§ 25 NDSG
Principles for the processing of personal data
(1)The processing of personal data by a public body within the meaning of § 23(1) and (2) shall be lawful insofar as and as long as it is necessary and proportionate for the performance of the task within its competence referred to in § 23(1) and (2).
(2)Personal data must
(3)be processed lawfully and in good faith,
(4)be collected for specified, explicit and legitimate purposes and not processed in a manner incompatible with those purposes, and
(5)be accurate and, where necessary, kept up to date, whereby all reasonable measures must be taken to ensure that personal data which are inaccurate with regard to the purposes for which they are processed are erased or rectified without delay.
(6)1The processing of special categories of personal data shall be lawful only where it is indispensable for the performance of tasks. 2For the protection of special categories of personal data processed for the purposes referred to in § 23, § 17(2) to (4) shall apply mutatis mutandis.
(7)1Processing of personal data for a purpose other than that for which they were collected shall be lawful where the other purpose is one of the purposes referred to in § 23, the controller is authorised to process data for that purpose, and the processing is necessary and proportionate for that purpose. 2The processing of personal data for a purpose other than the purposes referred to in § 23 shall be lawful where it is provided for by a legal provision.
(8)1The processing may be carried out for archival purposes in the public interest or for statistical purposes. 2For the processing of personal data for scientific or historical research purposes, § 13(1) to (4) shall apply mutatis mutandis, whereby the rights of the data subject to access pursuant to § 51, to rectification and restriction of processing pursuant to § 52 shall not apply insofar as the exercise of those rights would be likely to render impossible or seriously impair the achievement of the respective scientific or historical research purposes and the exclusion of those rights is necessary for the fulfilment of those purposes.
(9)1Processing for other purposes shall not be deemed to take place where it is carried out for the exercise of supervisory and control powers, for auditing purposes or for conducting organisational reviews. 2Processing for training and examination purposes shall also be lawful, insofar as the legitimate interests of the data subjects in the confidentiality of the data do not outweigh.