According to the lawyer the data security statement has to be updated.
Adjust usage of location data to agreement based (was done in the meantime).
Only refer to public interest if there is a law for it, otherwise use justified interest of the responsible party (a step lower).
Test if lobid-resources is a Verbunddatei according to the new NRW law. -> There is nothing written about it in the new data security law of NRW. But it was just a thought which I mentioned in the mail to the lawyer.
Create a data security statement for the start page. -> Unnecessary, won't do it.
According to the lawyer the data security statement has to be updated.