Legal bases for the processing of data in a cross-Länder online service

(1) The authority operating a cross-Länder online service may process the personal data necessary for the purposes of supporting the use of an electronic administrative service, disclosing the data from the online form to the respective competent authority, and transmitting electronic documents relating to administrative matters to the user. This also applies to the processing of special categories of personal data within the meaning of Article 9(1) of Regulation (EU) 2016/679, insofar as necessary for the administrative procedure connected to the cross-Länder online service. Section 22(2) of the Federal Data Protection Act applies accordingly.
(2) The data necessary for supporting the use of an electronic administrative service may be temporarily stored in the cross-Länder online service, in order to give the user the opportunity to complete, correct or delete the online form at a later time. Section 22(2) of the Federal Data Protection Act applies accordingly to the temporary storage of special categories of personal data within the meaning of Article 9(1) of Regulation (EU) 2016/679.
(3) The temporarily stored data are, as a rule, to be deleted automatically after 30 days from the user's last processing of the online form. The user must be informed in advance of the automatic deletion of the temporarily stored data relating to their online form. Longer-term storage of data in the cross-Länder online service is exceptionally permissible where it is to be expected that this is necessary for supporting the user in using an electronic administrative service. In such cases, a reasonable deletion period must be set. The user must be informed of this deletion period.
(4) The controller within the meaning of Article 4 number 7 of Regulation (EU) 2016/679, for the processing of personal data in the cross-Länder online service under subsections (1) to (3), is exclusively the authority operating the cross-Länder online service. The data-protection responsibility of the authority to which personal data is transmitted for the purpose of conducting the administrative procedure remains unaffected.