§ 39 DSG NRW
Processing for a purpose other than the collection purpose
(1)Processing of personal data for a purpose other than the purpose for which the data were collected shall be permissible where the other purpose is a purpose referred to in Section 35, the controller is authorised to process data for this purpose, and the processing for this purpose is necessary and proportionate. The processing of personal data for another purpose not referred to in Section 35 shall be permissible where it is provided for in a legal provision.