Transmission of social data for research and planning

(1) Transmission of social data is permissible insofar as it is required for a particular project 1. of scientific research in the field of social benefits, or of scientific labour-market and occupational research; or 2. of planning in the field of social benefits by a public body within the scope of its functions, and interests of the person concerned worthy of protection are not impaired, or the public interest in the research or planning materially outweighs the interest of the person concerned in secrecy. Transmission without the consent of the person concerned is not permissible insofar as it is reasonable to obtain that consent. Particulars of surname and first name, address, telephone number, and the structural characteristics of the person concerned strictly required for initiating a project under the first sentence, may be transmitted for surveys even without consent. A data-protection concept must be submitted to the authority competent under subsection (4), first sentence.
(2) Where a research question connected in substance with the project under subsection (1), first sentence arises from that project, the period under subsection (4), fifth sentence, no. 4 for processing the required social data may, on application, be extended for this purpose, or a new period fixed, and further required social data transmitted.
(3) Insofar as special categories of data within the meaning of Article 9(1) of Regulation (EU) 2016/679 are transmitted to a third party under subsection (1) or (2), or processed by a third party under subsection (4a), that party must provide, in the processing, appropriate and specific measures to safeguard the interests of the person concerned under section 22(2), second sentence of the Federal Data Protection Act. In addition to the measures named there, the special categories of data within the meaning of Article 9(1) of Regulation (EU) 2016/679 must be anonymised as soon as this is possible having regard to the research purpose.
(4) The transmission under subsection (1) and the further processing, including a processing of social data together with further data, as well as the transmission under subsection (2), require the prior authorisation of the supreme federal or Land authority competent for the field from which the data originate. The supreme federal authority may transfer the authorisation procedure, for applications of insurance carriers under section 1(1), first sentence of the Fourth Book or of their associations, to the Federal Office for Social Security. Transmission of social data to a non-public body, and further processing by it under subsection (2), may be authorised only where the non-public body has undertaken, towards the authorising authority, to process the data only for the intended purpose. The authorisation may, having regard to safeguarding social confidentiality, be refused only where the conditions of subsection (1), (2) or (4a) are not met. It must precisely designate 1. the third party to whom the data are transmitted; 2. the nature of the social data to be transmitted and the group of persons concerned; 3. the scientific research or the planning for which the transmitted social data may be processed; and 4. the day up to which the transmitted social data may be processed, and is, even without special notice, subject to the reservation of the subsequent inclusion, alteration or supplementing of a requirement. After expiry of the period under the fifth sentence, no. 4, the processed data may be stored for up to ten years to enable a subsequent review of the research results on the basis of the original data, and processing for further research projects under subsection (2).
(4a) In addition to the transmission of social data for a particular research project under subsection (1), first sentence, processing of that social data may also be applied for, for research projects not yet determined but connected in substance, of the same field of research. Authorisation is to be granted under the conditions of subsection (4) where the data recipient undertakes, towards the authorising body, to comply with the conditions of authorisation for future research projects in the field of research too. The authority competent under subsection (4), first sentence may demand from the applicant the submission of an independent assessment of the data-protection concept. The applicant is obliged to notify the authority competent under subsection (4), first sentence, before its commencement, of every research project envisaged within the authorised field of research, and in doing so to set out the fulfilment of the conditions of authorisation. The research project may be commenced eight weeks after receipt of the notification by the authorising authority, unless the authorising authority states, before expiry of the period, that a separate authorisation procedure is required for the notified project.
(5) Where the processing of social data is authorised for non-public bodies, the authorising body must ensure, by requirements, that the limits set to the authorisation by subsections (1), (2) and (4a) are observed.
(6) Where the third party to whom social data are transmitted is a non-public body, it is subject to the supervision of the authority competent under section 40(1) of the Federal Data Protection Act.