On 25 May 2018, the EU General Data Protection Regulation (GDPR) comes into effect in all member states of the European Union as a measure to create uniform standards of data protection within the EU. While the known basic principles of the 'old' German data protection law remain in place, the GDPR creates a new legal framework which expands the rights of data subjects. The new legislation tightens the technical requirements and with that the aspect of data security. It furthermore standardises the provisions for the transfer of data into third countries.

In addition to the GDPR, Ulm University is also subject to the Federal State Data Protection Act of Baden-Württemberg (LDSG BW). On 6 June 2018, the Landtag (state parliament of Baden-Württemberg) decided the new LDSG, which came into effect on 12 June 2018.

According to the GDPR, the processing of personal data is permitted only if the processing is regulated by a legal basis, or if the data subject has given their effective consent to the use at the time of data collection. If you wish to collect data for a research project or administrative purposes, make sure that there is a legal basis for the collection and use of these data for this specific purpose. If this is not the case, you need to obtain the data subjects' consent. A template is provided here. According to art. 4 no. 11, art. 7 GDPR, the following seven rules apply to the obtaining of effective consent:

1. Form of consent

The declaration of consent does not necessarily have to be in written form (i.e. with original signature). It can be declared in the form of an oral statement, electronically or in text form (i.e. without original signature) also. When choosing the form of consent, please note that the burden of proof of the data subject's consent to the processing of their personal data lies with the user of the data. It is therefore advisable to document the consent.

The declaration of consent must be clearly intelligible and worded unambiguously. Visual elements may be used to improve intelligibility. Optically, the declaration of consent must be clearly distinguishable from other matters.

2. Awareness at the time of consent

Prior to giving consent, the data subject must receive information on which specific personal data their consent refers to as well as the specific purpose of the processing. Any passing on to third parties must be listed.

3. Voluntary nature of the consent

The data subject has to give their consent at their own free will. This means that the data subject must have true freedom of choice and must be able to deny consent without suffering any disadvantage. The data subject must be made aware that they have the right to deny their consent.

4. Specificity and purpose of consent

The declaration of consent must specify unambiguously what exact data are processed and for what purpose. A universal and generalised declaration is not sufficient. The use of collected data for other purposes is prohibited in principle. The more significant the encroachment into the personality right (Right of Publicity), the greater degree of detail is required in the declaration of consent.

5. Unambiguity of the declaration of consent

When the data subject agrees to the declaration of consent, they must understand that they are giving their consent. This can be indicated by using the title "consent"(Einwilligung) or by using the term "consent" or "agreement" (Zustimmung).

6. Option to withdraw consent

The data subject must be able to withdraw their consent at any time. This must be stated clearly in the declaration of consent. Denial of the right to withdraw is prohibited.

The withdrawal does not necessarily have to be declared in the same form as the consent. However, the declaration of withdrawal must not be made more difficult than the declaration of consent or entail additional obstacles. It shall be as easy to withdraw as to give consent. Address and contact information for the submission of the declaration of withdrawal must be provided.

7. Own data

The data subject can only give consent to the use of their own personal data. For the use of the data of several persons, each person must give their consent individually.

According to art. 30 GDPR, Ulm University is obliged as a public entity to maintain a record of all processing activities (in german: Verzeichnis von Verarbeitungstätigkeiten; short: VVT) under its responsibility. This obligation also comprises any processing activities carried out by Ulm University on behalf of others. The VVT replaces the previous register of processing operations (in german: Verfahrensverzeichnis; short: VVZ) according to § 11 LDSG (old version).

Processing as defined in art. 4 GDPR means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

The term processing thus refers to any handling of personal data, including their storage.

The term processing activities summarises in this context operational steps with regard to an individual specific purpose, for instance the collection and use of student data in a campus management system.

Within Ulm University, departmental and technical contact persons who wish to establish a system have the responsibility to ensure that the processing activities begin only after a VVT was created and approved by the relevant departments. The processing of employee data usually also requires the approval of the Staff Council.

With regards to systems for which a VVZ was created in the past, it is necessary to adapt this register to the current legal requirements. These systems therefore also require the creation of a VVT.

"Commissioned data processing" (ADV) as defined by the GDPR is the processing of personal data via a service provider by order of the controller (i.e. by order of Ulm University). An ADV is, for instance, when personal data are hosted on external servers, IT systems maintained by third parties or data storage media disposed of by another company.

According to art. 28 GDPR, such an ADV is only permitted if the controller has ensured that the processor has taken suitable technical and organisational measures to protect the rights of the data subjects. In principle, this must be documented in an agreement in written form between the controller and the processor.

Should you wish to use a service provider or establish a Software as a Service (SaaS), an agreement in written form is required which regulates the data protection responsibility on top of general matters such as payment and liability. Your contact persons in dept. I-2 Legal and Organisational Affairs are happy to answer any questions around this topic and can help you write an ADV agreement.

Did you lose your laptop, smartphone or a USB stick? Did you send an email to the wrong addressee including an attachment containing personal data? Did your PC get hacked? In today's IT world, these and other 'data breaches' are part of daily life.

It is important for you to know that according to art. 33, 34 GDPR such data breaches can entail two reporting obligations:

a) Notification to the responsible supervisory authority within 72 hours (art. 33 GDPR)

The data breach must be notified to the responsible supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of it. Supervisory authority for Ulm University is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI BW).

Exempt from the notification obligation are data breaches which "are unlikely to result in a risk" for the data subject. As there are currently no principles for interpretation or parameters given by the LfDI BW for when such a risk can be excluded, notification is advisable when in doubt.

The breach shall not be notified later than 72 hours of having become aware of it. This "becoming aware" refers to any and every employee of Ulm University, not only persons with overarching responsibility such as the Chief Financial Officer/President or the data protection officers.

b) Notification to the data subject (art. 34 GDPR)

Beyond the notification to the LfDI BW, the GDPR also stipulates a notification to the data subject. This notification, however, is required only if the breach presents a high risk to the rights and freedoms of a natural person. Notification to the data subject may be omitted if:

• measures to control the damage were taken which eliminate the risk, or


• technical and organisational measures are in place which make access to the personal data impossible (e.g. encryption).

Please note: From 25 May 2018 on, please notify all data breaches that you become aware of immediately to the contact persons in dept. I-2 of the Central University Administration via the provided online form. If you are unable to provide all details instantaneously, please submit the notification anyway and provide further information as it becomes available. Please DO NOT send the notification directly to the LfDI BW. The notification must be send to the data protection officers only, who will initiate the forwarding and necessary documentation.

If you fear damage to the IT security of the University (Trojans etc.), please also inform the kiz (Communication and Information Centre) via their Help Desk immediately.