Without prejudice to others, the following rules must be ensured:
The password for accessing the computer must be at least 8 characters long, it must be memorisable so that it does not have to be written down elsewhere, but it must not be the result of one word or a string of words.
The computer must have all the latest security updates.
If the computer contains personal data, its use should be restricted to third parties.
Yes, as long as it is for the strict fulfilment of their professional duties. The personal data of students, staff or candidates must remain on personal computers for as long as it is necessary to carry out the legitimate task, after which it must be deleted. During the time they remain on the personal computer, the employee must ensure that their computer complies with all basic security rules. Optionally, the user can encrypt files containing personal data.
There are various ways of obtaining informed consent. One of the most common is to send emails asking the data subject to confirm that they want to receive emails for the specific purposes indicated in the email. It should be noted that the specific purposes for which the emails are to be sent must be indicated, e.g. publicising cultural events promoted by the Institution, or disseminating news. You should also explicitly state that the absence of a reply should be considered as non-authorisation.
You can, but only if you have the email owner’s informed consent.
The contract it has with students, staff and teachers allows it to be used for professional or academic purposes. This is not true for the purposes of publicising non-professional or non-academic events.
As a rule, all exchanges of personal data with third parties to the UPB must be communicated to the institution’s Data Protection Supervisor. It should be noted that such transmission of personal data is legitimate as long as there is a legal obligation to do so or if the data subjects have given their authorization to do so. In general, personal data sent as part of survey procedures for national statistical purposes (e.g. RAIDES, REBIDES) is required by law and must therefore continue.
Yes, but only in the places indicated and with the appropriate restrictions. Student grades are personal data and therefore not public. However, in the interests of transparency, evaluations can be made known to evaluation colleagues.
Consent must be given individually for each treatment in an explicit and affirmative way.
Processing is only lawful if and to the extent that at least one of the following situations applies:
-
- The data subject has given their consent to the processing of their personal data for one or more specific purposes;
-
- Processing is necessary for the performance of a contract to which the data subject is a party, or for pre-contractual steps at the request of the data subject;
-
- Processing is necessary for compliance with a legal obligation to which the controller is subject;
-
- Processing is necessary for the protection of the vital interests of the data subject or another natural person;
-
- Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the person responsible for processing;
-
- Processing is necessary for the purposes of the legitimate interests pursued by the person responsible for processing or by a third party.
The request for consent should be understood as a last resort. In other words, only data that is strictly necessary for legitimate processing without a request for consent should ever be requested.
The GDPR has very clear measures for these cases. There are deadlines for informing the Data Protection Supervisor, who must inform the National Data Protection Commission within 72 hours of becoming aware that the data has been compromised. If the breach could significantly affect the data subject, it may be necessary to inform them.