§ 6 NDSG
Purpose limitation, change of purpose
(1)The purpose of the processing of personal data shall also include processing
(2)for the exercise of supervisory and control powers, for auditing purposes and for conducting organisational reviews, as well as
(3)for training and examination purposes, insofar as the legitimate interests of the data subject in the confidentiality of the data do not outweigh.
(4)Processing of personal data for a purpose other than that for which the data were collected shall be lawful insofar as and as long as
(5)the data processing is necessary to avert a danger to public security or to avert substantial disadvantages to the welfare of the Federation or a Land,
(6)the data processing is necessary for the prosecution of criminal offences or administrative offences, for the enforcement of criminal penalties or for the enforcement of fines,
(7)the data processing is necessary to avert a serious impairment of the rights and freedoms of another person,
(8)the data processing is necessary to verify information provided by the data subject whose accuracy is in doubt on the basis of factual indications,
(9)the data processing is necessary for the protection of the data subject, or
(10)the data can be obtained from generally accessible sources or the data processing body would be permitted to publish them, unless the legitimate interest of the data subject in confidentiality manifestly outweighs.
(11)Personal data which are subject to professional secrecy or a special official secret and which have been transmitted to the data processing body by the person bound by the obligation of confidentiality in the exercise of their professional or official duties may not be processed for other purposes pursuant to paragraph 2.
(12)Personal data stored exclusively for purposes of data protection control, for ensuring data security or for the proper operation of a data processing system may not be processed for other purposes pursuant to paragraph 2.
(13)Information of the data subject pursuant to Article 13(3) and Article 14(4) of the General Data Protection Regulation about data processing pursuant to paragraph 2 numbers 1 to 4 shall not be provided insofar as and as long as the purpose of the processing would be jeopardised thereby.