§ 7 SDSG
Purpose limitation, change of purpose
(1)1The purpose of processing personal data by public bodies shall also include processing for the exercise of supervisory and control powers, for the auditing of accounts, for conducting organisational reviews, and for the testing and maintenance of automated data processing procedures, as well as for statistical purposes of the controller. 2This shall also apply to processing for education, training, continuing education and examination purposes, provided that the legitimate interests of the data subject in maintaining confidentiality do not preclude this.
(2)Processing for purposes other than the original purposes shall be lawful where 1. it is necessary to avert substantial detriment to the public interest or an otherwise directly imminent threat to public security, 2. it is necessary to avert a serious impairment of the rights of another person, 3. it is necessary to verify statements of the data subject because there are factual indications that they are inaccurate, or 4. in the course of lawful performance of duties, indications of criminal offences or administrative offences arise and the notification of the authorities competent for prosecution or enforcement appears appropriate.
(3)1By derogation from Article 13(3) and Article 14(4) of Regulation (EU) 2016/679, the data subject shall not be informed about the data processing pursuant to paragraph 2 insofar as and for as long as such information would jeopardise the purpose of the processing. 2Where the controller refrains from informing the data subject, the reasons for doing so shall be documented.
(4)Furthermore, a change of purpose shall be lawful where 1. it is not possible or would involve disproportionate effort to obtain the consent of the data subject, but it is manifest that the data processing is for his or her protection and the data subject would give consent if aware of the other purpose, or 2. the data can be taken from publicly available sources or the data processing body would be permitted to publish them, provided that the legitimate interests of the data subjects do not manifestly preclude this.
(5)The processing of special categories of personal data within the meaning of Article 9(1) of Regulation (EU) 2016/679 for a purpose other than that for which the data were collected shall be lawful where the conditions set out in paragraph 2 are met and an exception pursuant to Article 9(2) of Regulation (EU) 2016/679 applies.
(6)Where personal data are subject to professional secrecy or special official secrecy and were transmitted to the data processing body by the person bound by the obligation of confidentiality in the exercise of their professional or official duty, paragraphs 2 and 4 shall not apply, unless the person or body bound by the obligation of confidentiality has given consent.
(7)Personal data stored exclusively for purposes of data protection supervision, data security or ensuring the proper operation of a data processing system may only be processed for these purposes. zur Einzelansicht § 7