Art. 29 BayDSG
Processing for Other Purposes and of Special Categories of Personal Data, DNA Analyses
(1)Processing of personal data for a purpose other than the one for which they were collected shall be permissible where the other purpose is one of the purposes referred to in Art. 28 para. 1, the controller is authorised to process data for that purpose, and the processing for that purpose is necessary and proportionate. The processing of personal data for another purpose not referred to in Art. 28 para. 1 shall be permissible where it is provided for in a legal provision.
(2)The processing of special categories of personal data within the meaning of Art. 9 para. 1 GDPR shall only be permissible where it is absolutely necessary for the performance of the task, the conditions of Art. 9 para. 2 letters c and e GDPR are met, or it is provided for in a legal provision.
(3)For the purpose of avoiding DNA trace contamination, persons who regularly perform tasks in the context of police or criminal procedural investigations and who may thereby come into contact with trace material may, with their written consent, have body cells taken and subjected to molecular genetic analysis, in order to process the DNA identification patterns derived therefrom and to compare them automatically with trace material. The body cells shall be taken by means of a buccal swab or a procedure comparable in terms of intrusiveness. Before giving consent, the data subject shall be instructed on the purpose of the processing and the procedure for detecting DNA trace contamination and shall be informed that consent may be refused and withdrawn at any time. The use of the body cells taken shall be permissible only for the determination of the DNA identification pattern pursuant to sentence 1, and the processing of the DNA identification pattern only for the purposes stated in sentence 1.
(4)The DNA identification patterns shall be stored in a police database established for this purpose. A data protection impact assessment shall not be required.
(5)The DNA identification patterns shall be pseudonymised. Comparisons with these patterns shall be logged. The log data shall be stored independently and may only be used for the purpose of reviewing the lawfulness of the data processing. Where the log data are no longer needed for this purpose, but no later than the end of the third calendar year following the year of logging, they shall be deleted.
(6)The body cells obtained pursuant to para. 3 shall be destroyed and the data collected shall be deleted when they are no longer required for the stated purposes. The destruction of the body cells and the deletion of the data collected shall take place no later than three years after the point in time at which the data subject could last have come into contact with trace material.