c) Moreover, the legislature may also allow for a further use of data
collected by the state for other purposes than those determining the
original data collection (change in purpose).
The proportionality requirements for such a change must conform to
the principle of a hypothetical re-collection of data. According to this,
the new use of the data must serve the protection of legal interests or
aim to investigate criminal offences of such weight that would, by constitutional standards, justify collecting them again with comparably
weighty means. A specific risk situation, as required for the initial data
collection, is generally not required a second time; it is necessary but
generally also sufficient that there be a specific evidentiary basis for
further investigations.
With regard to data from the surveillance of private homes and from
remote searches of information technology systems, a change in purpose is only permitted if the relevant risk situation requirements applicable to the collection of the data are again fulfilled.
3. The transfer of data to state authorities in third countries is subject to
the general constitutional principles of purpose limitation and change
in purpose. In assessing a new use, the autonomy of the other legal
order must be respected. A transfer of data to third countries requires
the ascertainment that, in the third country, the data will be handled in
sufficient conformity with rule-of-law standards.
2/71