BSI ID: G 0.38

Personal data is almost always information that requires special protection. Typical examples include information about the personal or material circumstances of an identified or identifiable natural person. If the protection of personal data is not adequately ensured, there is a risk that the data subject's social position or economic circumstances will be adversely affected. Misuse of personal data may occur, for example, if an institution collects too much personal data, collects it without a legal basis or consent, uses it for a purpose other than that for which it was collected, deletes personal data too late or discloses it without authorisation.

Examples:

• Personal data may only be processed for the purpose for which it was collected or initially stored. It is therefore not permitted to use log files in which the login and logout of users to IT systems are recorded solely for access control purposes for the purpose of monitoring attendance and behaviour.

• Persons who have access to personal data could pass it on without authorisation. For example, an employee at the reception desk of a hotel could sell guests' login details to advertising companies.