Privacy
In the following, we inform you about the collection and processing of personal data in connection with a report under the German Whistleblower Protection Act (HinSchG)
Data protection controller within the meaning of Art. 4 No. 7 GDPR
Friedrich-Alexander-Universität Erlangen-Nürnberg
Freyeslebenstraße 1
91058 Erlangen
E-Mail: poststelle@fau.de
Data Protection Officer
Datenschutzbeauftragter FAU
c/o ITM Gesellschaft für IT-Management mbH
Bürgerstraße 81
01127 Dresden
Purposes of data processing
The purpose of data processing is to improve the enforcement of Union law and policies and national law by providing information on breaches.
Legal bases
Art. 6 (1) (c) GDPR, Art. 9 (2) (g) GDPR, § 10 HinSchG
Categories of personal data and origin
|
Number
|
Name of data
|
Origin
|
|
1
|
Name and/or other identifying data of the whistleblower
|
whistleblower
|
|
2
|
Contact details (usually e-mail address) of the whistleblower
|
whistleblower
|
|
3
|
Name and/or other identifying data of persons who are the subject of a report or who are otherwise named in a report
|
whistleblower
|
|
4
|
Contents of the report (including any subsequent additions)
|
whistleblower
|
|
5
|
Documentation of the notification and the procedure according to § 17 HinSchG
|
created by Ombudsperson
|
|
6
|
Verbatim transcript of the (remote) oral report
|
created by Ombudsperson
|
|
7
|
Minutes of the contents of the (remote) oral report
|
created by Ombudsperson
|
|
8
|
Audio recording of the message or meeting
|
whistleblower / created by ombudsperson
|
|
9
|
Perceptions at a meeting
|
Ombudsperson
|
|
10
|
Account data
|
created by Meldestelle / FAU
|
|
11
|
Usage data and logging of changes
|
by using the system
|
|
|
|
|
Categories of data subjects
|
Data Category (No.)
|
Category of affected persons
|
|
1, 2, 4-11
|
whistleblower
|
|
4-11
|
Ombudsmen (employees of the reporting office)
|
|
3-8
|
Persons who are the subject of a report and other persons named in a report
|
Categories of recipients
The identity of the whistleblower is initially only known to the ombudspersons, i.e. employees of the reporting office in the IT Law Unit of the University of Würzburg. The identity of the whistleblower will only be passed on to FAU if this is necessary for any follow-up measures and if the whistleblower has previously consented in text form. If other persons are named in the report, their identity will only be passed on to FAU if they have given their consent or if this is necessary for the follow-up measures. Otherwise, the report will be anonymized and abstracted and passed on to FAU so that confidentiality is maintained. However, the protection of confidentiality does not apply without exception. On the one hand, whistleblowers who report incorrect information intentionally or through gross negligence are not protected. On the other hand, in certain cases provided for by law, information on the identity of whistleblowers may be passed on to competent authorities, such as law enforcement and fine authorities. For further details, please refer to the following tabular overview.
|
Data Category (No.)
|
Receiver
|
Reason for disclosure
|
|
1-11
|
Ombudspersons
|
Operation of the reporting office, including receipt of reports and conduct of proceedings pursuant to Section 17 of the Whistleblowing Act
|
|
1-8, 10,11
|
Sub-processor: University of Würzburg and LegalInnovate Technologies GmbH, An der Niers 6, 47608 Geldern and its sub-processors
|
Operation of the whistleblower platform
|
|
1
|
Competent authorities according to § 9 para. 2 and 3 HinSchG (law enforcement authorities, fine authorities, bodies responsible for taking follow-up measures inside and outside FAU, etc.)
|
Occasions pursuant to § 9 (2) and (3) HinSchG (criminal prosecution, fine proceedings, FAU internal and external follow-up measures, etc.); in this case, the identity of the whistleblower is only disclosed below the requirements of § 9 (1) to (3) HinSchG
|
|
3
|
Competent authorities according to § 9 para. 4 HinSchG (law enforcement authorities, fine authorities, bodies responsible for taking follow-up measures within and outside FAU, etc.)
|
Occasions pursuant to Section 9 (4) of the Criminal Assistance Act (criminal prosecution, fine proceedings, internal and external follow-up measures, etc.); in this case, the identity of the whistleblower is only passed on below the requirements of § 9 (4) HinSchG
|
|
4-7
|
Competent authorities according to § 9 HinSchG (law enforcement authorities, fine authorities, bodies responsible for taking follow-up measures within and outside FAU, etc.)
|
Reasons according to § 9 paras. 2-4 HinSchG (criminal prosecution, fine proceedings, FAU internal and external follow-up measures, etc.)
|
|
|
|
|
Transfer of personal data to a third country
There are currently no plans to transfer data to recipients in third countries.
Envisaged deadlines for the deletion of the different categories of data
|
Data Category (No.)
|
Deletion period
|
|
1-7
|
The data will be deleted three years after the conclusion of the procedure. The data may be retained for a longer period of time in order to comply with the requirements of the HinSchG or other legal provisions, as long as this is necessary and proportionate.
|
|
8
|
The data will be deleted after the protocol has been prepared and released. The protocol is usually prepared within one month.
|
|
9
|
The data is "deleted" when the memory fades, and the confidentiality requirement takes the place of deletion.
|
|
10, 11
|
The data will be deleted when the necessity no longer exists.
|
|
|
|
|
|
Archive law remains unaffected by the deletion periods.
|
Your rights under the General Data Protection Regulation (GDPR)
Under the General Data Protection Regulation (GDPR), you have the following rights:
Information: You can request information as to whether and, if so, which personal data we process about you and receive further information related to the processing (Art. 15 GDPR). Please note that this right to information may be limited or excluded in certain cases (cf. in particular Art. 10 BayDSG).
Rectification: If incorrect personal data is processed, you have the right to rectification (Art. 16 GDPR).
Deletion / restriction of processing: If the legal requirements are met, you can request the deletion of your personal data or the restriction of its processing (Art. 17 and 18 GDPR). However, the right to erasure pursuant to Art. 17 (1) and (2) GDPR does not exist, among other things, if the processing of personal data is necessary for the performance of a task that is in the public interest or is carried out in the exercise of official authority (Art. 17 (3) (b) GDPR) or if there are statutory retention obligations.
Objection: For reasons arising from your particular situation, you can also object to the processing of personal data concerning you by us at any time (Art. 21 GDPR).
If you make use of your rights, we will check whether the legal requirements for this are met. Further limitations, modifications and, where applicable, exclusions of the aforementioned rights may result from the General Data Protection Regulation or national legislation.
Complaint: You have the right to complain to a supervisory authority within the meaning of Art. 51 GDPR about the processing of your personal data. The competent supervisory authority for FAU is the Bavarian State Commissioner for Data Protection, which can be reached at P.O. Box 22 12 19, 80502 Munich or https://www.datenschutz-bayern.de/service/complaint.html. In addition to the right to lodge a complaint, you can lodge a legal remedy in court.
No obligation to provide the data
You are not obliged to provide your data. However, if you do not provide the required data, you will not be able to submit a report or the report cannot be processed.
Legal guarantees
Section 4 of the German Whistleblowing Act creates, among other things, legal protection for whistleblowers and other protected persons by prohibiting reprisals and liability for damages. The confidentiality of the identity of data subjects is protected by §§ 8, 9 HinSchG.
