Data Protection: Student Data

Personal data

Ludwig-Maximilians-Universität München (LMU) takes the protection of the personal data of its students, visiting students, and early students (enrolled persons) very seriously. In order to ensure the lawfulness of data processing and to guarantee the security of personal data during transmission, LMU uses appropriate encryption methods (e.g., SSL/TLS) and secure technical systems based on the current state of the art.

We process personal data of enrolled persons in connection with their studies at LMU and its partner universities. This includes upstream procedures (e.g., application procedures for international students).

Pursuant to Art. 13, 14 GDPR, enrolled persons are provided with the following information about the processing of personal data at LMU.

1. Name and Contact Details of the Controller

The controller for data processing is:

Ludwig-Maximilians-Universität München (LMU) Geschwister-Scholl-Platz 1
D-80539 Munich
Tel.: +49 (0)89-2180-0
Email: poststelle@verwaltung.uni-muenchen.de

The processing of personal data takes place in the respective responsible departments and institutions of LMU, such as University Administration—here, for example, primarily in the Office of the University Registrar and the International Office—central institutions, faculties, institutes, in keeping with their respective duties. More information about the contact details is available
at https://www.lmu.de.

2. Contact Details of the Data Protection Officer at LMU

Ludwig-Maximilians-Universität München (LMU)
Der behördliche Datenschutzbeauftragte
Geschwister-Scholl-Platz 1
D-80539 Munich
Tel.: +49 (0)89-2180-2414
Contact form: www.lmu.de/datenschutz

3. Type of Personal Data and Purposes of Data Processing

a) Type of personal data processed

As part of your studies at LMU, we regularly process the following personal data from you:

• Personal data required for the implementation of admission and preregistration procedures in accordance with the Bavarian Higher Education Admissions Act, eligibility procedures and other procedures intended for admission to studies at LMU, application procedures as part of mobility programs (such as international student exchange), and enrollment (name, contact details, date and place of birth, university entrance qualification, proof of health insurance, digital photo for the LMUcard, chosen subjects, if applicable, certain requirements for studying the chosen subjects, other application documents [such as language certificates, letters of intent and reference] etc.);
• Personal data relating to your course of study (registration number, semester, leaves of absence, payment transactions, e.g., semester fee, participation in teaching, general email and correspondence, contact requests, etc.) and as alumni;
• The coursework and examinations you have completed and related personal data (e.g., examination registrations, examination results, failed attempts, any medical certificates and reports on incapacity to take examinations, compensation for disadvantages, proof of attendance at events requiring attendance, proof of coursework completed at other universities, etc.);
• Personal data arising in connection with university elections, with the exercise of rights in academic self-administration (e.g., membership of the student representatives) and with comparable other occasions arising from your status as a member of LMU;
• Other personal data that you provide to LMU in the context of your membership or that arise as part of your membership (e.g., in the case of honors, scholarships, grants, participation in visiting and exchange programs, field trips, and sports and leisure activities).

Particularly sensitive data and special categories of personal data within the meaning of Art. 9 (1) GDPR are also processed. This relates in particular to data on the existence of a disability (e.g., if a degree of disability is specified) or on health status (e.g., in the case of an accident report).

The following personal data is collected—where necessary—on the basis of the law, in particular Art. 87
(2) Bavarian Higher Education Innovation Act (BayHIG) and the relevant enrollment, continuation of registration, leave of absence, and de-registration statutes of Ludwig-Maximilians-Universität München:

• Salutation, last name, first name, birth name
• Gender
• Date, place and country of birth
• Nationality
• Residence for the semester and home
• Date, place and type of university admissions qualification, including any grades
• Practical work experience before commencing studies
• Practical semesters and semesters at preparatory courses
• Information about another university attended at the same time, about universities attended in previous semesters, and the university of first registration, as well as about study abroad
• Location of the planned final examination
• Information on credit points earned through recognition and crediting
• Type, subject, semester, month and year of examination completion, examination success, and overall grade of examinations taken
• Interruptions in studies by type and duration
• Reason, semester, and year of leaves of absence and de-registration

In addition, pursuant to Art. 87 (2) BayHIG, enrolled persons are obligated to provide further data collected by LMU and its joint institutions, required

• for enrollment, leave of absence, and de-registration pursuant to Art. 87 to 94 BayHIG and the statutes issued on the basis of Art. 95 BayHIG
• for admission and preregistration pursuant to the Bavarian Higher Education Admissions Act, the University Admissions Ordinance, and other legal provisions
• for registration and admission as well as the acceptance of examinations or coursework under the respective examination and degree programs

To the extent necessary for the implementation of studies, mobility programs, or membership, the following additional personal data may be collected and processed:

• (Private) email address
• Photo (voluntary, e.g., for semester ticket)
• Selected courses with semester hours per week
• The subject or subjects in which the selected courses take place
• Details of the partner university
• Name and contact details of legal guardians
• Name and contact details of an emergency contact (for mobility programs)
• Learning agreement (for mobility programs)
• Copies of identification (partially redacted)
• Account and bank information (for scholarships)
• Loan data in the library system
• Stays abroad
• Specific grades and course certificates (e.g., in the context of further training and the acquisition of additional qualifications [e.g., foreign languages])
• Log data in Active Directory

b) Purpose of data processing

The processing of your personal data is used, among other things, to set up, organize, and manage your status as an enrolled person or member of LMU (e.g., conducting aptitude tests, second degree program, early studies, enrollment, de-registration, transfer of place), to organize and coordinate studies in accordance with the course of study and examination regulations (e.g., provision of the necessary data processing and IT infrastructure, e-learning services, and the necessary platforms, the use of the library, preparation and conduct of examinations), to ensure your participation in academic self-administration (e.g., participation in university elections, participation in university committees), to process your study and membership matters (e.g., leaves of absence, study exchange programs, attendance checks), to enable you to provide proof of your coursework and examinations (e.g., issuing certificates), to be able to issue you with a certificate and other proof upon successful completion of your studies and to process other procedures related to your status as an enrolled person or member of LMU (e.g., proof of eligibility for Federal Education and Training Assistance Act [BAföG], use of the semester ticket) or to fulfill legal obligations in connection with your studies (e.g., university statistics), or to fulfill other legal obligations (e.g., enforcement of domiciliary rights). This relates specifically to the following purposes:

• Implementation of admissions and preregistration procedures in accordance with the Bavarian Higher Education Admissions Act, aptitude assessment, aptitude tests, and academic advising and orientation:
  When carrying out preregistration procedures, aptitude assessment, and corresponding procedures, the respective personal data is collected and processed exclusively for the purpose of the procedure in the respective responsible institutions. Applicants for places receive the access data for the admissions and enrollment procedures.
  Enrolled persons receive password-protected system access for the online self-service functions for creating official student documents and certificates and for reporting changes of address.
  LMU logs access and activities in order to be able to track the legality of access at any time and to be able to prove the activities as part of accountability required by law. The log data is not used for any other purpose.
• Implementation of enrollment, continuation of registration, and de-registration: The personal data is processed in order to be able to enroll and continue registration at LMU and to make use of LMU services (e.g., change of subject). The data is also processed in order to carry out de- registration.
• Implementation of coursework and examinations as part of examination and student administration, participation in courses, and use of central LMU facilities (e.g., university library, online access): In student and examination administration, personal data is used for establishing contact, for application management (leaves of absence, etc.) and for internship, fee, award, and examination administration in the context of the legal regulations, in particular in accordance with the relevant examination and study regulations, the teaching degree examination regulation, the regulations on medical education for dentistry, human medicine, and veterinary medicine (e.g., administration of state examinations).
• Implementation of international affairs and mobility programs, such as semesters abroad and other stays abroad or guest residencies: The personal data is processed for the provision and handling of studies abroad, exchange procedures, and guest residencies, including the relevant application and selection procedures and support programs, especially for international students.
• Implementation of scholarships (e.g., support for qualified enrolled persons): In the context of scholarships, LMU records scholarship applications to be processed (e.g., Deutschlandstipendium) and uses the available data for targeted information on scholarship programs, talent promotion, and the awarding of prizes to enrolled students and graduates.
• Provision and control of LMU system access: Personal data is processed in order to provide the necessary administrative and management services (e.g., campus ID, online portals, learning platforms, videoconferencing services, library services).
• Exercise your rights as a member of LMU (e.g., exercising functions in the context of academic self-administration, participation in LMU sports and leisure activities).
• Provision of services for enrolled students who have left the university: Personal data is processed in order to maintain the connection with LMU even after completing your studies, to participate in events, and to receive information from LMU.
• Assertion of rights and claims (e.g., domiciliary rights) and for the implementation of legal remedy and litigation proceedings.

4. Legal Basis

Pursuant to Art. 87 (2) (1) BayHIG, students are obligated to provide certain personal data. Pursuant to Art. 87 (3) BayHIG, in addition to students, other persons may be enrolled who are obligated to provide the relevant data required to fulfill the duties set out in the applicable statutes—in this case the enrollment, continuation of registration, leave of absence and de-registration statutes.

The EU General Data Protection Regulation (GDPR) and the Bavarian Data Protection Act (BayDSG) additionally stipulate that personal data may be collected if knowledge of it is necessary for the fulfillment of the duties for which the collecting body is responsible or if there is a legal obligation to do so.

To the extent that the processing of your personal data is necessary to fulfill a legal obligation to which LMU is subject, Art. 6 (1) (c), (3) (1) (b) GDPR, in conjunction with the Enrollment, Continuation of Registration and De-registration Statutes, the Bavarian University Election Rules (BayHSchWO), the Examination and Study Regulations of LMU, pursuant to Art. 13, Art. 121 (5) BayHIG, the statistics act applying to institutions of higher education and vocational academies—Higher Education Statistics Act (Section 3, 5 HStatG in conjunction with Section 15 Federal Statistics Act [BStatG]), the statutory budget provisions and the Social Security Code V constitute the legal basis for processing.

If the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in LMU, the data processing is carried out in accordance with Art. 6
(1) (e), (3) sent. 1 (b) GDPR, Art. 87 BayHIG in conjunction with the Enrollment, Continuation of Registration and De-registration Statutes, the Bavarian University Election Rules (BayHSchWO), the Examination and Study Regulations of LMU, teaching degree examination regulation I and II (LPO I, II), the regulations on medical education in the fields of medicine, dentistry, and veterinary medicine (ÄApprO, TappV, ZApprO), the Bavarian Higher Education Admissions Act (BayHZG), the University Admissions Ordinance (HZV), the statistics act applying to institutions of higher education and vocational academies—Higher Education Statistics Act (Sections 3, 5 HStatG in conjunction with Section 15 Federal Statistics Act [BStatG]), the Social Security Code V as well as any other laws and regulations applicable in individual cases constitute the legal basis for processing. Data is transferred to the Bavarian Judicial Examination Office (LJPA) pursuant to Art. 5 (1) (1) BayDSG in conjunction with Sections 27 (1) (2), 38 (1), 42 of the Training and Examination Regulations for Lawyers (JAPO).

The processing of personal data as part of the online application or online enrollment is only carried out to the extent necessary for enrollment and in compliance with the applicable regulations.

In the context of scholarships, LMU determines in the systems the eligible enrolled persons who best meet the criteria of the funding programs; a proposal with the transfer of personal data to external scholarship providers is only made with consent pursuant to Art. 6 (1) (a) GDPR. Participation in the scholarship awards is not permitted without consent to the transfer of data.

If LMU obtains consent from enrolled persons for the processing of personal data for specific purposes in accordance with Art. 6 (1) (a), Art. 7 GDPR, processing is permitted on the basis of this consent until withdrawn. Withdrawal is always only for the future and does not affect the legality of the data processed up to the time of withdrawal.

If LMU concludes a contract with the enrolled persons (e.g., as part of a scholarship), the data processing is carried out for the execution of the contract pursuant to Art. 6 (1) (b) GDPR.

5. (Categories of) Recipients of Personal Data and Data Transfers to Third Countries

Your data collected at LMU will be processed and transferred within the university to the extent that
this is permissible and necessary to fulfill LMU’s public duties and legal obligations.

As internal recipients, these are in particular the responsible offices in university administration and in the central institutions, in particular the university library, as well as in the relevant faculties and other necessary university institutions and departments, to the extent that this is necessary for the organization or implementation of the course of study or for the fulfillment of the duties or legal obligations of LMU.
LMU employees will only have access to your data collected or processed as part of the application,

enrollment, or continuation of registration or for other purposes if this is necessary for the fulfillment of the official duties assigned to them by LMU or for the fulfillment of legal obligations.

The data collected is used for administrative purposes in LMU systems, is only accessible to the LMU employees responsible for the respective processing, and is only transferred on the basis of legal authorizations or after consent has been given (e.g., with an effective power of attorney). Unauthorized disclosure to third parties, international organizations, or to a third country does not take place.

For degree programs that participate in the nationwide admissions comparison, known as the dialogue- oriented service procedure (DoSV), application data is sent to the Foundation for University Admissions (see www.hochschulstart.de) responsible for the DoSV for the nationwide application and admissions comparison and compared with the data stored there (Section 37 (a) of the Bavarian University Admissions Ordinance). The Foundation for University Admissions prepares rejection and exclusion notices as well as admission and deferral notices in the name of and on behalf of LMU and makes them available in the DoSV portal; LMU has concluded a data processing agreement with the Foundation for University Admissions for this purpose.

In the context of the legal requirements of the ÄApprO, ZApprO, and TAppV, data is exchanged with the Institute for Medical and Pharmaceutical Proficiency Assessment (IMPP) and with the government of Upper Bavaria, to the extent that this is necessary to grant a license to practice medicine.

Data is exchanged with the Bavarian State Judicial Examination Office (LJPA) at its request and via encrypted communication. The LJPA is notified of the enrolled persons who have been admitted to the First State Examination in Law (personnel number, examination date, overall grade, retake for a better grade, area of specialization, examination university, last name, gender, date of birth). The Judicial Examination Office reports the passed and failed areas of specialization with grades to the LJPA. (registration number, last name, gender, date of birth, free exam attempt).

As part of enrollment and the course of studies, personal data is compared, where necessary, with the respective health insurance provider (Section 199a SGB V), and data is transferred to the responsible student union (Studierendenwerk) in connection with BAföG applications submitted there (Sections 47, 48 Federal Education and Training Assistance Act – BAföG).

Information that includes personal data or indirectly allows conclusions to be drawn about such data (e.g., whether a person is enrolled at LMU) will only be provided directly to the person concerned (in person or in writing). Such information will only be provided to third parties upon submission of a written declaration of consent (power of attorney) and if there are no legal reasons to the contrary.

LMU also processes your data at the Leibniz Supercomputing Centre (LRZ), an institute of the Bavarian Academy of Sciences and Humanities, with which a data processing agreement exists, in order to fulfill the public duties incumbent on LMU and its legal obligations. Data transmission is encrypted. This also applies to the library system. Technical support is provided by the Bavarian State Library and the LMU University Library.

In the context of mobility programs, jointly offered programs, or similar cooperative arrangements, personal data is transmitted to the partner institutions if this is necessary for the implementation of the cooperative arrangement. This includes, for example, master and contact details, gender, application documents, admission and enrollment data, study data and course certificates, visa information, and financial data as well as health data on disabilities. If the partner institution is in a third country or is an international organization, data transmission is carried out pursuant to Art. 44 et seq. GDPR, i.e., on the basis of an adequacy decision pursuant to Art. 45 GDPR, other appropriate safeguards pursuant to Art. 46 GDPR (in particular on the basis of standard data protection clauses), or in exceptional cases, on the basis of an exception pursuant to Art. 49 GDPR (in particular for the performance of a contract concluded by LMU in the interest of the data subject).

In the case of mobility programs funded by third parties (such as Erasmus+, DAAD PROMOS, Fulbright, etc.), LMU is obligated to process certain personal data of the students concerned and forward it to the funding provider in order to carry out the funding and to check its use, in particular name, gender, nationality, email address, proof of special needs (disability, child) as well as data on studies and mobility.

LMU uses IT solutions from external service providers for the implementation of mobility programs, in particular the online software MoveON and MoveIN from the provider QS unisolution GmbH (Stuttgart). Data processing takes place exclusively in the Federal Republic of Germany, another state of the European Union, or in a country of the European Economic Area.

Where necessary and legally required or legally obligatory, data is also transmitted to the student union (Studierendenwerk), health insurance providers, the Bavarian Accident Insurance Fund, the LMU University Hospital (e.g., in the case of medical students), and other state institutions. The transfer of data is based either on a legal obligation or on your consent.

For student and examination statistics, anonymized data is passed on to the Bavarian State Office for Statistics.

6. Automated Decision-Making, Profiling, Automated Processing

Automated decision-making or profiling does not take place.

LMU analyzes anonymized (non-personally identifiable) course of study data in order to optimize advising services and support measures.

For applications for semesters abroad at foreign partner universities, current arithmetic examination grades are provided for processing in the mobility management system “MoveOn” as a basis for deciding on the allocation of places if there are more applications than places available. The data will not be disclosed without consent or used for purely automated evaluations.

The technical and organizational measures required for data protection are based on the state of the art and reviewed regularly and adjusted if necessary. The procedures used for the automated processing of personal data are reviewed by the LMU Data Protection Officer.

7. Period of Storage of Personal Data

Personal data is processed as long as necessary for the respective purpose and as long as statutory retention or archiving obligations exist.

Data from applicants—including as part of the admissions procedure as per the HZV— is used exclusively for processing applications. If applications were not successful, this data will be erased or destroyed two years after the end of the application process (Art. 17 (1) (a) GDPR). In the case of archival value, erasure only takes place after the data has been offered to the archive (Art. 89 GDPR in conjunction with Art. 26 (6) BayDSG).

LMU stores the personal data of enrolled students for the period of their studies and beyond in accordance with legal requirements. The period depends on the type and purpose of the data.

• In the case of admission, preregistration, and eligibility procedures as well as related procedures, a retention period of up to two years may be provided for. If the data processing is only based on consent, erasure of the data will take place after withdrawal of consent, provided there are no statutory retention obligations.
• Study documents are generally stored for the period of study and, if necessary, for up to a further ten years. A limited personal master data record (including the basic audit file) is stored for up to one hundred years and then archived to the extent required by law. In particular, the data record contains information on the period of enrollment, examination results, de- registration, and the conferral of an academic degree. The retention period begins at the end of the calendar year in which de-registration took place. The purpose of storage is to be able to provide information to social security agencies (e.g., pension insurance) and to fulfill statutory documentation obligations to be able to trace financial statements in the public interest.
• Examination documents are generally stored for the period of the degree program and for up to a further five years, starting at the end of the calendar year in which the result of the respective examination (e.g., module examination) was reported. A limited master examination file (e.g., degree) is archived permanently (KMS X/4 – 6 /192 980 dated 12/20/1993).
• Personal data relating to financial transactions (e.g., tuition fees, student fees) must be stored for up to ten years on the basis of budgetary, fiscal, and tax law.
• Data in the library systems will be erased following de-registration. If an account is still encumbered with loans or fees, data will be retained until the account is cleared and erased immediately thereafter, provided there are no longer any statutory retention obligations.
• Applications and other correspondence will be stored for the period of study, depending on the type and purpose of the correspondence, but for at least two to a maximum of ten years, in order to be able to verify the course of study and, if necessary, issue relevant certificates, etc.
• Personal data that is only processed on the basis of consent will be erased once the declaration of consent has been withdrawn.

In accordance with legal requirements, examination and study documents are archived or erased and destroyed after the retention periods have expired.

8. Obligation to Provide Personal Data

LMU collects the personal data required under Art. 87 (2) BayHIG and Art. 87 (3) BayHIG as part of the application of the University Admissions Act and the University Admissions Ordinance, whereby the fields indicated as mandatory must be completed in order to participate in the admissions procedure.

Data collected by LMU in the context of enrollment, leave of absence, and continuation of registration must be provided in order to be enrolled, be granted leave of absence, and be able to continue registration.

If personal data pursuant to Art. 87 BayHIG is not provided, applications based on this data (e.g., for admission to studies, enrollment, examinations, leave of absence, deadline extensions and access authorizations, etc.) cannot be processed and any corresponding entitlements may be forfeited.

If data is provided voluntarily, e.g., an email address for alumni management purposes, failure to provide this information will not result in any disadvantage to the use of LMU services. At most, there may be a loss of convenience because individual offers or services cannot be used.

If the personal data is not collected by LMU, provided or shared by you, or provided by a competent government agency in other procedures, it is obtained from administrative processes during the course of studies (e.g., grades, compensation for disadvantages, absences, log data).

9. Your Rights Relating to the Processing of Personal Data

If you have any questions or complaints regarding the processing of your personal data, you are welcome to contact the relevant department that processes the data in question or the LMU Data Protection Officer at any time.

As an enrolled person, you have the following rights under Art. 12 et seq. GDPR

• If your personal data is processed, you have the right to obtain information on data stored about your person (Art. 15 GDPR).
• If incorrect personal data is processed, you are entitled to rectification (Art. 16 GDPR).
• If the legal prerequisites are met, you can demand erasure or restriction of processing (Art. 17, 18 GDPR).
• If consent has been given for data processing or there is a contract for data processing, and data processing is carried out by using automated procedures, there may be a right to data portability (Art. 20 GDPR).
• You have the right to withdraw your consent to data protection at any time with future effect. The withdrawal of consent does not affect the legality of the processing done on the basis of consent until withdrawal (Art. 7 GDPR).
• You have the right to request information as to whether automated decision-making, including profiling, takes place with regard to processing (Art. 22 GDPR).
• You have the right to object, on grounds relating to your particular situation, at any time to processing which is based solely on Art. 6 (1) (e) GDPR (Article 21 (1) sent. 1 GDPR).

If the rights set out above are exercised, LMU will check whether the legal requirements are met and will take the necessary measures where required.

• Furthermore, you have the right to lodge a complaint with a data protection supervisory authority. The government agency responsible for LMU is the Bavarian Data Protection Commissioner (https://www.datenschutz-bayern.de).

Always first contact LMU or the relevant data processing department in order to enable prompt clarification of your concerns or questions, as the data protection supervisory authority will also normally first refer you to LMU.

10. Version and Changes to the Privacy Policy

This data protection information was last updated on 08 April 2024.

We reserve the right to regularly update this Privacy Policy to reflect current legal requirements and technical changes and to implement our services and offerings in a manner that complies with data protection laws. The version applicable at the time of data processing shall apply.

Further information on the processing of personal data at LMU is also available in the Privacy Policy of LMU for its website and in the information of the respective institutions or services, insofar as further data collection takes place there. This applies, for example, to data processing in connection with the use of online services (e.g., Moodle, Zoom) or for the purpose of using LMU libraries.

Revised 08/04/2024