Data protection principles

As a general rule, whenever personal data is to be processed, data protection regulations must be observed.
The relevant provisions under data protection law are essentially:

• the European General Data Protection Regulation GDPR, which has been applicable throughout Europe since 25 May 2018

• the German Federal Data Protection Act (BDSG) and, in the Free State of Bavaria, the Bavarian Data Protection Act (BayDSG)

• other so-called sector-specific law (e.g. the Social Security Codes)

The GDPR defines personal data in Article 4 No. 1 of the GDPR as any information relating to an identified or identifiable natural person. A natural person is regarded as identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

These include, amongst others:

• name, date and place of birth, gender, age

• contact details such as address, e-mail address, telephone number

• uniquely assigned identification codes such as identity card numbers, social security numbers, or student registration numbers

• as well as, for example, vehicle registration numbers, IP addresses, fingerprints, eye colour, exam results, bank account details, etc.

According to Article 4 No. 2 of the GDPR, the term processing describes any operation or set of operations which is carried out on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, distribution, or any other form of making available, the matching or linking, the restriction, erasure or destruction.

An important fundamental principle of data protection is the so-called ban with permit reservation⁽²⁾. This means that the processing of personal data is, in principle, prohibited and only becomes lawful if³

• it is expressly permitted or required by law (processing may, for example, be permissible if it is necessary to protect the vital interests of the data subject, Article 6 (1) Sentence 1 lit. d of the GDPR, or to carry out a task carried out in the public interest, Article 6 (1) Sentence 1 lit. e of the GDPR) or

• the data subject has given their consent

Consent is generally the more relevant basis for legitimising practical projects and surveys carried out as part of a degree programme where personal data is to be processed. Further information on consent under data protection law can be found here.

Regardless of the basis on which personal data is processed (whether by consent or another form of legal basis), the information requirements set out in Article 13 of the GDPR must be met. Accordingly, the data subject must be provided with at least the following information – even in the case of photographs or video recordings:

• What personal data is to be processed?

• For what purpose is this data to be processed?

• Who is the data controller / contact person / data protection officer?

• Will the data collected be disclosed? If so, to whom? (If the data is intended to be transferred to a third country or an international organisation, this must also be explicitly stated.)

• How long will the data be stored?

• Information on the data subject’s rights: right of access, erasure, restriction, objection, data portability, and the right to lodge a complaint with the competent supervisory authority (in Bavaria: the Bavarian State Office for Data Protection Supervision

• Information on the right to withdraw consent at any time

If there are plans to publish personal data, it is also appropriate, in the interests of transparent communication, to provide information on the scope of the publication. If, for example, the photographs or videos are to be made publicly available on the internet , this can be done by stating that the data will be accessible without restriction in terms of time or location.

All this information and these notices must be provided to data subjects in accordance with Article 12 (1) of the GDPR in a precise, transparent, comprehensible, and easily accessible form, using clear and plain language. This may be done either in writing or in another form (e.g. electronically).