Data processing by third parties
1 The processing of personal data may be assigned to third parties by agreement or by law if:
a. the data is processed only in the manner permitted for the instructing party itself; and
b. it is not prohibited by a statutory or contractual duty of confidentiality.
2 The instructing party must in particular ensure that the third party guarantees data security.
3 Third parties may claim the same justification as the instructing party.