Zoom

For virtual meetings within the university administration as well as online events, online courses and webinars in teaching and research, the tool DFNconf and the tool Meet are available. The EvaSys tool can also be used for digital polling. If these tools are not suitable — i.e. not sufficiently effective — to perform the required tasks, the tool Zoom may be used. Zoom has been approved for use by the university management.

LMU provides central EDU licenses for the use of Zoom (the scope of functions corresponds to the business license). Please note that Zoom should only be used in its version 5.0 or later, as certain aspects of data protection (such as end-to-end encryption, E2EE) are only supported from this version.

As of February 2023, LMU has switched to the Zoom X product, which is operated by the German company Telekom. Zoom X is hosted exclusively on servers in Germany. When deploying Zoom, it was taken into consideration that Zoom made numerous changes, closed security gaps, and fixed technical bugs. Zoom also adapted the data protection guidelines and adopted the EU standard contractual clauses right after the EU-US Privacy Shield was declared ineffective. It should also be considerered that Zoom reacted immediately to any criticism from the supervisory authorities and took necessary measures (e.g. offering end-to-end encryption). Moreover, Zoom offers numerous settings for users in order to further increase data security. Suitable alternatives are also available free of charge for confidential communication.

• The use of Zoom is intended to fulfill the legal obligations of LMU and to facilitate, promote and improve cooperation. The use for private purposes under the licenses provided by LMU is prohibited.
• The Zoom business licenses provided by LMU may only be used by LMU members.
• Behavioral and performance control, as well as the recording of personal statistics when using Zoom does not take place and is inadmissible.
• The use of external (third-party) Zoom-Marketplace applications is not permitted. External (third party) Zoom-Marketplace applications may not be connected to other central IT services of LMU.
• The Zoom client (see "Registration and Login”) must be updated as needed or requested to avoid security vulnerabilities.
• The minimum age for using Zoom under the licenses provided by LMU is 16 years.
• As a rule, no content should be exchanged through this service that requires a high level of protection or is strictly confidential. It is not permitted to use Zoom when communication includes or processes special categories of personal data, e.g. health data, or data that are classified as top secret, confidential, classified or classified for official use only. Similarly, sensitive communication such as health service counseling sessions, communication regarding personnel file data, or disciplinary proceedings should not be conducted via Zoom.
• As a rule, the service should not be used to carry out appointment procedures or job interviews. For these purposes you can use DFNconf or LRZ meet, or use other tools from other German or European providers that are classified as secure by LMU.
• Invitations to Zoom sessions may normally only be sent to and from LMU official email addresses. If external persons have to be involved in Zoom sessions, their official email address must be used. As a rule, existing secure channels, e.g. Sync&Share, LMU teams or shared drives, should be used for the exchange of protected files between participants.
• As a rule, higher education examinations should only be carried out via Zoom in justified exceptional cases, in particular where other appropriate options are not available.
• If records of meetings are saved and/or polling or voting take place within Zoom, this must be communicated in advance in a transparent manner to all participants.
• You may only use the internal Zoom chat funktion during your video conference. Outside of video conferencing, you may use the official instant massaging Tool LMU-Chat.
• Please note that no contact details of LMU members are stored or may be stored in Zoom Chat.

• The fulfillment of LMU duties requires that unauthorized disclosure of personal data to third parties is ruled out and that data secrecy is safeguarded. Furthermore, the data protection notices regarding Zoom (data protection information for the use of Zoom at the LMU) must be observed.
• All content in Zoom (video and chat messages) is encrypted by default during transport, however the key is generated by Zoom itself and stored in the Zoom servers. The best possible data protection for your Zoom meeting can be achieved if ALL meeting participants activate their E2EE setting in their personal Zoom accounts and apply this setting to the scheduled video meeting. In this case, no one – not even Zoom- except the individual participants will have access to the meeting content (chat messages included). This advanced encryption is not available for meetings via browser. For the best protection, you and your meeting participants must use Zoom with the Zoom client or with the Zoom app for mobile devices.
• Zoom meetings must be protected with an additional password. This also applies to meetings and webinars planned before 01.03.2021. If you have not previously assigned an identification code for a meeting or webinar, a code will be automatically assigned as part of the changes and the new link of the meeting or webinar must be sent again to the participants.
• The access data for Zoom meetings may only be disclosed to the participants. The publication of access and meeting data on websites, social media or other channels is not permitted.
• Activating the waiting room is optional, but standard for new meetings.
• It is possible to create meetings only for authorized participants (see registration). This is the standard for new meetings.
• If records of meetings are created or interviews take place, this must be communicated in advance in a transparent manner. A record of any meeting may only be produced and saved with the express consent of the participants concerned and only insofar as this is necessary under the applicable law and for the purposes of the service or for the specific task. A link to the standard declaration of consent can be found under the section “Consent to record an online event”. The Zoom app (Zoom client) shows in real time when a recording is taking place.
• Surveys within Zoom are to be conducted anonymously as a general rule. The setting for anonymisation of responses must be explicitly selected by the organisers (moderators) in advance. Further information on the settings for surveys can be found on the Zoom website “Polling for Meetings".
• Please also note the general instructions on how to use video conferencing in the service portal (service variant: Use of a camera for the purpose of video conferencing) as well as the information regarding working remotely from home in the service portal (service variant: BYOD Bring Your Own Device and Home Office).

All employees of LMU have a personal ZOOM license available for the organisation of online events, which is active after a first registration. A further registration directly with ZOOM is not required for the use of the videoconferencing service. For data security reasons, it is recommended to log in exclusively with your LMU user ID via “Single Sign-On” (SSO) to lmu-munich.Zoom.us or by Zoom client. Further information can be found on the website of the IT-service-desk video conferencing and online teaching with ZOOM.

From 17.07.2021, Zoom users will have the opportunity to change their own name (where appropriate, the pronoun), which is visible to the organisers and other participants within the Zoom event.

In principle, the mere participation in an online event without registration (without entering the LMU user ID and without personal details of the participants) is possible by link and is particularly relevant for students. By default and with the updated LMU-wide Zoom settings, participation in online events is limited to people who have logged in to Zoom via an LMU user ID. This setting can be turned off individually in the organizer’s personal Zoom account to enable participation without registration and without identification.

For more information about how to authenticate your participants, see the Zoom website, Change your meeting recording and telephone settings.

As far as it is necessary for the performance of LMU duties (e.g. technical support) or for didactic purposes (e.g. training courses), you can allow a participant in your videoconference to temporarily control your device for that specific purpose. For your protection, the default setting of this option is turned off; you must explicitly activate the option in your profile. In addition, you will be asked to actively allow the remote control within your meeting. If you have agreed, the fact that your device is being controlled remotely will at all times remain visible to you. The prerequisite for using the remote control function is that you have taken all the necessary measures to protect yourself and others against abuse:

• You should know without doubt the identity of the person to whom you are allowing remote control.
• Remote control is limited to the required scope, permitted purposes and, in principle, to LMU members.
• You must ensure that no misuse, in particular unauthorised access to official data and no unauthorised data retrieval, is possible. For this purpose, you should, among other things, close all systems and documents that are not required for the session and log out from any services prior to activation. You should use your own PC profile for the session, or a specific demonstration device containing no personal or official data, or from which personal or official data cannot be easily accessed.
• While remote control is active, you need to actively monitor your PC at all times to prevent misuse.
• You can stop remote control at any time by clicking this option on the context button. The remote control shall be terminated as soon as the purpose is fulfilled.

The remote control option should generally remain deactivated in your personal profile and should only be activated session-wise if strictly necessary.

Zoom is operated by Zoom Video Communications, Inc. (website of the service provider Zoom).

Zoom X is operated by the company Telekom Deutschland GmbH.

To use this service, you need to agree to Zoom’s terms, Zoom’s privacy policy and the Terms of Use, and to take note of LMU’s privacy information regarding the use of Zoom. The current terms and conditions of use of the LMU are available under user guidelines for information processing systems of the Ludwig-Maximilians-Universität München. The terms of use applicable at the time of use shall be decisive.

The decision to activate the user account for Zoom is voluntary. It is not possible to use Zoom without your consent.

Please find more information regarding the use of Zoom at LMU in the following pages:

• Declaration of consent for the admission of the online event
• Note for employees of the LMU: Further information on the use of Zoom can be found in the LMU service portal
• System requirements for Windows, MacOs and Linux
• Get started with Zoom
• How do I test or connect my computer audio?
• How can I test my configuration?
• How can I attend an online meeting (e.g. an online seminar)?
• Information on the possibility of voting

Please note that this IT offer may be temporarily unavailable, e.g. due to maintenance work. As far as possible, we will inform you about any service interruption.

The materials and contributions made available within Zoom sessions are normally protected works under copyright and personal rights. The materials and content exchanged and the contributions concerned may only be used for official purposes or for students’ own study purposes. Unauthorized disclosure to third parties is expressly prohibited. This applies in particular to film and sound recordings as well as to courses or lessons offered as part of a live stream. Non-compliance with copyright and personal rights of third parties is not a bagatelle. Unauthorised exploitation (e.g. reproductions or sale) and communication to the public (e.g. sharing the content on social networks) will be sanctioned.

Translation of version: August 2023

We would like to inform you below about the processing of personal data in connection with the use of Zoom.

The use of Zoom at the Ludwig-Maximilians-University (LMU) is due to the need to maintain ongoing university operations, even in the event of absences from the place of employment. The concerns of data protection and in particular the requirements of the General Data Protection Regulation are taken into account.

We use the videoconferencing service in administration, teaching, research and training to conduct virtual meetings, telephone conferences, interactive online courses and/or webinars (“online meetings”).

The purpose of data processing is the use of Zoom as a tool for cooperation in the context of official activities at the LMU for the fulfilment of legal obligations and university tasks in accordance with Art. 2 BayHIG, in particular for ensuring and supporting teaching and research operations.

The processing operations include the use of the licensed products and services, the provision of updates, the guarantee of information security and technical and customer-related support.

Data processing for purposes other than those specified or permitted by law (e.g. for internal review of security systems and to ensure internal network and information security in accordance with Article 6(1) of the BayDSG) does not take place.

Use of Zoom for private purposes within the framework of the LMU licenses provided is not permitted.

There is no performance or behavior control by the LMU based on your use of Zoom. The use of Zoom to compile personal statistics is not permitted.

In the context of the use of Zoom at LMU, the controller and the users must ensure that no unauthorised data processing takes place. In addition, the use must ensure that the confidentiality of business matters is maintained.

Before using Zoom, the possible data protection settings must be made in such a way that personal data are processed by Zoom only for the aforementioned purposes and within the scope of applicable law. The data protection principles, in particular privacy by default, data minimization, storage limitation, confidentiality and purpose limitation, must be observed.

Zoom is to be used in the current version, necessary updates are to be made.

Through appropriate settings in Zoom and in the hardware and software used, the setting of advertising cookies and tracking, e.g. by Google Analytics, Google Ads, can be excluded.

If an audio transmission is sufficient for the respective purpose, the image transmission should be switched off. Any chat functions are only to be used insofar as this is necessary for the respective task fulfilment.

To protect privacy, you should replace your background with a fade-in. Your head can still be seen, but your environment can't. In the service portal, the LMU provides suitable background information.

Chat, question or survey functions shall only be used to the extent that they are absolutely necessary for the respective purpose in the course of fulfilling the task.

In some cases (e.g. prolonged unavailability of the service) it may be necessary to contact you. If there is no equivalent or better way to inform you, we will use your personal data to contact you, e.g. via the LMU information service.

For your user profile, you only need to enter your name and your official e-mail address (@lmu.de) in the initial filling. On a voluntary basis, you can enter further information and edit it yourself at any time. In the context of use, however, only the data that is actually necessary for the respective use should be provided and used. Attention must be paid to data-saving use.

Categories of personal data concerned by the processing

We only process the personal data that you have provided to us or that we have received about you in an admissible manner in the course of our activities at LMU (Art. 4 para. 2 BayDSG). In order to use Zoom, the following personal data is required from you

• surname
• forename
• Official e-mail address (@lmu.de)

As part of the use, further personal data may be processed by Zoom. This depends on the settings selected in each case and the content used in the context of use.

The following personal data are subject to processing:

• User details

First name, last name, telephone (optional), e-mail address, password (if single sign-on is not used), profile picture (optional), department (optional).

For security reasons, it is strongly recommended to always log in to Zoom with single sign-on.

• Meeting metadata

Topic, description (optional), subscriber IP addresses, device/hardware information (including IP address, MAC address, ID of other devices used in connection with the Zoom account (unique device identifier, browser, operating system, version of the Zoom client).

• For recordings (optional)

MP4 file of all video, audio and presentation recordings, M4A file of all audio recordings, text file of the online meeting chat, text file of all chats in the meeting, audio log file.

• For interviews/votes (optional)

Capture responses with participant names as presets. These results will be displayed to the organisers (“moderators”) after the interview has been conducted.

• When dialing in by phone

Information about the incoming and outgoing phone number, country name, start and end times. If necessary, other connection data such as the IP address of the device, the 911 address (registered service address), the host name, the host email and the MAC address of the device used may be stored.

• Text, audio and video data

You may have the option of using the chat, question or survey functions in an online meeting. In this respect, the text entries made by you are processed in order to display them in the online meeting and, if necessary, to log them.

In order to enable the display of the video and the playback of audio, the data is processed by the microphone of your terminal as well as by a possible video camera of the terminal according to the duration of the meeting.

You can switch off or mute the camera or microphone yourself at any time via the zoom applications.

Logging of attendance

The setting "Users must register" creates an overview of all those present, which can be viewed by the organizer. In principle, the attendance list will not be made available to the participants.

Data collection for the purpose of checking attendance or participation is permitted under data protection law if there is an attendance requirement for the respective event (e.g. there would also be an attendance requirement in attendance) and proof of participation must be maintained or created. This results for student events regularly from the examination and study regulations. If data is collected only to prevent unauthorized use and to ensure proper and trouble-free execution of the session, the data must be deleted as soon as the event has ended or the purpose has been achieved.

registration

In order to participate in an online meeting or to enter the meeting room, you must provide at least information about your name even without registration. It can also be a fantasy name. Alternatively, after logging in to Zoom, you have the option of adjusting the name (including pronouns, if applicable) that is visible to all other participants within Zoom meetings via your own account settings. This self-chosen name (may also be a "fantasy name") is not stored in the attendance list and cannot be traced back to you by the organizers.

Cookies

For more information on the processing of cookies in the context of the use of Zoom, please refer to the Zoom website for information on cookie policy.

Zoom view

The presets in Zoom should be selected in such a way that no automatic recording takes place. A recording may only be made with the express consent of all participants concerned (you can obtain a corresponding consent form via the link Consent to the recording of an online event) and only to the extent that this is absolutely necessary within the framework of applicable law and for official purposes or for the concrete performance of tasks. A recording without the consent of the persons concerned is punishable by law.

In particular, copyrights and the personal rights of the persons concerned must be observed and preserved in records. In order to maintain accessibility, appropriate processing rights must be granted. Zoom allows the use of watermarks so that distribution can be controlled in the event of a recording.

When using Zoom, care must be taken to ensure that smart devices, such as Alexa, Siri, Google Home, are not in the scope of application or are active in order to prevent unauthorised data processing or recording.

Recordings may only be stored (locally) on LMU's internal servers or data carriers. Recorded events may only be stored for as long as this is necessary for the fulfilment of the respective task and as long as there is no obligation to delete them.

If recordings and/or interviews are carried out, this must be communicated transparently in advance. The fact of recording is displayed to the participants in the Zoom app and must be kept transparent throughout the recording time. In the case of surveys, the storage of the answers without personal data can only be initiated by the organizers and for the specific survey in advance by explicitly switching to "carry out anonymously". This option is preferred by the organizers. Surveys, which are not conducted anonymously, show the organizers the results with details of the participants' names.

Chat logs

If it is absolutely necessary for the purposes of logging the results of an online meeting, IM chat logs can be stored. This must first be made transparent to the participants. As a rule, logging and recording chats are not required.

In the case of webinars, questions asked by webinar participants may be processed for the purposes of admissible recording and follow-up of webinars.

ballots

Voting can be open (by electronic hand signal, personal hand lifting during an image transmission) or secret. Special statutory provisions on voting remain unaffected and must be observed.

Automatic decision-making, profiling

A use of Zoom in the context of automatic decision-making within the meaning of Art. 22 GDPR or for profiling does not take place and is also not permitted.

Attention monitoring

Zoom no longer offers this option. The function is no longer available in the LMU zoom.

The data processing is carried out in accordance with and on the basis of the General Data Protection Regulation (GDPR), the Bavarian Data Protection Act (BayDSG) and the other applicable data protection regulations.

The processing of personal data in the context of the use of Zoom is based on the following legal bases:

• for the (voluntary) use of Zoom and the recording in accordance with Art. 6 (1) (a) GDPR (consent)
• for the performance of service tasks pursuant to Article 6(1)(e), (2) and (3) GDPR in conjunction with Article 4(1) of the BayDSG, Article 2 of the BayHIG and Article 12 of the BayHIG
• for teaching in accordance with Art. 6(1)(e) GDPR in conjunction with Art. 4(1) BayDSG in conjunction with Art. 76(2) BayHIG
• for employees pursuant to Article 6(1)(b) of the GDPR in conjunction with Article 4(1) of the BayDSG in conjunction with Section 3a(1) of the ArbStättV
• for data processing in the context of contractual relationships (e.g. with contractual partners) in accordance with Art. 6 (1) (b) GDPR

The provision of necessary personal data in the context of the use of Zoom is mandatory and justified for LMU employees in the context of the employment relationship. For students, the use in courses without compulsory attendance is voluntary (Art. 6 (1) (a) GDPR). Students have the option of taking exams in person (cf. § 8 BayFEV). The decision as to which videoconferencing system is used lies with the service responsible for the respective task.

Zoom is a remote conferencing service headquartered in San Jose, California. Since February 2023, LMU has switched to the product Zoom X, which is operated by the German company Telekom in partnership with the company Zoom. Zoom X is hosted exclusively on servers in Germany and a large part of Zoom X's customer support is now handled in Germany. A contract processing agreement is in place with Telekom Deutschland.

Zoom also largely complies with the data protection guarantees pursuant to Art. 44 et seq. GDPR. The appropriate level of data protection is guaranteed, among other things, by the conclusion of so-called EU standard contractual clauses between Telekom Deutschland and Zoom. The data processing takes place in a third country insofar as no pure browser application is used. Zoom has also concluded corresponding standard contractual clauses with its subcontractors (cf. Art. 46 GDPR), see table section ‘Disclosureand recipients of personal data’ To the extent that data should continue to be transferred to the USA, e.g. specific metadata or pseudonymised data, this is done on the basis of standard contractual clauses that have been agreed with Zoom. In addition, further technical and organizational measures have been implemented. The video transmission is end-to-end encrypted from version 5.0, which is also to be used under the license agreement. In addition, the processing of special categories of personal data within the meaning of Article 9(1) GDPR is not permitted.

Personal data processed in connection with the use of Zoom will not be disclosed to third parties unless they are specifically intended for disclosure.

The provider Zoom and its partner, Telekom Deutschland GmbH, as well as any subcontractors, necessarily receive knowledge of the processed data, insofar as this is necessary or provided for in the context of the order processing contract or any contractual relationships with subcontractors.

Zoom Approved Processors

The approved sub-processors process personal data on the basis of the standard contractual clauses. A table with all sub-processors can be found in the Zoom Approved Processors section at the bottom of the page.

A deletion of data takes place:

• 7 days after revocation of consents required for publication and storage of the recording.
• Alternatively: After the necessity for publication and storage of the recording has ceased to exist
• Locally stored records are deleted after their own deadlines
• Locally stored chat messages are deleted if they are older than 30 days.

You can delete your user account in Zoom itself at any time, the necessary information can be found on the Zoom website ‘How do I cancel my account?’ (external link). The official account must be deleted as soon as the service is no longer needed for the performance of the duties, at the latest when leaving the LMU.

If you are registered with Zoom as a user, reports about online meetings (meeting metadata, dial-in data, questions and answers in webinars, survey features in webinars) can be stored with Zoom for up to one month.

Responsible for data processing

The controller of the data processing directly related to the organisation of “online meetings” is:

Ludwig-Maximilians-University of Munich

Geschwister-Scholl-Platz 1

80539 Munich

Note: As far as you access the Zoom website, the provider of Zoom is responsible for data processing. However, access to the website is only necessary for the use of Zoom in order to download the software for the use of Zoom.

You can also use Zoom if you enter the respective meeting ID and, if necessary, other access data for the meeting directly in the Zoom app. If you do not want to or cannot use the Zoom app, then the basic functions can also be used via a browser version, which you can also find on the Zoom website.

Competent Data Processing Service

Ludwig-Maximilians-University of Munich
Department VI - Information and Communication Technology
Geschwister-Scholl-Platz 1
80539 Munich
VI@verwaltung.uni-muenchen.de

General questions and support

Ludwig-Maximilians-University of Munich
Department VI - Information and Communication Technology
IT Service Desk
Geschwister-Scholl-Platz 1
80539 Munich
it-servicedesk@lmu.de

Contact details of the LMU's official data protection officer

Ludwig-Maximilians-University of Munich
-- Official data protection officer --
Geschwister-Scholl-Platz 1
80539 Munich
Tel.: 089-2180-2414
https://www.lmu.de/data protection

If the legal requirements are met, you have the right to receive information about the data stored about you (Art. 15 GDPR). If incorrect personal data is processed, you have the right to rectification (Art. 16 GDPR). In addition, when submitting the legal requirements, you have the right to erasure (Art. 17 GDPR), restriction (Art. 18 GDPR), data portability (Art. 20 GDPR).

In addition, for reasons arising from your particular situation, you can also object to the processing of personal data concerning you by us at any time (Art. 21 GDPR) and revoke any consent given for the future. If the legal requirements are met, we will no longer process your personal data as a result. The lawfulness of the data processing carried out on the basis of the consent until the revocation is not affected by this (Art. 7 GDPR).

In addition, pursuant to Article 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority. The data protection supervisory authority responsible for the LMU is the Bavarian State Commissioner for Data Protection, Wagmüllerstraße 18, 80538 Munich (website of the Bavarian State Commissioner for Data Protection, external link).

Should you wish to exercise your rights or have any questions, please contact the responsible service for data processing (see above). It checks whether the legal requirements for this are met and then takes the necessary measures.

Please also see Zoom's privacy policy, which applies in addition (external link)

We revise this data protection notice in the event of changes in data processing or on other occasions that require changes or adjustments.

Status: 09/2023