EU General Data Protection Regulation

The EU GDPR will apply directly in all EU countries from 25 May 2018. In addition to the EU GDPR, the revised Federal Data Protection Act (BDSG-neu, DSAnpUG-EU) and the revised Lower Saxony Data Protection Act (NDSG-neu) must also be observed.

Key changes from the perspective of data controllers and staff entrusted with the processing of personal data:

• Articles 13/14: Information obligations
  • The information obligations relating to the collection of data are extended under the GDPR. In addition to the requirement for consent under the NDSG, the following points have been added:
    • Contact details of the Data Protection Officer. Recommendation:
      University of Oldenburg
      - The Data Protection Officer -
      Ammerländer Heerstr. 114–118
      26129 Oldenburg
      Email:
      Tel.: 0441-798 4196
      uol.de/data protection/
    • The legal basis for processing. For Consent: Article 6(1)(a) of the GDPR
    • Any additional information regarding data transfers
    • The duration of storage
    • Revision of the withdrawal policy and information on rectification, where applicable
    • The existence of a right to lodge a complaint with a supervisory authority
  • If data processing is not based on informed consent, the information requirements generally still apply, and the scope of the additional information may be correspondingly greater!
  • To fulfil the information obligations, model templates are available for Article 13 GDPR and Article 14 GDPR. Which model template you must use depends on the source from which you collect personal data. If the data is collected directly from the data subject (e.g. through an interview, by filling in a questionnaire, etc.), the Article 13 template must be used. If the data is obtained from a source other than the data subject (e.g. a website, telephone directory, residents’ registration office, other public authority, etc.) , the Article 14 template must be used. The Data Protection Officer will be happy to answer any questions you may have regarding both the correct template and the templates themselves.
• Article 25: Data protection through design and by default (privacy by design, privacy by default)
• Article 28: Data processors
  • Existing data processing agreements must be reviewed and amended to take account of the changed framework conditions.
• Article 30: Record of processing activities
  • The existing form for describing processing operations is being revised, and the existing register of processing operations under the NDSG will be replaced. The procedure for this is currently being prepared.
• Article 33: Reporting of personal data breaches
  • In the event of a personal data breach, this must be reported immediately to the head of the authority or the data protection officer. The further procedure for this is currently being prepared.
• Article 35: Data Protection Impact Assessment
  • The data protection impact assessment replaces the previous prior check under the NDSG. The need for an impact assessment is determined as part of the notification of the processing operation under Article 30. The controller (operator/initiator) of the processing operation is responsible for this. The data protection officer advises the controller.

This list is not intended to be exhaustive. It is intended to serve as a guide and checklist to identify any immediate action required in relation to the GDPR.

Please also note the information in the section Register of Processing Activities!

If you have any questions on this matter, please contact the Data Protection Officer.