(1) Joint procedures are automated procedures which enable several controllers within the meaning of the Federal Data Protection Act to process personal data in or from a database. Where joint procedures are also intended to enable data retrieval by other bodies, the retrieval procedures pursuant to Section 10 of the Federal Data Protection Act shall apply.
(2) The participation of public bodies of the Federation pursuant to Section 2 (1) of the Federal Data Protection Act in joint procedures shall be permissible only where this is appropriate with due regard to the data subject's legitimate interests and the tasks to be performed by the participating bodies. The provisions regarding the permissibility of data processing in individual cases shall remain unaffected.
(3) Before establishing or effecting substantial changes to a joint procedure, a prior check shall be carried out pursuant to Section 4d (5) and (6) of the Federal Data Protection Act and the Federal Commissioner for Data Protection and Freedom of Information shall be heard. The stipulations pursuant to sub-section 4 and the result of the prior check shall be submitted to the Federal Commissioner.
(4) Before establishing or effecting substantial changes to a joint procedure, beyond the information pursuant to Section 4e, first sentence of the Federal Data Protection Act, the following in particular is to be stipulated in writing:
1. the procedure to be applied and the bodies responsible for defining, amending, developing and complying with organizational and technical specifications for the joint procedure and
2. the participating bodies responsible for ensuring the legality of collecting, processing and using data, respectively.
The controllers pursuant to the first sentence, no. 1 shall appoint one of the participating bodies whose data protection official shall keep an overview to be drawn up by the participating bodies in accordance with Section 4g (2), first sentence of the Federal Data Protection Act and shall make this overview available to anyone for inspection pursuant to Section 4g (2), second sentence of the Federal Data Protection Act together with the information pursuant to the first sentence, nos. 1 and 2. In accordance with the first sentence, no. 1, controllers may also be appointed which are permitted to commission other bodies to collect, process and use personal data for the joint procedure. Section 11 of the Federal Data Protection Act shall remain otherwise unaffected.
(5) Where divergent data protection regulations apply for the participating bodies, it is to be determined before establishing a joint procedure which data protection law shall apply. It is further to be determined which supervisory authority shall verify compliance with the data protection regulations.
(6) The data subjects may assert their rights pursuant to Sections 19 to 20 of the Federal Data Protection Act against any of the participating bodies, irrespective of which body is responsible for processing the data in the individual case concerned pursuant to sub-section 4, first sentence, no. 2. The body contacted by the data subject shall forward the matter to the responsible body in the case concerned.