A legal basis alone is not enough to justify a disclosure. There are other rules which apply here as they do to processing.

First, there is the principle of proportionality, as per § 9 para. 3 IDG: a disclosure of personal data must always be proportionate. This means that a public body may only disclose those personal data which are appropriate and necessary to the purpose for which they are being disclosed, and the disclosure of which can be deemed acceptable to the data subject. Thus, only the personal data that the recipient needs to complete their task may be disclosed, and no more.

Second, there is the purpose limitation principle (§ 12 IDG): in principle, personal data may only be processed for the purpose for which they were collected. Disclosing personal data to another public body or third party may, however, be associated with a change of purpose. The original purpose for which a public body had processed the data prior to the disclosure does not necessarily have to be the same purpose for which the other public body or third party will be processing the data once received. If, for example, the social welfare office is permitted to disclose to the tax authority how much in welfare benefits a taxable person has received, then the purpose changes: from combating poverty to assessment of income tax. However, this change of purpose is usually justified by the legal basis for the disclosure or by the consent of the data subject in individual cases.

Third, there is the principle of transparency (§ 15 IDG): if a public body collects data about a person from another public body or from private individuals, it must actively inform the data subject of this. In addition, the disclosed data must be accurate; in other words, the principle of integrity also applies (§ 11 IDG).

And finally, information security must also be ensured (§ 8 IDG): the public body must protect information being disclosed to others by employing appropriate organizational and technical measures.