Data protection declaration for the processing of personal data in the context of digital exams

For what purpose will personal data be processed?

Data is processed in order to conduct digital examinations and is part of the responsibility of TUD as a public authority pursuant to § 5 SächsHSFG (Act on the Autonomy of Institutions of Higher Education in the Free State of Saxony).     

Who is responsible for data processing and whom can data subjects contact?

Technische Universität Dresden
Contact:
Vice-Rectorate Academic Affairs
Mommsenstraße 11
01069 Dresden
Email:
Tel.: +49(0) 351 463 34833

TU Dresden’s Data Protection Officer
Mr Jens Syckor
01062 Dresden
Tel.: +49 (0)351 463-32839
Email:

What is the legal basis for the processing of personal data?

Data is processed for digital on-site examinations (i.e. on the premises of TU Dresden) on the basis of Art. 6 para. 1 subpara. 1 lit. e, para. 2 and 3 GDPR in conjunction with § 14 para. 1 sentence 1 no. 1 and 2 as well as § 14 para. 3 sentence 1 SächsHSFG in conjunction with § 7 SächsHSPersDatVO and § 14 para. 3 sentence 2 SächsHSFG in conjunction with the examination regulations of TU Dresden.

The legal basis for data processing in the case of digital remote examinations (i.e. outside the premises of TU Dresden) is Art. 6 para. 1 subpara. 1 lit. a and, if applicable, Art. 9 para. 2 lit. a GDPR (consent).

Which personal data will be processed?

The data specified in § 7 SächsHSPersDatVO are processed (e.g. enrollment number and examination with regard to type, form, subject and date).

In addition, personal data will be processed that can result from the particular type or form of the digital examination in question (e.g. electronic log data; especially in the case of remote examinations characteristics such as the appearance or voice of the data subjects, information from data subjects’ photo IDs for authentication purposes, and information regarding private rooms, if applicable).     

How will personal data be processed and how long will it be stored?

Even though the data for on-site digital examinations is collected electronically, the procedure for conducting these examinations is very similar to the usual procedure for non-digital examinations. For example, PC pools are used to answer questions in a predetermined electronic template instead of submitting answers on a printed piece of paper. The additional personal data that is generated in this process is essentially limited to the electronic log data.

In the case of remote digital examinations, more personal data is processed (see above), in particular in the case of examinations where audio and video feeds of the examiners and examinees are transmitted or where the camera pans across the room in response to suspicious behavior. In these cases, data processing is essential in order to ensure that examinees have as equal opportunities as possible, which TU Dresden is obliged to ensure in accordance with the principle of equal opportunities (Art. 3 Para. 1 GG) and freedom of occupation (Art. 12 GG). However, due to the increased data processing, conducting and taking remote digital examinations at TU Dresden is voluntary in two senses. First, examiners are free to offer remote digital examinations. Second, examinees are given the option of taking the exam in question either as a remote digital exam or as an on-site digital exam, provided that the examiners offer the first option. If examiners offer the remote digital examination and examinees register for and take part in the examination, both parties clearly indicate that they agree to the data processing and therefore consent to it. Examinees may voluntarily and electronically consent to the processing of data for remote digital testing once they have taken note of this data protection declaration.

The personal data will be erased as soon as it must no longer be stored by TU Dresden in order to perform its public tasks and no other legal retention periods prevent their erasure.

Will personal data be transferred to third parties?

Unless stipulated otherwise by law or unless you have given your express consent in individual cases, no personal data will be transferred to third parties.

In order to conduct the digital examinations, various online service providers may be utilized (e.g. BPS Bildungsportal Sachsen GmbH).

Will personal data be published?

Personal data will not be published.

What general rights do data subjects have?

Voluntariness and withdrawal of consent (Art. 7 para. 3 GDPR)

The provision of personal data for digital exams is voluntary. You can refuse or withdraw your consent at any time without stating a reason to the person responsible for the data. Withdrawal can be made electronically, in particular for examinees. Unless the processing is permitted by another legal basis (in particular § 7 SächsHSPersDatVO), your personal data will no longer be processed upon receipt of the withdrawal. The withdrawal of consent shall not affect the lawfulness of the processing that took place on the basis of the consent given prior to withdrawal. In concrete terms, this means: A withdrawal of consent within the period from two weeks before the examination until immediately before the examination date will not have any consequences in terms of data protection law, as data processing will not take place, but will generally lead to withdrawal from the examination pursuant to the decision of the examination committee. If a withdrawal of consent is not made until after the exam, the exam will still be assessed.

Right of access to personal data (Art. 15 GDPR)

You have the right to obtain information on the data processed concerning your person, as well as the possible recipients of this data, at any time. You are entitled to a reply within one month from when the party responsible for data processing receives your request for information.

Right to rectification, erasure and restriction (Art. 16–18 GDPR)

You may request at any time that TU Dresden correct or erase your personal data and/or restrict its processing.

Right to data portability (Art. 20 GDPR)

You may request that the responsible party send you your personal data in a machine-readable format. Alternatively, you can request the direct transfer of your personal data to a different responsible party, insofar as this is possible.

Right to object (Art. 21 GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you in the context of on-site digital examinations. If the legal requirements are met, your personal data will no longer be processed in the future. In concrete terms, this means: Due to the fact that the interests of TU Dresden usually take precedence with regard to the fulfillment of its public tasks and duties, the right to object only comes into effect in absolutely exceptional cases (e.g. if a withdrawal from an examination can be justified under examination law).

Right to lodge a complaint (Art. 77 GDPR)

You can contact TU Dresden's Data Protection Officer (see above) at any time and, in the case of a complaint pursuant to Art. 77 GDPR, the responsible supervisory authority for data protection.

Responsible supervisory authority:
Saxon Data Protection Officer / Sächsischer Datenschutzbeauftragter
Postbox 11 01 32
01330 Dresden
Tel.: +49 351 85471 101
Email:

Note: To claim your rights, it is sufficient to notify the responsible office (see above) in writing (letter, email). You can withdraw your consent to data processing at any time, or you can contact the person responsible for the relevant examination (examiner) directly (no form necessary). However, the rights can only be exercised if the processed data allows for the identification of your person.