§ 6 HmbDSG
Purpose limitation
(1)The purpose of processing personal data, including data within the meaning of Article 9 of Regulation (EU) 2016/679, shall also encompass processing for the exercise of supervisory and control powers, for audit purposes, for the conduct of organisational reviews and for the purposes of data security, data protection supervision or ensuring the orderly operation of a data processing system. This shall also apply to the processing of personal data for training and further education purposes, insofar as the legitimate interests of the data subject in the confidentiality of the data do not manifestly prevail.
(2)Processing of personal data for purposes other than the original purposes shall be permissible where 1. this is necessary to avert substantial detriment to the common good or a danger to public safety, defence or national security, 2. this is necessary to avert a serious impairment of the rights of another person, 3. this is necessary for the prosecution of criminal offences or administrative offences, for enforcement or execution of sentences or of measures within the meaning of Section 11(1), number 8, of the Criminal Code or of educational measures or disciplinary measures within the meaning of the Youth Courts Act, or for the fulfilment of a judicial request for information, and legal provisions do not preclude this, 4. this is necessary to verify information provided by the data subject because there are factual indications of its inaccuracy, 5. in the context of participation in private-law transactions or for the enforcement of public-law claims, there is a legal interest in the knowledge of the data to be processed and there is no reason to assume that the legitimate interest of the data subjects in confidentiality prevails, 6. it is obvious that the processing is in the interest of the data subject and the data subject would give consent if aware of the other purpose, 7. the data could be or were directly taken from generally accessible sources, or the data processing body would be entitled to publish them, unless the legitimate interests of the data subjects manifestly oppose this, 8. the processing serves the handling of petitions, parliamentary enquiries or requests for the submission of files by the Parliament and the predominant legitimate interests of the data subjects are not opposed thereto, 9. the processing is necessary for the conduct of scientific or historical research or statistics, the interest in the conduct of the research or statistical project substantially outweighs the interest of the data subjects in the exclusion of the change of purpose, and the research or statistical purpose cannot be achieved by other means or only with disproportionate effort.
(3)Where the personal data are subject to professional secrecy and have been transmitted to the data processing body by the person bound to secrecy in the exercise of his or her professional duty, paragraph 2 shall not apply.
(4)Where personal data are linked with other data of the data subject or of third parties in such a way that their separation into necessary and unnecessary data is not possible or is possible only with disproportionate effort, the taking note of, the internal forwarding within the controller and the transmission of the data that are not necessary for the performance of the respective task shall also be permissible, insofar as the legitimate interests of the data subject or of third parties do not prevail. The unnecessary data shall in that regard be subject to a processing prohibition. zur Einzelansicht § 6