Processing of personal data is generally prohibited. However, it may be permitted if there is a legal basis for the processing.
–> This is the prohibition with reservation of permission of the GDPR.
There are regularly two options for a legal basis (=permit requirement):
1. Legal basis for permission, e.g. Article 6 paragraph 1 lit. b-f GDPR, §§14-20 BlnDSG, §6 BerlHG, §1 StudDatVO, §14 TMG, §84 LBG or
2. Consent of the persons concerned Article 6 Paragraph 1 lit. a GDPR
For the HWR, consent in accordance with Article 6 Paragraph 1 lit. a GDPR must always be obtained if
there is no other legal basis for authorisation for our official actions, or
if additional personal data is to be collected and processed that is not covered by the authorisation.
Example
A university operates a central IT system to support teaching. The use of the system is mandatory in some degree programmes and regulated in their degree programme regulations. The system also allows students to upload profile photos, express opinions in a chat and link the data to Facebook. These provision of functions and interfaces go far beyond the pure purpose of use to support teaching and are not necessary for this and thus require separate consent. This is because other purposes are pursued with them.
The purposes of the administrative actions of the HWR Berlin are generally anchored in the Berlin Higher Education Act. It contains corresponding authorisation criteria for processing activities. The limits are to be interpreted narrowly. If none of the above-mentioned permissions are applicable, other special legal regulations as well as the provisions of the GDPR must be examined. If there are also no relevant facts, the processing can only be legitimised by consent. For official action, however, this should be the exception.