T 2.162 Lack of admissibility regarding the processing of personal data

Processing personal data is only admissible if a law or another statutory regulation allows for the aforementioned or if the person concerned has given his/her consent.

There is the risk of personal data being processed unlawfully if there is no sufficient legal basis (consent or statutory permission, e.g. with the help of data protection legislation, social code, education acts, policy acts, hospital acts). Additionally, threat T 2.105 Violation of statutory regulations and contractual agreements is referred to.

Processing personal data in the absence of an adequate legal basis may entail a fine or a custodial sentence and/or may cause consequences in the fields of service law or labour law. The person concerned may claim a right to damages.