Art. 4 BayDSG
Lawfulness of Processing (on Art. 6 paras. 1 to 3 GDPR)
(1)The processing of personal data by a public body shall be permissible, without prejudice to other provisions, if it is necessary for the performance of a task incumbent upon that body.
(2)Personal data that are not obtained from publicly accessible sources shall be collected from the data subject with their knowledge. Personal data may be collected from third parties where
(3)this is provided for or necessarily presupposed by a legal provision,
(4)the administrative task to be fulfilled, by its nature or in the individual case, necessitates such collection,
(5)collection from the data subject would require a disproportionate effort or would be unlikely to succeed, or
(6)the data may be transmitted from another public body to the collecting body.
(7)In the cases referred to in sentence 2 nos. 2 and 3, there shall be no indications that overriding legitimate interests of the data subject would be affected. Where data are collected from the data subject without their knowledge, sentence 2 nos. 1 and 2 shall apply accordingly.