Legal bases for the processing of data in user accounts and for identification purposes

(1) For establishing the identity of the user of a citizen account, the following data may be processed insofar as necessary: 1. data under section 18(3) of the Act on Identity Cards and Electronic Identification, 2. the unique identifier and the specific data transmitted by notified electronic identification means under Regulation (EU) No 910/2014 of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC (OJ L 257, 28.8.2014, p. 73), as last amended by Directive (EU) 2022/2555 (OJ L 333, 27.12.2022, p. 80), 3. the unique identifier transmitted by other recognised electronic identification means, and 4. the mailbox reference of the user account. Where the user account is subsequently used together with the electronic proof of identity under section 18 of the Act on Identity Cards and Electronic Identification, section 12 of the eID Card Act, or section 78(5) of the Residence Act, the service- and card-specific identifier and the address must, as a rule, be transmitted; for electronic identification means under sentence 1 numbers 2 and 3, only the respective unique identifier.
(2) For establishing the identity of the user of an organisation account, and for establishing the power of representation or authority to act of a natural or legal person acting for the organisation, the following data may be processed insofar as necessary: 1. basic company data under section 3 of the Basic Company Data Register Act, 2. data under section 139b(4a) and section 139c(6a) of the Fiscal Code, 3. the unique identifier and specific data transmitted by notified electronic identification means under Regulation (EU) No 910/2014, 4. the unique identifier transmitted by other recognised electronic identification means, 5. the mailbox references of the user account, 6. data on the power of representation or authority to act, as well as data under subsection (1), of the natural persons acting for an organisation, and 7. data of the members of the representative body or the statutory representatives. Where a member of the representative body or the statutory representative is a legal person, its data may be used under this subsection.
(3) For establishing a user's identity, the tax authority operating the secure procedure under section 87a(6) of the Fiscal Code on behalf of the supreme tax authorities of the Federation and the Länder may 1. retrieve, by an automated procedure and at the instigation of the user, the data listed in section 139b(4a) and section 139c(6a) of the Fiscal Code held by the Federal Central Tax Office, as well as corresponding data stored for taxation purposes by the tax offices at those tax authorities, and 2. transmit the retrieved data, at the instigation of the user, to that user's user account.
(4) Data within the meaning of subsections (1) and (2) may, at the instigation of the user, also be exchanged between user accounts within the portal network.
(5) For communicating with the user, the following data may additionally be processed: 1. form of address, 2. further addresses, 3. De-Mail address or a comparable address of a delivery service of a Member State of the European Union, or of another contracting state to the Agreement on the European Economic Area, under Regulation (EU) No 910/2014, 4. e-mail address, 5. telephone or mobile number, 6. fax number, and 7. communication content data.
(6) At the instigation of the user, electronic documents relating to administrative matters, and status and procedural information, may be transmitted to the user account and processed for the purposes of the user account, insofar as necessary.
(7) At the instigation of the user, permanent storage of the data under subsections (1), (2), (5) and (6) is permissible. In the case of permanent storage, the user must at all times be able independently to delete the user account and all stored data. The citizen account is automatically deleted after two years of user inactivity. The user is automatically notified electronically, two months in advance, of the impending deletion. Electronic identification may in each case take place by means of a one-off query of the identity data.
(8) The data under subsections (1), (2), (5) and (6) and under section 9(1) that are necessary for the respective purpose may, at the instigation of the user, be transmitted to the authority responsible for the administrative service, to an administrative portal, or to an online service, and processed by them, insofar as necessary for the purposes of supporting the use of electronic administrative services or their handling. Responsibility for the permissibility of the transmission lies with the third party to whom the data is transmitted. Unless otherwise provided by statute, the third party may process the data only for the purpose for which it was transmitted.
(9) Insofar as data may be processed under subsections (5) to (8), this also applies to special categories of personal data under Article 9(1) of Regulation (EU) 2016/679. Section 22(2) of the Federal Data Protection Act applies accordingly.
(10) For the processing of personal data in the user account under subsections (1) to (9), the body responsible in each case for the user account is exclusively the controller within the meaning of Article 4 number 7 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1; L 314, 22.11.2016, p. 72; L 127, 23.5.2018, p. 2; L 74, 4.3.2021, p. 35). Where several bodies share responsibility for a user account, they are joint controllers under Article 26 of Regulation (EU) 2016/679.