§ 5 NDSG
Transmission of personal data
(1)1The transmission of personal data to a public body shall be lawful insofar as it is necessary for the performance of the tasks of the transmitting body or of the receiving body and the data were collected for that purpose or the conditions for a change of purpose are met. 2The transmission of personal data to a non-public body shall be lawful insofar as
(2)it is necessary for the performance of the tasks of the transmitting body and the data were collected for that purpose or the conditions for a change of purpose are met, or
(3)the receiving body credibly demonstrates a legitimate interest in knowledge of the data to be transmitted and there is no reason to believe that the legitimate interest of the data subject in confidentiality outweighs.
(4)3In the case of a transmission pursuant to sentence 2, the recipient shall undertake vis-a-vis the transmitting public body to process the data only for the purpose for which they were transmitted. 4The transmission to public-law religious communities shall be permissible only where it is ensured that the recipient processes data in compliance with the General Data Protection Regulation.
(5)1The transmitting body shall bear the responsibility for the lawfulness of the transmission of personal data. 2Where the transmission takes place at the request of a public body, that body shall bear the responsibility. 3The transmitting body shall then only be required to examine whether the request for transmission falls within the scope of the tasks of the requesting body. 4The lawfulness of the request shall be reviewed only where there is reason to do so in the individual case; the requesting body shall provide the transmitting body with the information necessary for this review. 5Where the transmission takes place by automated retrieval (§ 7), the recipient shall bear the responsibility for the lawfulness of the retrieval.
(6)Where personal data are linked with further personal data of the data subject or of another person in such a way that separation is not possible or would be possible only with disproportionate effort, the transmission of such further data to public bodies shall also be lawful, provided that the legitimate interests of the data subject or another person in their confidentiality do not manifestly outweigh; further processing of such data shall be unlawful.