§ 30 NDSG
Data transmission outside the public sector
(1)1The transmission of personal data to persons or bodies outside the public sector shall be lawful where
(2)the recipients credibly demonstrate a legal interest in knowledge of the data to be transmitted and there is no reason to believe that the legitimate interest of the data subject in confidentiality outweighs, or
(3)the transmission is in the public interest or a legitimate interest is asserted for it, and the data subjects have not objected to the transmission in those cases.
(4)2In the cases of sentence 1 number 2, the data subjects shall be notified in an appropriate manner and in a timely fashion of the intended transmission, the type of data to be transmitted and the intended purpose of use.
(5)The transmitting body shall require the recipients to process the data only for the purposes for which they were transmitted.