§ 4 LDSG SH
Lawfulness of the processing of personal data for other purposes
(1)Processing of personal data for a purpose other than that for which the data were collected shall be lawful within the scope of the controller's tasks where 1. it is necessary to avert substantial disadvantages to the public interest or a danger to public security, defence or national security, 2. it is necessary for the prosecution of criminal offences or administrative offences, for the enforcement or execution of sentences or measures within the meaning of § 11(1) number 8 of the Criminal Code or of educational measures or disciplinary measures within the meaning of the Juvenile Courts Act, or for the enforcement of fines, 3. it is necessary to avert a serious impairment of the rights of another person, 4. obtaining the consent of the data subject is not possible or would involve disproportionate effort and it is evident that the data processing is in the interest of the data subject and there is no reason to assume that the data subject would refuse consent if aware of the other purpose, 5. it is necessary to verify information provided by the data subject because there are factual indications that such information is inaccurate, or 6. the data are generally accessible or the responsible body would be permitted to publish them, provided that the legitimate interests of the data subject are not adversely affected.
(2)The processing of special categories of personal data within the meaning of Article 9(1) of Regulation (EU) 2016/679 for a purpose other than that for which the data were collected shall be lawful where the conditions of paragraph 1 are met and an exception under Article 9(2) of Regulation (EU) 2016/679 or under Section 2 Sub-section 3 of this Act or under another legal provision permitting the processing of special categories of data within the meaning of Article 9(1) of Regulation (EU) 2016/679 applies.
(3)The processing of personal data subject to professional secrecy for a purpose other than that for which the data were collected shall be lawful where the conditions of paragraph 1 or 2 are met and the person or body bound by the obligation of confidentiality has given prior consent.
(4)Where personal data are linked with further personal data of the data subject or of third parties in such a way that separation is not possible or would be possible only with disproportionate effort, the transmission of such further data shall also be lawful, provided that the legitimate interests of the data subject or other persons do not outweigh; further processing of such data shall be unlawful.
(5)Personal data stored exclusively for the purposes of data protection control, data security or for ensuring the proper operation of a data processing system may not be processed for other purposes. zur Einzelansicht § 4