§ 3 SächsDSG
Lawfulness of the processing of personal data
(1)The processing of personal data by public bodies shall be lawful where it is necessary for the performance of a task within the competence of the controller or in the exercise of official authority vested in the controller.
(2)1The purpose of processing personal data shall also include processing for the exercise of supervisory and control powers, for the auditing of accounts, for conducting organisational reviews, and for the testing and maintenance of automated procedures, as well as for statistical purposes of the controller. 2This shall also apply to processing for education, training, continuing education and examination purposes, provided that the legitimate interests of the data subject do not preclude this.