1 nos. 2 and 3 shall not apply where the personal data are subject to a professional or special official secrecy obligation and were transmitted to the processing body by the person obliged to maintain confidentiality in the exercise of their professional or official duties.
(3)In the cases of paragraph 1 sentence 1 nos. 2, 3 and 5, by derogation from Articles 13(3) and 14(4) of Regulation (EU) 2016/679, the data subject shall not be informed of the processing of personal data insofar and for as long as the purpose of the processing would be jeopardised. The reasons for refraining from providing information shall be recorded. Section 23(3) shall apply accordingly.
(4)Where personal data are so interconnected that their separation according to different purposes, including by copying and rendering anonymous, is not possible or is possible only with disproportionate effort, a prohibition of use in accordance with paragraph 1 shall take the place of separation for data that do not serve the purpose of the respective processing.
(5)The processing of special categories of personal data within the meaning of Article 9(1) of Regulation (EU) 2016/679 for a purpose other than the one for which the data were collected shall be permissible where the conditions of Section 14(2) and an exception pursuant to Article 9(2) of Regulation (EU) 2016/679 or Section 14(1) are met. zur Einzelansicht § 15