§ 17 ThürDSG
Purpose limitation and permissibility of further processing
(1)(Articles 6 and 23 of Regulation (EU) 2016/679)
(2)In addition to the original purposes, the processing of personal data by public bodies shall always also be deemed to serve the purposes of 1. exercising supervisory or control powers, 2. preparing business statistics for the controller, 3. auditing, 4. conducting organisational studies for the controller, or 5. testing or maintaining automated data processing procedures. This shall also apply to processing for training or examination purposes by the controller, insofar as no obviously overriding legitimate interests of the data subject conflict therewith.
(3)The processing of personal data for purposes other than those for which they were collected shall, subject to specific provisions, be permissible where 1. it is necessary to avert significant disadvantages to the public interest or an otherwise directly imminent threat to public safety, 2. it is necessary for the prosecution of criminal offences or administrative offences, for the enforcement or execution of sentences or measures within the meaning of Section 11(1) No. 8 of the Criminal Code (StGB), of educational measures or disciplinary measures within the meaning of the Youth Courts Act, or for the enforcement of administrative fine decisions, 3. it is necessary to protect the rights and freedoms of another person, 4. third parties to whom the data are to be transmitted credibly demonstrate a legitimate interest in knowing the data to be transmitted and the data subject has no legitimate interest in the exclusion of the transmission, 5. it is obvious that it is in the interest of the data subject and there is no reason to assume that the data subject would refuse consent if aware of the other purposes, 6. the data subject's information needs to be verified because there are factual indications that it is incorrect, 7. the data can be obtained from publicly accessible sources or the data processing body would be entitled to publish them, or 8. it is necessary to safeguard the collection of costs, taxes and customs duties, provided that the legitimate interest of the data subject in the exclusion of the change of purpose does not prevail. The processing of personal data for archiving purposes in the public interest, for scientific and historical research purposes and for statistical purposes shall always be permissible. In all other respects, the controller shall, when determining whether further processing is compatible with the purpose of the original collection, observe the requirements of Article 6(4) of Regulation (EU) 2016/679. In the cases of sentence 1, the data subject shall not be informed insofar as and for as long as the purposes of the processing would thereby be jeopardised.
(4)Paragraph 2 shall not apply to personal data which are processed exclusively for the purposes of data protection control, data security or for ensuring the proper operation of a data processing system. zur Einzelansicht § 17