> The clubs have to be registered and need a license. They need to keep a register of members. It is not in the law that they need to give this register to the authorities, but it is still a risk.

I very much recall how long the promise of "Covid Guest Lists are not used by the police" lasted.

The anonymized form is only for the "automatic" reports without anyone asking. The authority can request — §26(2) — the data (= non-anonymized) at any point based on without any requirement for a specific reason.

That said, "the authority" is not necessarily the police or public prosecutor; the determination who does this is left to the federal state (who might make it the police/prosecutor, or not…) — presumably if they're not "the authority" themselves, they would have to ask "the authority" to forward it.