§ 3 DSG NRW
Permissibility of the processing of personal data
(1)Unless special statutory provisions take precedence, the processing of personal data by public bodies shall be permissible where it is necessary for the performance of a task carried out in the public interest by the processing bodies or where it is carried out in the exercise of official authority vested in the controller.
(2)Data processing shall be organised in such a way that, during processing, in particular during transmission, access in the course of task performance, and inspection, the separation of data according to the respective purposes pursued and according to different data subjects is possible. Where personal data are linked in such a manner that their separation into necessary and unnecessary data is not possible or is possible only with disproportionate effort, awareness, internal transfer within the data processing body, and transmission of data that are not necessary for the performance of the respective tasks shall also be permissible, provided that the legitimate interests of the data subject or third parties do not prevail. The unnecessary data shall be subject to a prohibition on use in this respect.
(3)Official documents on the technical and organisational measures pursuant to Article 32 of Regulation (EU) 2016/679 shall not be subject to the general right of access to information under the Freedom of Information Act of North Rhine-Westphalia.