§ 16 DSG NRW
Processing of special categories of personal data
(1)The processing of special categories of personal data within the meaning of Article 9(1) of Regulation (EU) 2016/679 shall be permissible insofar as
(2)1. it is necessary to avert dangers to public safety,
(3)2. it is necessary for the prosecution of criminal offences or administrative offences, for the enforcement or execution of penalties, of fining decisions, measures of reform and prevention, educational measures or disciplinary measures within the meaning of the Youth Courts Act, or for ordering confiscation decisions,
(4)3. it is necessary for the purposes of preventive health care, medical diagnosis, the provision and supervision of health care or health alerts, the prevention or control of communicable diseases and other serious health hazards, or the management of health care services, provided that the processing of such data is carried out by medical or other personnel subject to a corresponding duty of confidentiality, or
(5)4. it is necessary in order to exercise the rights and fulfil the obligations arising from the law of social security and social protection.
(6)In the case of Article 9(2)(a) of Regulation (EU) 2016/679, consent to the processing of genetic or biometric data or health data shall be given in writing.