(1) Identity card authorities may collect, transmit, otherwise process or use personal data only in accordance with this or other Acts or statutory instruments.
(2) Identity card authorities may transmit data in the identity card register to other authorities at their request if
1. the requesting authority is authorized by law or statutory instrument to receive such data,
2. the requesting authority would not be able to fulfil its assigned duties without knowledge of the data, and
3. the data cannot be obtained from the data subject without unreasonable effort, or the nature of the task for which the data are required means that the data cannot be collected in this way.
With regard to data which are also kept in the civil register, the restrictions contained in the legislation on registration must be respected.
(3) The requesting authority shall be responsible for ensuring that the conditions in subsection 2 are met. Only those staff who are specially authorized by the head of the authority may submit requests pursuant to subsection 2. The requesting authority shall keep a record of the reason for the request and the source of the data and files transmitted. If the Federal Office for the Protection of the Constitution, the state offices for the protection of the Constitution, the Federal Intelligence Service, the Military Counterintelligence Service, the Federal Criminal Police Office or the Federal Public Prosecutor requests the identity card authority to transmit data, the requesting authority shall record the family and given name and address of the data subject and the reason for the transmission of data. Such records shall be retained separately, secured using technical and organizational means and destroyed at the end of the calendar year following the year in which the data were transmitted.
(4) Data from the identity card register may be used to correct data in the civil register and vice versa.