Without prejudice to others, the following rules must be ensured: The password for accessing the computer must be at least 8 characters long, it must be memorisable so that it does not have to be written down elsewhere, but it must not be the result of one word or a string of words. The computer …
Category Archives: FAQ Proteção de Dados
Can I have personal data about students, staff and candidates on my personal computer?
Yes, as long as it is for the strict fulfilment of their professional duties. The personal data of students, staff or candidates must remain on personal computers for as long as it is necessary to carry out the legitimate task, after which it must be deleted. During the time they remain on the personal computer, …
What to do with the emails already on the mailing lists?
There are various ways of obtaining informed consent. One of the most common is to send emails asking the data subject to confirm that they want to receive emails for the specific purposes indicated in the email. It should be noted that the specific purposes for which the emails are to be sent must be …
Continue reading “What to do with the emails already on the mailing lists?”
Can I send emails to generic email lists that I have at my institution?
You can, but only if you have the email owner’s informed consent.
Can I send emails to lists of teachers, staff and students via the institutional email?
The contract it has with students, staff and teachers allows it to be used for professional or academic purposes. This is not true for the purposes of publicising non-professional or non-academic events.
I regularly send personal data about students, staff or candidates to entities outside the UPB. Can I continue to do so?
As a rule, all exchanges of personal data with third parties to the UPB must be communicated to the institution’s Data Protection Supervisor. It should be noted that such transmission of personal data is legitimate as long as there is a legal obligation to do so or if the data subjects have given their authorization …
Can I publish lists with grades?
Yes, but only in the places indicated and with the appropriate restrictions. Student grades are personal data and therefore not public. However, in the interests of transparency, evaluations can be made known to evaluation colleagues.
How to ask for consent?
Consent must be given individually for each treatment in an explicit and affirmative way.
What data is legitimate to process?
Processing is only lawful if and to the extent that at least one of the following situations applies: The data subject has given their consent to the processing of their personal data for one or more specific purposes; Processing is necessary for the performance of a contract to which the data subject is a party, …
What is the procedure when you become aware that data that has been collected and processed is in the possession of a third party?
The GDPR has very clear measures for these cases. There are deadlines for informing the Data Protection Supervisor, who must inform the National Data Protection Commission within 72 hours of becoming aware that the data has been compromised. If the breach could significantly affect the data subject, it may be necessary to inform them.