According to Art. 2 para. 1 EU-DSGVO, the EU-DSGVO applies to all bodies that process personal data, whether wholly or partially automated or not, that are stored or are to be stored in a file system. The Data Potection Act of Lower Saxony (NDSG) provides for an extension of the scope of application in that the law also applies to personal data that is neither stored nor to be stored.
The Controller, in the sense of the EU-DSGVO the authority that processes personal data, is responsible for compliance with all rules, requirements and specifications listed in the EU-DSGVO. The principle of the fundamental prohibition of collection of personal data subject to permission (Art. 6 EU-DSGVO) applies to the collection of personal data and is lawful if:
- the data subject has given consent to the processing of his or her personal data for one or more specified purposes;
- the processing is necessary for compliance with a legal obligation to which the controller is subject;
- the processing is necessary for the performance of a task carried out in the public interest;
- processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
- processing is necessary to protect the vital interests of the data subject or of another natural person;
- the processing is necessary for the purpose of the legtimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.
The processing must comply with the principles of lawfulness of processing, fairness of processing, transparency, adequacy, data minimisation, accuracy, storage limitations, integrity and confidentiality, and must be adequately demonstrated in terms of accountability.
For the vast majority of the data collected centrally by the TU Braunschweig, this does not change anything, since they are based on a corresponding legal basis.