between
Technische Universität Carolo Wilhelmina zu Braunschweig
Represented by the President
and the
Comprehensive Staff Council (Gesamtpersonalrat) of Technische Universität Carolo Wilhelmina zu Braunschweig
Represented by the Chairperson.
Technische Universität Carolo Wilhelmina zu Braunschweig (TU Braunschweig) and its Comprehensive Staff Council conclude the following TU Braunschweig/Staff Council Agreement (hereinafter also referred to as staff council agreement) in accordance with § 78 NPersVG (Niedersächsisches Personalvertretungsgesetz [Lower Saxony Staff Representation Act]) as well as § 66 and 67 NPersVG respectively § 17 NHG (Niedersächsisches Hochschulgesetz [Lower Saxony Higher Education Act]) in their currently applicable versions.
This Staff Council Agreement1 establishes basic rules for the collection and processing of personal data and governs the documentation, procedures, and obligation to provide information between members of as well as persons affiliated to Technische Universität Braunschweig and its institutions that process personal data. Under this staff council agreement, the university may collect and process personal data necessary for the purposes specified in § 17 (1) NHG in order to fulfill its duties. This applies to the data of prospective students and members as well as affiliates of Technische Universität Braunschweig who are not employed by or in a service relationship with the university, for the purposes of enrollment, participation in courses and exams, and the use of university facilities. In addition, the university may process other personal data in accordance with §17 NHG in order to fulfill its other duties. The definitions of the terms related to the processing of personal data are set forth in § 3 of the Lower Saxony Data Protection Act (Niedersächsisches Datenschutzgesetz—NDSG).
The design and selection of data processing systems have to be guided by the goal of processing no personal data, or as little as possible (§ 7 (4) NDSG). Unless the NHG provides definitive data protection provisions in other areas, the Lower Saxony Data Protection Act (NDSG) applies.
As a general rule, the necessary technical and organizational measures to ensure data security have to be implemented regardless of whether personal data is processed in files or using automated procedures.
In accordance with § 17 (1) of the NHG, this staff council agreement governs the processing of personal data of
a) members and affiliates of TU Braunschweig in accordance with § 5 and § 7 of the Basic Regulations of TU Braunschweig,
b) prospective students for the purposes of applying to and enrolling at TU Braunschweig,
c) former university members and affiliates for the purpose of maintaining contact
d) Members and employees of TU Braunschweig’s cooperation partners, provided that they make use of TU Braunschweig’s facilities or other resources in accordance with their contracts.
(1) The collection, processing, and use of personal data are permitted only to the extent that a law, other legal provision, or legal basis, or this service agreement provides for such activities, or the data subject has given consent. They are carried out in accordance with the Lower Saxony Data Protection Act (NDSG). This staff council agreement, together with the Regulations on the Collection, Storage, and Processing of Personal Data dated July 8, 2009, as amended (Appendix III to the Enrollment Regulations), constitutes the legal basis for collecting, processing, and using the necessary personal data in accordance with § 17 (1), sentence 1, of the NHG.
(2) All persons involved in the processing of personal data have to be specifically informed, as part of the hiring process and through annual training, of the obligation to maintain data confidentiality under § 5 of the NDSG, as well as of criminal and administrative offenses according to § 28 and § 29 of the NDSG, and have to confirm this in writing by signing a document. The head of the respective facility is responsible for the annual training.
(3) According to this staff council agreement, personal data may only be collected and further processed as part of an automated procedure if there is a procedure description for the procedures used for this purpose that has been approved by the Data Protection Officer (DPO) of TU Braunschweig in accordance with § 8 NDSG (see the form in Appendix 1) and if the Executive Board of TU Braunschweig has approved the procedure. Before introducing a new automated process for processing personal data or making a substantial change to an existing one, the DPO will determine whether a prior check is required pursuant to § 8a (3) in conjunction with § 7 (3) of the NDSG. As part of this preliminary review, if it has to be conducted, it will be determined whether this procedure, due to the nature of the data to be processed or the use of new technologies, poses specific risks with regard to informational self-determination and the right to ensure the confidentiality and integrity of information technology systems, and whether these risks can be managed through appropriate organizational and technical measures.
(4) The procedure description has to be prepared by the institution responsible for collecting and processing the data and submitted to the Executive Board.
(5) The Executive Board will immediately notify the Data Protection Officer and the relevant personnel representation, provided that the individuals affected by the data collection are covered by the Lower Saxony Staff Representation Act (NPersVG).
(6) The Executive Board, or an institution designated by it, will request an opinion from the Data Protection Officer regarding the procedure description. The Data Protection Officer is responsible for conducting prior reviews of procedures (see paragraph 3); in cases of doubt, the Lower Saxony Data Protection Officer has to be consulted. The Executive Board will then notify the relevant personnel representation to the extent required under paragraph 5. In the event of objections by the employee representation, the procedures set forth in the NPersVG will apply. Additional provisions regarding the participation of the personnel representation may be set forth in a staff council agreement.
(7) Once the Executive Board has approved the procedure, the procedure description is included in a procedure directory and, with the exception of the portion of the description intended for internal use only, is generally published on the university’s website. Upon request anyone may be granted access to these public sections of the procedure descriptions by the Data Protection Officer of TU Braunschweig.
(8) Compliance with the procedure has to be ensured by the responsible and processing personnel designated in the procedure description. The individuals named in the procedure description have to confirm that they have read and understood this task by signing it. Any change in the person designated in the procedure description as the person responsible for or handling the procedure has to be reported to the DPO immediately by submitting an updated procedure description. Regardless of this, the DSB may verify at any time whether the designated individuals are still fulfilling their responsibilities for the procedure.
(9) Personal data must be anonymized as early as possible if it is to be used for statistical analysis beyond the processing of an administrative procedure. Anonymization is mandatory if the data is further processed using other methods or on computers that are not subject to the university’s oversight.
(10) For the purposes of error analysis and troubleshooting, data may be disclosed in a non-anonymized form to an external contractor in exceptional cases, provided that such disclosure is justified. The contractor has to be required in writing to comply with data protection regulations in accordance with the NDSG. Prior approval has to be obtained from the Data Protection Officer. If there is a particularly urgent need to analyze and resolve errors in the central supply system—such as a failure of essential services—and the Data Protection Officer’s approval cannot be obtained on short notice, such approval has to be obtained immediately, along with a detailed justification.
(11) Non-anonymized personal data may be processed only by the institutions specified in the procedure description.
(12) Whenever personal data is discussed in committee meetings, such discussions take place in closed sessions. The parties involved have to be specifically informed of the data confidentiality requirements under § 5 of the NDSG, as well as the criminal and administrative offense provisions set forth in § 28 and § 29 of the NDSG.
(13) The correction, deletion, and blocking of personal data are subject to the provisions of § 17 of the NDSG.
(1) Prospective students, members, and affiliates of the university, as well as members and employees of partner organizations, are required to cooperate in the collection of the data specified in the approved procedure guidelines—to the extent that they are affected—and to apply or use the procedures and facilities provided for this purpose.
(2) Data subjects may view their personal data at the entity listed as the reporting institution in the procedure description.
The staff council agreement has to be published in an appropriate manner in accordance with § 78 (2) of the NPersVG and will enter into force on November 16, 2012, at Technische Universität Braunschweig. It may be terminated with four months' notice prior to the end of the year, effective no earlier than December 31, 2013. Amendments by mutual agreement may be made at any time. Termination and amendments have to be made in writing.
Braunschweig, (date)
TU Braunschweig
The President
Comprehensive Staff Council
The Chairperson
1 The wording of this staff council agreement corresponds to that of Technische Universität Braunschweig’s Regulations on the Processing of Personal Data, which were adopted by the Senate on May 23, 2012, and entered into force on June 12, 2012.