Service provided by the Federal Ministry of Justice and the Federal Office of Justice ‒ www.gesetze-im-internet.de Section 48 Processing of special categories of personal data (1) The processing of special categories of personal data shall be allowed only where strictly necessary for the performance of the controller’s tasks. (2) If special categories of personal data are processed, appropriate safeguards for the legally protected interests of the data subject shall be implemented. Appropriate safeguards may be in particular 1. specific requirements for data security or data protection monitoring; 2. special time limits within which data must be reviewed for relevance and erasure; 3. measures to increase awareness of staff involved in processing operations; 4. restrictions on access to personal data within the controller; 5. separate processing of such data; 6. the pseudonymization of personal data; 7. the encryption of personal data; or 8. specific codes of conduct to ensure lawful processing in case of transfer or processing for other purposes. Section 49 Processing for other purposes Processing personal data for a purpose other than the one for which they were collected shall be permitted if the other purpose is one of the purposes listed in Section 45, the controller is authorized to process data for this purpose, and processing is necessary and proportionate to this purpose. Processing personal data for another purpose not listed in Section 45 shall be permitted if it is allowed by law. Section 50 Processing for archiving, scientific and statistical purposes Personal data may be processed in the context of purposes listed in Section 45 in archival, scientific or statistical form if doing so is in the public interest and appropriate safeguards for the legally protected interests of data subjects are implemented. Such safeguards may consist of rendering the personal data anonymous as quickly as possible, taking measures to prevent unauthorized disclosure to third parties, or in processing them organizationally and spatially separate from other tasks. Section 51 Consent (1) If personal data may be processed by law on the basis of consent, the controller must be able to present evidence of the data subject’s consent. (2) If the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. (3) The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. The data subject shall be informed of this before giving consent. (4) Consent shall be effective only when based on the data subject’s free decision. When assessing whether consent was freely given, the circumstances in which it was given must be taken into account. The data subject shall be informed of the intended purpose of the Page 27 of 43