What is the process for disclosing data for an individual-specific purpose?

Summary of the four questions which should be asked when considering a disclosure:

• First: Is the public body wishing to obtain the personal data even permitted to process these data?
• Second: Is it permitted to ask the other public body from which it wishes to obtain the data the question about the data, as by doing so it is already disclosing information which could possibly be subject to a specific legal secrecy rule?
• Third: Is the public body being asked to disclose the data even permitted to process these data itself? If it is not even permitted to process the data, it is certainly not permitted to disclose them.
• And fourth: Is there a legal basis for the disclosure, is it proportionate and are there any restrictions under § 29 IDG which would prevent it – in particular a legal confidentiality obligation or an overriding confidentiality interest?

Downloads