Processing of social data on behalf

(1) The placing of an order within the meaning of Article 28 of Regulation (EU) 2016/679 for the processing of social data is permissible only where the controller notifies its legal or specialist supervisory authority, in good time before placing the order, in writing or electronically, of
1. the processor on behalf, the technical and organisational measures existing at that processor, and supplementary instructions;
2. the nature of the data to be processed on behalf, and the group of persons concerned;
3. the function for whose performance the data are to be processed on behalf; and
4. the conclusion of any sub-processing relationships. Where a public body is to be commissioned with the processing of social data, it must, in good time before placing the order, notify the intended commissioning in writing or electronically to its legal or specialist supervisory authority.
(2) The order for the processing of social data may be placed only where the processing takes place domestically, in another Member State of the European Union, in a state treated the same as this under section 35(7) of the First Book, or, where an adequacy decision under Article 45 of Regulation (EU) 2016/679 exists, in a third country or in an international organisation.
(3) The placing of an order for the processing of social data by non-public bodies is permissible only where
1. disturbances in operations could otherwise arise at the controller; or
2. the work transferred can be carried out substantially more cheaply by the processor. This does not apply where information-technology service providers, of which the Federation or the Länder hold the absolute majority of shares or votes, are commissioned with the prior authorisation of the supreme service authority of the controller.
(4) Where the processor is a body named in section 35 of the First Book, sections 9, 13, 14 and 16 of the Federal Data Protection Act apply besides sections 85 and 85a. For the bodies named in section 35 of the First Book that are not bodies of the Federation, the body competent under Land law for data-protection control takes the place of the Federal Commissioner. Where the processor is a non-public body, it is subject to the supervision of the authority competent under section 40 of the Federal Data Protection Act.
(5) Subsection (3) does not apply to contracts for the examination or maintenance of automated procedures or of data-processing installations by other bodies on behalf, where access to social data cannot be excluded. The contracts must be notified without delay to the legal or specialist supervisory authority where disturbances in operations are to be expected or have already occurred.