§ 3 LDSG SH
Lawfulness of the processing of personal data
(1)The processing of personal data by public bodies shall be lawful where it is necessary for the performance of a task within the competence of the controller or in the exercise of official authority vested in the controller.
(2)The purpose of the processing of personal data shall also include processing for the exercise of supervisory and control powers, for auditing purposes, for conducting organisational reviews, and for the testing and maintenance of automated procedures. This shall also apply to the processing of personal data for training and continuing education purposes, provided that the legitimate interests of the data subject are not adversely affected. zur Einzelansicht § 3