Data privacy information according to art. 12ff GDPR (General Data Protection Regulation)
Data processing that takes place in the execution of university law (see in particular Annex 3 of the Education Documentation Act),
as well as student services (e.g. copying system, library system, etc.)
Person in charge
The person responsible within the meaning of the GDPR is the respective rector in accordance with § 2 Paragraph 3 of the Education Documentation Act.
Rektorin Mag. Ruth Petz
+43 1 60118 0
Contact details of the data protection officer
Legal basis and purposes of data processing at Austrian universities (Art. 6 GDPR)
All legal obligations required for the performance of tasks which are in the public interest or which are necessary for the fulfilment of a legal obligation in the course of the administration of the studies (see in particular Annex 3 of the Education Documentation Act). Due to university law, students are legally obliged to provide the necessary personal data.
Student services (e.g. copying system, library system, etc.) and public relations. Insofar as data processing is based on consent, the right of revocation pursuant to Art 7 GDPR exists at any time.
Categories of data
The list of data categories to be processed for the implementation of higher education law is regulated by law in §§ 3ff in conjunction with the annexes to the Education Documentation Act.
Transmission and recipient
- Federal Minister responsible for overall evidence (via the Federal Institute for Statistics Austria) and the evidence on the personnel, operating and maintenance costs of the educational institution;
- Bundesanstalt Statistics Austria
- SourcePIN Register Authority within the scope of its powers under the E-Government Act.
- Institutions according to §7a of the Education Documentation Act
Transfer to third countries or international organisations
In the course of university administration at Austrian universities of teacher education, no data is generally transmitted to countries outside the EU. Data transfers in the course of international mobility programmes (e.g. Erasmus+) are in principle based on consent.
Specified by the respective legal material regulations (see Higher Education Act 2005 in its current version)
Rights of the person concerned
The rights of the person concerned must be asserted against the person responsible. This is according to § 2 Paragraph 3 of the Education Documentation Act the respective rector.
Rektorin Mag. Ruth Petz
+43 1 60118 0
As far as the data processing is based on consent, the right of revocation according to Art 7 GDPR exists at any time.
A data subject has the right to request information as to whether personal data are processed by him or her. (Article 15 GDPR)
Further rights of persons concerned (Art. 16 - 21 GDPR)
- A data subject has the right to request the correction or completion of inaccurate personal data without delay.
- A data subject has the right to request that the personal data be deleted without delay, provided that the reasons specified in Art 17 para. 1 GDPR are fulfilled.
- A data subject has the right to request that the processing of personal data be restricted, provided that the reasons specified in Art. 18 para. 1 GDPR are fulfilled.
- A data subject has the right to receive his/her personal data in a structured, current and machine-readable format, provided that the data processing is based on a consent or contract and is carried out by means of automated procedures.
- A data subject has the right to object at any time to the processing of his/her personal data, unless the data subject proves compelling grounds for processing worthy of protection (e.g. law enforcement), which outweigh the interests, rights and freedoms of the data subject.
Automated decision making
In the area of university administration and performance evaluation, no automated decision-making, including profiling, takes place that has a legal effect on the person concerned or significantly impairs them in a similar manner.
Austrian Data Protection Authority
+43 1 52 152 0
Right of appeal (Art 77 GDPR)
A data subject shall have the right of appeal to the supervisory authority if he/she considers that the processing of personal data concerning him/her is contrary to this Regulation.