Legal grounds in the public sector
Art. 9 ZVOP-1 provides for certain restrictions on data processing by the public sector. Pursuant to it, personal data may only be processed by the public sector if the legal ground for the processing of personal data and the personal data to be processed are provided for by statute. Statutes may also provide that certain personal data may only be processed by the public sector on the basis of consent of the individual.
However, as an exception, personal data may be processed by the public sector even without an explicit basis in law or consent of the data subject if these data are essential for the exercise of statutory competences, duties or obligations of the public sector, provided that such processing is not contrary to justified interests of the individual to whom the data relate.
Accuracy of personal data
Prior to inputting personal data into a filing system, data controller may verify its accuracy by examining an identity document or other suitable public document of the individual to whom the data relates (Art. 18 ZVOP-1).
Supply of personal data to data recipients
Art. 22 ZVOP-1 provides for certain clarifications regarding the supply of personal data to data recipients. Most importantly, the data controller of the Central Population Register or of the Records of Registered Residents is obliged to supply to an authorised subject demonstrating a lawful interest in exercising rights before public sector bodies the name and address of an individual against whom they wish to proceed.
