§ 4 DSG LSA
Lawfulness of the processing
(1)of personal data The processing of personal data shall be lawful insofar as it is necessary for the performance of 1. a legal obligation to which the controller is subject, or 2. a task within the competence of the controller, the performance of which is in the public interest or is carried out in the exercise of official authority vested in the controller. In all other respects, the lawfulness of data processing shall be determined by Article 6(1) of Regulation (EU) 2016/679.