§ 4 SDSG
Lawfulness of the processing of personal data
(1)The processing of personal data by public bodies shall be lawful where it is necessary for the performance of a task within the competence of the controller.
(2)The transmission of personal data to public bodies shall be lawful where it is necessary for the performance of a task within the competence of the transmitting body or the third party to whom the data are transmitted.
(3)The transmission of personal data to non-public bodies shall be lawful where 1. it is necessary for the performance of a task within the competence of the transmitting body, 2. the third party to whom the data are transmitted credibly demonstrates a legitimate interest in obtaining the data to be transmitted and the data subject has no legitimate interest in excluding the transmission, or 3. it is necessary for the assertion, exercise or defence of legal claims and the third party has undertaken vis-a-vis the transmitting public body to process the data only for the purpose for which they were transmitted.
(4)The controller shall be obligated to ensure by contract that a processor to whom this Act does not apply complies with its provisions. zur Einzelansicht § 4