General information on the EU General Data Protection Regulation

From 25 May this year, the General Data Protection Regulation (GDPR) will apply directly in all Member States of the European Union. The aim is to harmonise the current data protection legislation and replace it with a uniform European legal framework. However, the GDPR also contains a number of flexibility clauses which grant national legislators a certain degree of discretion regarding the implementation of the regulation.

The Hessian Data Protection Act was revised at the end of April 2016 and expanded to include freedom of information (HDSIG); in particular, it regulates matters relating to video surveillance and the protection of employees’ personal data.

In order to comply with the requirements of the GDPR, universities in Hesse, as public bodies, must adapt and further develop existing structures and processes in a timely manner.

However, provided that data protection requirements have been complied with to date, no fundamental changes to the handling of data at the university are to be expected; however, there are now stricter requirements regarding transparency and, in particular, the provision of information to data subjects, which are reflected, for example, in the h_da’s new privacy policy and the privacy notices accompanying consents, etc.

In areas where data processing is carried out solely to fulfil the necessary requirements of academic operations, it is particularly important to check whether the existing principle of the ‘necessity’ of data processing is also complied with under the GDPR (‘privacy by design and by default’).

• The scope of the obligations to provide information and disclose details to students is being extended (Articles 13–15 of the GDPR). In accordance with Article 12(1) of the GDPR, data subjects (in this case, students) must be informed about the processing of their personal data ‘in a concise, transparent, intelligible and easily accessible form, using plain and clear language’.
  
  
• The other rights of data subjects are also being extended compared with previous legislation. One new right is the right to data portability (Article 20 of the GDPR).
  
  
• The GDPR provides for extended documentation and evidence requirements. This relates, amongst other things, to demonstrating compliance with the data protection principles (Article 5(2) of the GDPR), the necessary technical and organisational measures (Article 24 of the GDPR) and the use of suitable data processors (Article 28 of the GDPR). Further documentation obligations arise from Article 30 of the GDPR (maintenance of a record of processing activities) and Article 33 of the GDPR (documentation of data breaches).
  
  
• Consent given by employees is only valid under certain conditions (Section 23 of the HDSIG).
  
  
• If processing is likely to result in high risks to students’ personal rights and freedoms, the university must in future carry out a data protection impact assessment (Article 35 of the GDPR). The data protection impact assessment replaces the prior checking mechanism, which was previously regulated under Section 7 of the Hessian Data Protection Act. This must be carried out by the controller; the data protection officer now has only an advisory role in this regard. As part of the data protection impact assessment, the likelihood and severity of potential risks must be assessed, amongst other things, and measures to mitigate the risks must be examined. Where necessary, the university must consult the supervisory authority in advance (Article 36 of the GDPR).
  
  
• Article 25 of the GDPR sets out the principles of ‘privacy by design and by default’. Accordingly, the university must design its IT systems in such a way that the principles set out in Article 5(1) of the GDPR (principles governing the processing of personal data) are effectively implemented. This applies in particular to the requirement of data minimisation. Accordingly, only as much data may be collected as is necessary to fulfil the purpose. Furthermore, IT systems must be configured by default so that only the necessary personal data is processed.
  
  
• The mechanism of data processing on behalf of a controller remains in place (Article 28 of the GDPR). However, the role of the data processor has changed with regard to potential personal liability and the imposition of administrative fines. Existing contracts should be reviewed as soon as possible to determine whether any amendments are required as a result of the GDPR.
  
  
• Furthermore, Article 82 of the GDPR extends civil liability for data protection breaches to include compensation for non-material damage.
  
  
• For the first time, a reporting and notification obligation is also introduced for public bodies (Art. 33 et seq. GDPR).

(Revised information from the Hessian Data Protection Commissioner)