(1) The registration authorities may use sorting criteria in the keeping of their registers. The sorting criteria may be based on the data referred to in section 3 (1) nos. 6 and 7. Appropriate technical measures as referred to in Articles 24, 25 and 32 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1; L 314, 22.11.2016, p. 72; L 127, 23.5.2018, p. 2), as amended, are to be implemented to prevent the sorting criteria being mixed up.
(2) If the registration authorities already process sorting criteria containing data other than those referred to in section 3 (1) nos. 6 and 7, they may continue to process them for a transitional period of six years following the entry into force of this Act.
(3) Sorting criteria may be transferred to public bodies and religious communities under public law when data are transferred. The recipient of the data may process the sorting criteria only in communicating with the relevant registration authority, and onward transfer is not permissible. If sorting criteria contain personal data, they may be transferred only if the personal data contained in the sorting criteria may also be transferred to the recipient.
(4) Subsection (3) sentences 2 and 3 applies accordingly to the onward transfer of sorting criteria within the administrative unit to which the registration authority belongs.