Data protection management for COVID-19-registrations
As an employer and as a university, the Vorarlberg University of Applied Sciences has certain reporting and information obligations to the health authorities to prevent the spread of COVID-19. The duty of care and loyalty in the relationship between the employer and the employees also obliges the Vorarlberg University of Applied Sciences to have prepared the necessary steps to be taken in the event of a suspected or confirmed case of COVID-19 or official contact tracing and to put the necessary measures in place.
Purpose of the data processing, data categories:
The data are processed to prevent COVID-19 from spreading. On the one hand, the data of persons who have spent time on the university’s premises and in the university’s buildings who have a suspected or confirmed case of COVID-19 will be recorded, while on the other hand data will be recorded to enable contact tracing so those who may have had contact with a person with COVID-19 can be informed as quickly as possible.
Students, employees, external lecturers and other visitors to the Vorarlberg University of Applied Sciences are affected by the data processing. Names, contact details, days and times present and (teaching) events attended will be recorded in particular.
The legal basis for the processing of the information can be found in the employer duties of protection and care and in the considerable public interest in the monitoring of epidemics and their spread (Article 9(2) b) in combination with Article 6(1) c) and f) and Article 9(2) g) in combination with Article 6(1) c) and e) GDPR, and in Section 3 of the Law on Epidemics, from which the duty of disclosure of Vorarlberg University of Applied Sciences arises and Section 5 paragraph 3 of the Law on Epidemics, on the basis of which the Vorarlberg University of Applied Sciences is obliged to provide information to the regional administrative authorities).
The provision of personal information is not prescribed by law. For employees, there is a contractual obligation arising from their employment contracts, on the basis of which they are bound by a duty of loyalty, while for students there is an obligation arising from the student agreements. There is no contractual obligation for all other visitors.
The data collected will be used internally by employees at the Vorarlberg University of Applied Sciences and where necessary forwarded to them. Where necessary on the basis of statutory reporting obligations, the data will be forwarded to the health authorities (regional administrative authorities) for targeted collaboration.
Duration of storage:
The data collected will be archived until the purpose of infection avoidance has been fulfilled and no further inquiries from the authorities are pending and the Vorarlberg University of Applied Sciences no longer needs the data as evidence for official measures or other reporting obligations. The data will of course be treated as confidential and only passed on to third parties in the event of a legal obligation to do so or under strict compliance with the data minimisation principle.
Your data protection rights according to the GDPR:
We kindly wish to note that within the scope provided for under the law, you have the right to information, correction, deletion and restriction of the processing and the right to object to the processing of your personal data. If you have any queries or requests in connection with this, you can contact email@example.com.
If the processing is carried out on the basis of consent, you can withdraw this at any time by emailing firstname.lastname@example.org. If the processing is carried out on the basis of the justified interests of the Vorarlberg University of Applied Sciences, you can make a justified objection to this. This does not affect the legality of the data processing carried out up to the point of the withdrawal or objection.
If you believe that unlawful data processing is being carried out, please contact us on email@example.com. You also have the right to complain to the Austrian Data Protection Authority as the competent supervisory authority.
Responsible for data processing:
Fachhochschule Vorarlberg GmbH, Campus V
Hochschulstraße 1, 6850 Dornbirn
firstname.lastname@example.org, +43 5572 792-0
Data Protection Officer contact:email@example.com
If you have any questions or concerns about data protection at the Vorarlberg University of Applied Sciences, our internal contact would be happy to help. You can contact them via email on firstname.lastname@example.org.
This text is published in German and English. In case of ambiguities or disputes the German version shall be binding.