§ 8 DSG NRW
Responsibility for data transmission
(1)The responsibility for the permissibility of a transmission of personal data shall be borne by the transmitting body. Where the transmission is carried out on the basis of a request from a public body, that body shall bear the responsibility. The transmitting body shall then only verify whether the transmission request falls within the scope of the recipient's tasks. It shall examine the lawfulness of the request only where there is cause to do so in the individual case. The requesting body shall provide the information necessary for this examination in its request. Where the transmission is carried out by automated retrieval, the recipient shall bear responsibility for the lawfulness of the retrieval.
(2)The transmission of personal data by public bodies to non-public bodies shall be permissible where
(3)1. it is necessary for the performance of tasks falling within the competence of the transmitting body and the conditions that would permit processing under Sections 3 and 9 are met,
(4)2. the third party to whom the data are transmitted credibly demonstrates a legitimate interest in knowledge of the data to be transmitted and the data subject has no legitimate interest in the exclusion of the transmission, or
(5)3. it is necessary for the establishment, exercise or defence of legal claims
(6)4. and the third party has committed itself to the transmitting public body to process the data only for the purpose for which they were transmitted.
(7)Processing for other purposes shall be permissible where a transmission under sentence 1 would be permissible and the transmitting body has consented.
(8)The transmission of special categories of personal data within the meaning of Article 9(1) of Regulation (EU) 2016/679 shall be permissible where the conditions of paragraph 1 or 2 and an exception under Article 9(2) of Regulation (EU) 2016/679 or under Section 16 are met.
(9)When transmitting personal data to non-public bodies, the conditions set out in paragraphs 2 and 3 shall be indicated.