Service provided by the Federal Ministry of Justice and the Federal Office of Justice ‒ www.gesetze-im-internet.de (2) The controller shall implement appropriate technical and organizational measures to ensure that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That applies to the amount of data collected, the extent of their processing, the period of their storage and their accessibility. In particular, the measures must ensure that by default the data are not made accessible by automated means to an indefinite number of persons. Section 72 Distinction between different categories of data subjects When processing personal data, the controller shall, as far as possible, make a clear distinction between different categories of data subjects. This applies in part icular to the following categories: 1. persons with regard to whom there are serious grounds for believing that they have committed a criminal offence; 2. persons with regard to whom there are serious grounds for believing that they are about to commit a criminal offence; 3. persons convicted of a criminal offence; 4. victims of a criminal offence or persons with regard to whom certain facts indicate that they could be the victim of a criminal offence; and 5. other persons, such as witnesses, persons who can provide information, or contacts or associates of the persons referred to in nos. 1 to 4. Section 73 Distinction between facts and personal assessments In processing, the controller shall distinguish, as far as possible, personal data based on facts from personal data based on personal assessments. To this end, the controller shall identify evaluations based on personal assessments as such, as far as possible and reasonable in the context of the processing in question. It must also be possible to determine which body keeps the records on which an evaluation based on a personal assessment is based. Section 74 Procedures for data transfers (1) The controller shall take appropriate measures to ensure that personal data which are inaccurate or no longer up to date are not transmitted or otherwise made available. To that end, the controller shall, as far as possible with reasonable effort, verify the quality of the data before they are transmitted or made available. The controller shall also, as far as possible and reasonable, in all transmissions of personal data include the necessary information to enable the recipient to assess the degree of accuracy, completeness and reliability of the data, and the extent to which they are up to date. (2) If the processing of personal data is subject to special conditions, in transmissions of data the transmitting body shall inform the recipient of these conditions and the requirement to respect them. The obligation of providing information may be met by marking the data accordingly. (3) The transmitting body shall not apply conditions to recipients in other Member States of the European Union or to agencies, offices and bodies established pursuant to Chapters 4 and 5 of Title V of the Third Part of the Treaty on the Functioning of the European Union other than those applicable to similar domestic transmissions. Section 75 Rectification and erasure of personal data and restriction of processing (1) The controller shall rectify inaccurate personal data. Page 38 of 43