§ 9 DSG NRW
Permissibility of data processing with regard to purpose limitation
(1)Personal data may also be processed by public bodies for the exercise of supervisory and control powers, for auditing purposes, or for carrying out organisational investigations. This shall also apply to processing for training and examination purposes, provided that the legitimate interests of the data subject in the confidentiality of the data do not manifestly prevail.
(2)Processing of personal data for purposes other than those for which the data were collected shall be permissible where
(3)1. it is necessary to avert significant disadvantages to the common good or a danger to public safety, defence or national security,
(4)2. it is necessary to avert a serious impairment of the rights of another person,
(5)3. in the course of lawful performance of duties, indications of criminal offences or administrative offences emerge and notification of the authorities responsible for prosecution or enforcement appears to be warranted,
(6)4. verification of the information provided by the data subject is necessary on the basis of factual indications of its inaccuracy,
(7)5. it is necessary to safeguard a legal interest of a third party and the data subject's interest in confidentiality worthy of protection does not prevail, or
(8)6. it is in the public interest, in particular for the enforcement of public-law monetary claims, or is necessary to safeguard legitimate interests of a third party and the data subject has not objected to the data processing in these cases.
(9)The data subject shall not be informed about data processing pursuant to paragraph 2 insofar as and for as long as this would jeopardise the purpose of the processing.
(10)Furthermore, a change of purpose shall be permissible where
(11)1. it is not possible to obtain the consent of the data subject or this would involve a disproportionate effort, but it is obvious that the data processing is in the data subject's interest and that the data subject would give consent if aware of the other purpose,
(12)2. the processing of an application made by the data subject is not possible without the change of purpose of the data,
(13)3. the data can be obtained from publicly accessible sources or the data processing body would be entitled to publish them, unless the data subject's interest in the exclusion of storage or publication of the stored data manifestly prevails
(14)Where the personal data are subject to a professional or special official secret and have been transmitted to the controller by the person obliged to maintain confidentiality in the exercise of their professional or official duty, paragraphs 2 and 4 shall not apply.
(15)The transmission of personal data to bodies of public-law religious communities shall be permissible in analogous application of the provisions on data transmission to public bodies, provided that adequate data protection measures have been taken by the recipient.