Art. 6 BayDSG
Purpose Limitation (on Art. 6 paras. 3 and 4 GDPR)
(1)Public bodies that are permitted to process personal data may also process such data for the exercise of supervisory or control powers, for the preparation of operational statistics, for auditing, for conducting their own organisational reviews, or for the inspection or maintenance of automated data processing procedures and for ensuring network and information security, and, insofar as manifestly overriding legitimate interests of the data subjects do not preclude this, for their own training or examination purposes.
(2)Processing for purposes other than those for which the data were collected shall be permissible, without prejudice to the provisions of the GDPR, where
(3)it is manifestly in the interest of the data subject and there is no reason to assume that the data subject would refuse consent to such other purpose if aware of it,
(4)the data can be obtained from publicly accessible sources or the processing body would be entitled to publish them,
(5)the processing is necessary
(6)for the prevention of significant disadvantages to the public interest or of threats to public safety and order,
(7)for the prosecution of criminal offences or administrative offences, for the enforcement or execution of penalties or measures within the meaning of Section 11 para. 1 no. 8 of the Criminal Code or of educational measures or disciplinary measures within the meaning of the Juvenile Courts Act or for the enforcement of administrative fine decisions,
(8)for the conduct of scientific or historical research, the scientific or historical interest in the conduct of the research project significantly outweighs the interest of the data subject in the exclusion of the change of purpose, and the purpose of the research cannot be achieved in any other way or only with disproportionate effort,
(9)for the prevention of a serious infringement of the rights of another person,
(10)for the verification of statements made by the data subject, because there are factual indications of their inaccuracy,
(11)for the comparison of statements made by the data subject for the purpose of obtaining financial benefits from public bodies with other such statements, or
(12)for the safeguarding of tax and customs revenue.
(13)Art. 9 GDPR and Art. 8 and 24 para. 3 shall remain unaffected.
(14)Personal data that are processed exclusively for purposes of data security or data protection control shall not be processed for other purposes.