Purpose limitation and duty of secrecy of a third party to whom data are transmitted

(1) Persons or bodies not named in section 35 of the First Book to whom social data have been transmitted may process them only for the purpose for which they were permissibly transmitted to them. Transmission of social data under sections 68 to 77, or under another legal provision in this Code, to a non-public body on its request is permissible only where that body has undertaken, towards the transmitting body, to process the data only for the purpose for which they are transmitted to it. Third parties must keep the data secret to the same extent as the bodies named in section 35 of the First Book. Where social data have been transmitted to courts or public prosecution offices, these may further transmit judicial decisions containing social data, where a body named in section 35 of the First Book would be authorised to transmit to the further third party. In derogation from the fourth sentence, transmission under section 115 of the Federal Civil Servants Act, and under provisions referring to that provision, is permissible. Where social data have been transmitted to police authorities, public prosecution offices, courts or authorities responsible for averting danger, these may, independently of the purpose of the transmission, store, alter, use, transmit, restrict the processing of, or erase the data both for purposes of averting danger and for purposes of criminal prosecution and the enforcement of criminal sentences.
(2) Where data are transmitted to a non-public body, the persons employed there who store, alter, use, transmit, restrict the processing of, or erase these data must be informed by that body, before, or at the latest upon, the transmission, of the duties to be observed under subsection (1).
(3) Where, within the framework of an enforcement proceeding under section 66, the necessity arises that a criminal complaint is required to protect the enforcement officer, the social data transmitted for the purpose of enforcement may also be stored, altered, used, transmitted, have their processing restricted, or be erased, for the purpose of criminal prosecution, insofar as this is required. The same applies to the clarification of questions within the framework of a disciplinary proceeding.
(4) Where social data have been transmitted to courts or public prosecution offices for conducting a criminal or regulatory-fine proceeding, they may, in accordance with sections 476, 487(4) of the Code of Criminal Procedure and sections 49b and 49c(1) of the Act on Regulatory Offences, be stored, altered, used, transmitted, have their processing restricted, or be erased, for purposes of scientific research.
(5) The customs administration authorities may process social data transmitted to them for the purpose of enforcement also for the purpose of enforcing public-law claims of bodies other than those named in section 35 of the First Book.