Information in accordance with Art. 13 of the General Data Protection Regulation (GDPR)

Status: 10.02.2022

With the following information, KIT provides you with an overview of the processing of your personal data within the KonKIT electronic procedure for immune status to which we are obligated through the Ordinance of the State Government on Infection Protection Measures against the Spread of the SARS-CoV-2 Virus (Corona Ordinance - CoronaVO) in conjunction with the Baden-Württemberg Corona Ordinance on Academic Education Operations (CoronaVO Studienbetrieb).

To implement on-campus teaching under immune status conditions ordered by the authorities, proof of one‘s individual immune status can be provided via the KIT Card. After having registered once, the immune status can be checked when entering a function room. The type of proof will not be stored. The "KonKIT box" serves the purpose of technical implementation.

1. Responsible Institution

Institution responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) and other data protection regulations:

Karlsruhe Institute of Technology
Kaiserstrasse 12
76131 Karlsruhe
Germany
Phone: +49 721 608-0
Fax: +49 721 608-44290
Email: info∂kit.edu

Karlsruhe Institute of Technology (KIT) is a public corporation. It is represented by its President Prof. Dr. Holger Hanselka. KIT’s data protection officer can be reached at dsb∂kit.edu or at KIT‘s postal address with the addition "Die Datenschutzbeauftragte".

2. Type and Scope of Data Processing

Students can scan the QR codes of their immune status proofs using the QR code readers provided at central registration points. Personal data (surname, first name, date of birth and the expiration date of the currently requested immune status) are extracted from the QR code data. Based on the date of birth and the initial letters of the first name and surname as well as the KIT card number, it is checked whether the data of the immune status match the data stored on the presented KIT card. If this is the case, only the expiration date of the immune status will be stored on the KIT card. This is done by writing a data set in the encrypted bwCard app on the KIT Card via a card reader. The data set consists of only two date formats: Registration date, immune status expiration date. To ensure that this proof can also be used if required after the end of the semester, the data as a rule remains valid on the KIT Card until the end of the expiration date and is deleted at the latest when the KIT Card is returned to KIT. The app on the KIT Card can only be read with a key. The two date formats are encrypted additionally. The 3G status/immune status will not be stored. In order to be able to map legally prescribed changes to the validity periods of certain immune statuses, a deadline is set at which all persons who registered before the deadline have to register again. For persons who have registered after the deadline, the current expiration date is automatically stored.

When entering a lecture hall, the KIT card number and the expiration date of the immune status proof are read from the bwCard app by placing the KIT card on a KonKIT box. If the expiration date is in the future compared to the current date, a signal comes from the KonKIT box. This signal can be heard by the supervisory staff and the KIT card holders and serves to check whether there is a valid proof. The result of the immune status check will not be stored. There will be no individual-related assessment.

3. Legal Basis of Data Processing

Data processing is based on Article 6 (1)(c), (2) and (3) of the General Data Protection Regulation (GDPR) in conjunction with § 32 and §§ 28 to 31 of the German Infection Protection Act (Infektionsschutzgesetz - IfSG) and § 6 of the Baden-Württemberg Corona Ordinance on Academic Education Operations (CoronaVO Studienbetrieb).

4. Your Rights

With respect to your personal data, you have

• the right to obtain confirmation as to whether data concerning your person are being processed, obtain information about the data processed, obtain further information about the data processing, and obtain copies of the data (Article 15 GDPR)
• the right to rectification or completion of inaccurate or incomplete data (Article 16 GDPR)
• the right to erasure without delay of data concerning your person (Article 17 GDPR)
• the right to restriction of processing (Article 18 GDPR)
• the right to object to future processing of data concerning your person, provided that the data are processed pursuant to Article 6(1)(e) or (f) of the GDPR (Article 21 GDPR)

You also have the right to lodge a complaint with the supervisory authority about the processing of data concerning your person by Karlsruhe Institute of Technology (KIT) (Article 77 GDPR). Pursuant to Section 25 (1) of the State Data Protection Law (Landesdatenschutzgesetz - LDSG), the supervisory authority for KIT within the meaning of Article 51 (1) GDPR is

The Baden-Württemberg State Commissioner for Data Protection and Freedom of Information