Part 1
Teil 2
Sub-chapter 1
- § 22Processing of special categories of personal data
- § 23Processing for other purposes by public bodies
- § 24Processing for other purposes by private bodies
- § 25Transfer of data by public bodies
- § 26Data processing for employment-related purposes
- § 27Data processing for purposes of scientific or historical research and for statistical purposes
- § 28Data processing for archiving purposes in the public interest
- § 29Rights of the data subject and powers of the supervisory authorities in the case of secrecy obligations
- § 30Consumer loans
- § 31Protection of commercial transactions in the case of scoring and credit reports
Sub-Chapter 2
- § 32Information to be provided where personal data are collected from the data subject
- § 33Information to be provided where personal data have not been obtained from the data subject
- § 34Right of access by the data subject
- § 35Right to erasure
- § 36Right to object
- § 37Automated individual decision-making, including profiling
Teil 3
- § 55General information on data processing
- § 56Notification of data subjects
- § 57Right of access
- § 58Right to rectification and erasure and to restriction of processing
- § 59Modalities for exercising the rights of the data subject
- § 60Right to lodge a complaint with the Federal Commissioner
- § 61Legal remedies against decisions of the Federal Commissioner or if he or she fails to take action
- § 62Processing carried out on behalf of a controller
- § 63Joint controllers
- § 64Requirements for the security of data processing
- § 65Notifying the Federal Commissioner of a personal data breach
- § 66Notifying data subjects affected by a personal data breach
- § 67Conducting a data protection impact assessment
- § 68Cooperation with the Federal Commissioner
- § 69Prior consultation of the Federal Commissioner
- § 70Records of processing activities
- § 71Data protection by design and by default
- § 72Distinction between different categories of data subjects
- § 73Distinction between facts and personal assessments
- § 74Procedures for data transfers
- § 75Rectification and erasure of personal data and restriction of processing
- § 76Logging
- § 77Confidential reporting of violations
Teil 4
FDPA Part 2 - § 22
Processing of special categories of personal data
- By derogation from Article 9 (1) of Regulation (EU) 2016/679, the processing of special categories of personal data as referred to in Article 9 (1) of Regulation (EU) 2016/679 shall be permitted
- by public and private bodies if
- processing is necessary to exercise the rights derived from the right of social security and social protection and to meet the related obligations;
- processing is necessary for the purposes of preventive medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services or pursuant to the data subject’s contract with a health professional and if these data are processed by health professionals or other persons subject to the obligation of professional secrecy or under their supervision;
- processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices; in addition to the measures referred to in subsection 2, in particular occupational and criminal law provisions to ensure professional secrecy shall be complied with; or
- processing is urgently necessary for reasons of substantial public interest;
- by public bodies if
- processing is necessary to prevent a substantial threat to public security;
- processing is urgently necessary to prevent substantial harm to the common good or to safeguard substantial concerns of the common good; or
- processing is necessary for urgent reasons of defence or to fulfil supra- or intergovernmental obligations of a public body of the Federation in the field of crisis management or conflict prevention or for humanitarian measures;
- 1In the cases of subsection 1, appropriate and specific measures shall be taken to safeguard the interests of the data subject. 2Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, these measures may include in particular the following:
- technical organizational measures to ensure that processing complies with Regulation (EU) 2016/679;
- measures to ensure that it is subsequently possible to verify and establish whether and by whom personal data were input, altered or removed;
- measures to increase awareness of staff involved in processing operations;
- designation of a data protection officer;
- restrictions on access to personal data within the controller and by processors;
- the pseudonymization of personal data;
- the encryption of personal data;
- measures to ensure the ability, confidentiality, integrity, availability and resilience of processing systems and services related to the processing of personal data, including the ability to rapidly restore availability and access in the event of a physical or technical incident;
- a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing;
- specific rules of procedure to ensure compliance with this Act and with Regulation (EU) 2016/679 in the event of transfer or processing for other purposes.
and as far as the interests of the controller in the data processing are overridden by the interests of the data subject in the cases referred to in no. 1(d) and 2.
Source: Bundesamt für Justiz
