Grounds for justification

¹ A breach of personality rights is unlawful unless it is justified by the consent of the data subject, by an overriding private or public interest, or by the law.

² The controller may have an overriding interest in the following cases in particular:

• a.

  The controller processes personal data relating to a contracting party in direct connection with the conclusion or the performance of a contract.

• b.

  The controller is or intends to be in commercial competition with another person and for this purpose processes personal data that are not disclosed to third parties; legal entities that belong to the same group of companies as the controller are not regarded as third parties for the purposes of this provision.

• c.

  The controller processes personal data to verify the creditworthiness of the data subject, provided the following requirements are satisfied:

  • 1.

    The matter involves neither sensitive personal data nor high-risk profiling.

  • 2.

    The data are only disclosed to third parties if the third parties require the data for the conclusion or the performance of a contract with the data subject.

  • 3.

    The data are no more than ten years old.

  • 4.

    The data subject has attained the age of majority.

• d.

  The controller processes the personal data professionally and exclusively for publication in the editorial section of a periodically published medium or the controller uses the data, if they are not published, as an aid to their own personal work.

• e.

  The controller processes the personal data for purposes not related to specific persons, in particular for research, planning or statistics, provided the following requirements are satisfied:

  • 1.

    The controller anonymises the data as soon as the purpose of processing permits; if anonymity is impossible or if it requires disproportionate effort, the controller shall take appropriate measures to prevent the identification of the data subject.

  • 2.

    If the matter involves sensitive personal data, the controller shall disclose such data to third parties in such a manner that the data subject is not identifiable; if this is not possible, it must be guaranteed that the third parties only process the data for purposes unrelated to the data subject's person.

  • 3.

    The results are published in such a manner that data subjects are not identifiable.

• f.

  The controller collects personal data relating to a public figure that relate to that person's public activities.