Regulations for the Protection of Personal Data when Using E-Learning Procedures at the University of Wuppertal

of the Bergische Universität Wuppertal of 10.10.2012.

Published: AMTLICHE MITTEILUNGEN,Verkündungsblatt der Bergischen Universität WuppertalPublished by the RectorVolume 41, No. 57, Date 10.10.2012.

On the basis of § 2 para. 4 in conjunction with. §§ 3 Abs. 1 und 4 Abs. 2 S. 2 des Gesetzes über die Hochschulen des Landes Nordrhein-Westfalen (Hochschulgesetz - HG) vom 31. Oktober 2006 (GV. NRW. S. 474), zuletzt geändert durch Gesetz vom 31.01.2012 (GV. NRW. S. 90) hat die Bergische Universität Wuppertal folgende Ordnung erlassen.

§ 1 Scope of Application

(1) These regulations apply to the collection, processing, and use of personal data of users of e-learning procedures used at the University of Wuppertal for the purpose of imparting academic education.

(2) If a uniform data processing procedure is carried out at least also for e-learning purposes, the provisions of these regulations shall also apply to this procedure.

§ 2 Definitions

For the purposes of these Regulations

1. e-learning procedures are network-connected learning, teaching and testing procedures which collect, process and use personal data for the purpose of academic training and which aim to promote the learning of users and to provide evidence of their performance,

2. users are teachers, students, secondary listeners and guest listeners as defined by the currently valid enrollment regulations of the University of Wuppertal,

3. persons responsible for e-learning procedures are all university offices that provide e-learning procedures or mediate access to their use. In particular, these are the ZIM and the lecturers who use a procedure as part of a course.

§ 3 Principles

(1) When using e-learning procedures, the person responsible may collect, process or use personal data of the users insofar as this regulation or another legal provision expressly permits this. Personal data of these persons may then also only be made accessible to the public or to members of the university or to participants in a course or to the person responsible for the e-learning procedure if this is necessary to achieve the purpose of the specific e-learning procedure.

(2) The person responsible may use personal data of users for purposes other than those specified in paragraph 1, provided they have given their consent. The processing of data concerning the racial or ethnic origin, political opinions, religious or ideological beliefs, trade union membership, health or sexual life of users for e-learning purposes is only permitted on the basis of the explicit consent of the users concerned relating to this data.

§ Section 4 Duties of the Person Responsible

(1) For each e-learning procedure, the person responsible shall describe the type, scope and purposes of the collection and processing of personal data as well as the rights of the parties involved in a brief, generally understandable data protection concept. He or she must make the data protection concept available to users before they register for an e-learning procedure and keep it available at all times until the e-learning procedure is completed.

(2) The person responsible shall enable the use of the e-learning procedure anonymously or under a pseudonym, insofar as this does not contradict the purposes stated in Section 2 No. 1 and is technically possible and reasonable.

§ Section 5 Inventory Data

The person responsible may only collect and use personal user data such as name, address, matriculation number, field of study, semester of study or e-mail address to the extent that it is required for registration or for the use of e-learning procedures at Bergische Universität Wuppertal.

§ 6 Usage Data

(1) The person responsible may only collect and use personal data of a user such as, in particular, features for his/her identification, information on the beginning and end as well as the scope of the respective use or information on the individual e-learning procedures used by him/her, insofar as this is necessary for the use of these procedures.

(2) The person responsible may combine the usage data of a user on the use of different e-learning procedures, insofar as this is necessary for the purposes stated in § 2 No. 1.

§ 7 Content Data

The person responsible may collect, process and use communication content of any kind from users, without prejudice to copyright regulations, insofar as this is necessary for the purposes specified in § 2 No. 1.

§ Section 8 Research

(1) For the purpose of scientific research, the data controller shall process the data specified in §§ 5, 6 and 7 only in anonymized form. If scientific reasons prevent anonymization, the data may also be processed if they are pseudonymized and the group of persons involved in the research or the receiving agency or person does not have access to the assignment function. Data collection, anonymization or pseudonymization may also be carried out by the persons involved in the research if they have previously been sworn to secrecy in accordance with the Obligations Act and are under the supervision of the transmitting body.

(2) If anonymization or pseudonymization is not possible, personal data may be processed for a specific research project if

1. the data subject has consented,
2. the interests of the data subject which are worthy of protection are not impaired due to the nature of the data or the type of use, or
3. the purpose of the research cannot be achieved in any other way or can only be achieved at disproportionate expense and the public interest in carrying out the research project outweighs the legitimate interests of the data subject.

(3) Data processed for scientific purposes may only be published if

1. the data subject has consented, or
2. the public interest in the presentation of the research result significantly outweighs the interests of the data subject that are worthy of protection.

(4) Section 28 of the Data Protection Act of North Rhine-Westphalia shall remain unaffected.

§ Section 9 Recording and Transmission of Courses

(1) The recording and simultaneous or delayed transmission of a course shall be permissible if this is required by the educational mandate of the university and if it is technically and organizationally ensured that only persons participating in the course can take note of the recording. The participants must be informed about the recording and transmission of a course prior to the recording (live streaming, later access by course participants).

(2) Recording for simultaneous or time-delayed transmission for external access by the public, e.g. via the Internet, is only permissible if participants have been informed about the recording prior to the recording and if they, including individual contributions to the lecture, are not recorded in a way that can be individualized. If the purpose of the recording and transmission (e.g. also public relations work; also advertising) requires that (individual) participants are also recognizable, their prior consent to the recording and transmission must be obtained. The right to one's own image, in particular the provisions of the German Art Copyright Act, shall remain unaffected.

§ 10 Consent

(1) Consent is only effective if it is based on the user's free decision, in particular one made without social pressure. The user shall be informed of the intended purpose of the collection, processing or use and, if necessary, of the consequences of refusing consent. Consent must be given in writing, unless another form is appropriate due to special circumstances. If the consent is to be given in writing together with other declarations, it shall be specially emphasized.

(2) The written form shall be replaced by the electronic form if the person responsible ensures that the user has given his or her consent consciously and unambiguously, the consent is logged, the user can retrieve the content of the consent at any time and revoke it at any time with effect for the future. If the user has revoked his or her consent, his or her personal data shall be deleted or made anonymous, provided that no regulations require their further storage. If the deletion or anonymization makes it impossible to evaluate a performance record, the user must be informed of this before the deletion or anonymization. Participation in a course may not be made dependent on the user's consent to the use of his or her data for other purposes.

§ 11 Storage periods

(1) The inventory data specified in § 5 shall be stored until the user de-registers. At the user's request, this data may be deleted earlier. Inventory data of secondary students and guest students as defined by the currently valid enrollment regulations of the University of Wuppertal shall be stored for as long as they are allowed to attend courses at the University of Wuppertal.

(2) The usage data specified in § 6 must be deleted immediately after the usage process, unless they are required for the implementation of an e-learning procedure.

(3) The content data specified in §§ 7 and 9 must be deleted by the end of the respective semester in which the e-learning procedure is used. If the content is to be used further, it shall be anonymized.

§ 12 Data security

(1) The person responsible shall take the necessary technical and organizational measures to adequately protect the data collected and used on the basis of these regulations against misuse. Measures are necessary if they are required by the purpose of the specific e-learning procedure and their expense is in reasonable proportion to the intended protective purpose.

(2) Insofar as this is necessary according to the data protection concept of the respective e-learning procedure, measures shall be taken in particular which are suitable for ensuring that

1. the purpose limitation of collected data is maintained
2. only authorized persons can access the data subject to their access authorization and personal data cannot be read, copied, changed or removed without authorization,
3. it can be subsequently checked and determined whether and by whom personal data has been entered into data processing systems, changed or removed and to which bodies it has been passed on,
4. personal data is protected against accidental destruction or loss.

§ Section 13 Entry into force, time limit

These regulations shall enter into force on the day following their publication in the Official Notices as the promulgation journal of the University of Wuppertal.

Issued on the basis of the resolution of the Senate of the Bergische Universität Wuppertal of 04.10.2012.

Wuppertal, 10.10.2012 The Rector of the University of Wuppertal University Professor Dr. Lambert T. Koch