Legal Grounds for Data Processing

Anyone who processes personal data must not unlawfully breach the privacy of the data subjects in doing so. In particular, he must not process data, pertaining to a person, against that person’s express wish, without justification.

If the consent of the data subject is required for the processing of personal data, such consent is valid only if given voluntarily on the provision of adequate information.

A breach of privacy is unlawful unless it is justified by the consent of the injured party, by an overriding private or public interest or by law.

An overriding interest of the person processing the data shall in particular be considered if that person:

  • processes personal data in direct connection with the conclusion or the performance of a contract and the personal data is that of a contractual party;
  • is or intends to be in commercial competition with another and for this purpose processes personal data without disclosing the data to third parties;
  • process data that is neither sensitive personal data nor a personality profile in order to verify the creditworthiness of another, and discloses such data to third parties only if the data is required for the conclusion or the performance of a contract with the data subject;
  • processes personal data on a professional basis exclusively for publication in the edited section of a periodically published medium;
  • processes personal data for purposes not relating to a specific person, in particular for the purposes of research, planning and statistics and publishes the results in such a manner that the data subjects may not be identified;
  • collects data on a person of public interest, provided the data relates to the public activities of that person.