Art. 7 BayDSG
Special Automated Procedures (on Art. 6 para. 3, Art. 26 GDPR)
(1)Public bodies may only establish automated procedures that enable the transmission of personal data by retrieval, insofar as
(2)the retrieval is made from data holdings that are open to anyone without or after special authorisation to use, or
(3)the procedure appropriately takes into account the rights and freedoms of the data subjects and the tasks of the participating bodies.
(4)For retrievals pursuant to sentence 1 no. 2
(5)the recipient shall bear responsibility for the lawfulness of the individual retrieval,
(6)the establishing body shall ensure that the transmission of personal data can at least be ascertained and reviewed by means of suitable sampling procedures; it shall examine the lawfulness of retrievals only where there is reason to do so.
(7)The establishment of automated procedures that are intended to enable multiple public bodies to process personal data in a shared data holding or in which the participating public bodies grant each other mutual access to the stored personal data shall be permissible insofar as this is appropriate, taking into account the rights and freedoms of the data subjects and the tasks of the participating bodies, and risks to the rights and freedoms of the data subjects can be avoided by technical and organisational measures. Procedures pursuant to sentence 1 that may entail a high risk to the rights and freedoms of the data subjects shall only be permissible if they are established by or on the basis of a law.