Data protection policy on University of Münster graduate surveys conducted as part of the Joint Project on Graduate Surveys (KOAB)
1. Name and address of the responsible controller
The responsible controller as defined in the EU General Data Protection Regulation (GDPR) and other national data protection laws of the EU member states as well as other data protection-related provisions is:
University of Münster
represented by its Rector, Prof Dr Johannes Wessels,
Schlossplatz 2, 48149 Münster, Germany
tel.: + 49 251 83-0
email: verwaltung@uni-muenster.de
If you have any questions about the project, please contact the responsible staff member:
Johannes Friederich or Julia Schmidt
2. Name and address of the Data Protection Officer
You can contact the Data Protection Officer at:
Data Protection Office
Schlossplatz 2, 48149 Münster
tel.: + 49 251 83-22446
email: Datenschutz@uni-muenster.de
3. Data processing conducted in connection to the University of Münster Graduate Survey
Scope of data processing
The following personal data is processed in connection with the University of Münster Graduate Survey:
(1) first and last name
(2) date of birth
(3) gender
(4) nationality
(5) type of degree and date of issue
(6) subject of study
(7) postal address
(8) email address
Purposes of data processing
The personal data listed above is processed for the purpose of conducting the University of Münster Graduate Survey.
To ensure that the survey is optimally tailored to its recipients and to prevent the collection and processing of unnecessary data, the University of Münster has forwarded a list of all the degrees issued in the respective examination year to the Institute for Applied Statistics (ISTAT). This list is linked to individual access codes which allow recipients to open the questionnaire and contain details on the examination date (month/year), type of degree (bachelor’s, master’s etc.), the graduate’s subject(s) of study, but does not include names, addresses or student ID numbers. The information on the type of degree and subject(s) of study of the completed degree programme is automatically incorporated into the questionnaire via the access code. This function allows ISTAT to match access codes to the respondents’ answers without linking them to personal identifiers, e.g. names, addresses and student ID numbers. The dataset of survey results, which ISTAT provides the University of Münster, contains no access codes, ensuring that there is no way to identify individual responses to the participants’ names, addresses or student ID numbers.
We send the prospective respondents a personal invitation, signed by the Rector, to participate in the survey. The variant of the survey is determined by the respondent’s type of degree. The dataset also includes the prospective respondents’ postal addresses in Münster. This information is forwarded to the Residents’ Registration Office of the city of Münster. As an inter-administrative service, the Resident’s Registration Office then checks whether a more recent address is on file for the graduates. This data is then updated if necessary and forwarded to the respective University department responsible for its processing. In the case of identical names in the registry, precisely determining the correct address is only possible if other personal data can be used, such as date of birth or nationality. Based on past experience, we have found that comparing names with dates of birth significantly lowers the number of non-identifiable addresses. The prospective survey participants also receive an invitation via email which is either sent to their private email addresses, which they voluntarily disclosed at the time of enrolment, or their University email addresses.
During the field phase, if invitations are returned undelivered, an attempt is made to find the current address. This is done through the forwarding service of the Deutsche Post. If the addressee submitted a redirection order, the letter is forwarded to the new address and the University of Münster department responsible for conducting the survey is informed of the current address. If no redirection order exists, a search for the current address is conducted with the aid of the Meldeportal Behörden NRW (NRW administrative registration portal). The secure, data-encrypted Networks of the German Federal Government (NdB/formerly DOI-Network) automatically obtain the resident registration data from the municipal registration offices.
The stored address information is used for no other purpose than to invite and remind the prospective participants to complete the graduate survey. The respondents’ address information is not shared with third parties. The only exception is if respondents grant consent in the questionnaire to allow their address to be forwarded to the Alumni Club University of Münster und der Universitätsgesellschaft Münster e.V. Respondents who win a raffled prize are asked whether they wish to be mentioned by name on the University’s home page. If they grant consent, their names are posted on the home page; otherwise, their names are not disclosed.
Legal basis for processing personal data
If the operator obtains your explicit consent to process your personal data, Art. 6 (1 a) GDPR serves as the legal basis for the processing of this data.
If processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the University of Münster, Art. 6 (1 e) GDPR in conjunction with § 3 (1) of the NRW Higher Education Act (HG) in conjunction with § 3 (1) of NRW Data Protection Act (DSG) serves as the legal basis for processing. In accordance with § 7 (2) HG, universities are obliged to evaluate how well they are meeting their responsibilities, for example, with respect to teaching. To this end, the University is required to conduct the University of Münster Graduate Survey and is permitted to compile and further process any available data insofar as is necessary for the purpose of administering this survey.
Further recipients of your personal data
The personal data collected in connection to the University of Münster Graduate Survey is forwarded to the following recipients within and outside the University of Münster.
Recipients within the University of Münster:
- Dept. 5.3 – Strategic Planning and Academic Reporting
- Alumni Club University of Münster (by voluntary consent)
Recipients outside the University of Münster:
- Institute for Applied Statistics (ISTAT) GmbH
- Deutsche Post
- Meldeportal Behörden NRW
- Residents’ Registration Office of Münster
- Universitätsgesellschaft Münster e.V. (by voluntary consent)
Duration of storage of personal data
Your personal data which is used for sending the invitation to participate in the University of Münster Graduate Survey is deleted as soon as the final reminder has been delivered. Personal data which is processed for awarding prizes and, if applicable, forwarding your address to the Alumni Club University of Münster or the Universitätsgesellschaft Münster e.V. by prior voluntary consent is deleted as soon as the drawing has concluded, or your address has been forwarded.
If your consent was required for processing, the details are stored until you withdraw your consent, and no other legal grounds exist for processing the data.
4. Your rights as a data subject
Right to rectification and erasure of personal data
You have the right to have inaccurate personal data rectified by us without undue delay. You also have the right to demand that your personal data be erased as soon as the purpose of storage ceases to exist, or, if processing is subject to your consent, when you withdraw your consent, and no other legal basis exists for its further processing.
In accordance with Art. 21 (1) GDPR, your personal data is erased if you raise an objection to its processing and no overriding legitimate reasons exist for its further processing, or when your personal data was unlawfully processed, or when erasure is required in order to comply with legal mandates issued by European or national legislative bodies, to which the University of Münster is subject.
However, the mandatory erasure of personal data as provided above does not apply if the University must process such data in order to fulfil legal obligations imposed by European or national legislative bodies, or in order to perform a task in the public interest or in the exercise of official authority vested in the University, or if the further storage of personal data is required so that the University can assert, exercise and defend its legal claims.
Right to withdrawal
If the processing of your personal data is based on your explicit consent, you may withdraw said consent at any time. All personal data processed prior to withdrawal remains legitimate.
Right to information
You have the right to demand confirmation from the University of Münster as to whether any personal data connected to your person is being processed. If so, you have the right to obtain information concerning what personal data this is and for what purpose it is being processed. You also have the right to information about the duration of the planned storage of this data, or the respective criteria for determining how long this personal data will be stored.
Right to lodge complaint with the supervisory authority
You also have the right to lodge a complaint with the supervisory authority. The responsible supervisory authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Postfach 20 04 44, 40102 Düsseldorf, tel: +49 211 / 38424-0, email: poststelle@ldi.nrw.de.