Welcome to the Data Protection page of Hannover Medical School

The processing of personal data is a central component for the daily fulfillment of tasks. The personal data and information to be processed are of essential importance and must be adequately protected. Data Protection is therefore a top priority for MHH. The careful handling of personal data by employees, both paper-based and in the digital systems provided for this purpose, is essential to ensure compliance with the applicable data protection regulations.

Article 5(2) of the General Data Protection Regulation (GDPR) imposes a so-called "accountability obligation" on the controller. This means that there is an obligation to comply with the principles set out in Article 5(1) GDPR and to demonstrate compliance with them. The following data protection objectives are given:

  • Purpose limitation/data minimization: personal data shall only be collected for specified, explicit and legitimate purposes and shall not be further processed in a manner incompatible with those purposes. They must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
  • Availability: A high degree of availability is guaranteed by the performance-optimized provision of the desired IT services of a system within the time allotted. The hardware and software, including the data, are available when they are actually needed.
  • Integrity: Users can be sure that the data is correct, i.e. that its content is accurate and complete. The respective information is only processed by authorized persons and also only in the manner intended.
  • Storage limitation: personal data may only be stored for as long as the respective purpose or the statutory retention periods stipulate. If either the purpose or the statutory retention period expires, the personal data must be deleted immediately and irrevocably.
  • Transparency: The individual procedural steps during data processing are complete, up-to-date and documented in such a way that they can also be traced within a reasonable period of time. The data subject is fully informed about the handling of their data.

 

For this very purpose, the Data Protection Officer is a person appointed by the Presidium of MHH who coordinates, monitors and drives forward Data Protection tasks at MHH on its behalf. His or her tasks also include

  • Central point of contact for Data Protection issues
  • Establishment of a data protection management system (DSMS)
  • Creating documentation on Data Protection (e.g. a data protection manual)
  • Raising awareness and educating employees about Data Protection

The Data Protection Officer works closely with the Information Security Officer, the IT department (MIT) and the decentralized contact persons for Data Protection and the IT security contact persons of the departments.

If you have any concerns about Data Protection at MHH, please contact:

Hannover Medical School
OE 0007 - Joachim Barke
Data Protection Officer
Carl-Neuberg-Straße 1
30625 Hannover

General e-mail address: Data Protection@mh-hannover.de

 

Information on the rights of data subjects

The data subject has the right to request confirmation from the controller as to whether personal data relating to them is being processed; if this is the case, they have a right of access to such personal data and to the information specified in detail in Article 15 of the GDPR.

The data subject has the right to request from the controller, without undue delay, the rectification of inaccurate personal data concerning them and, where applicable, the completion of incomplete personal data (Article 16 of the GDPR).

The data subject has the right to request from the controller the erasure of personal data concerning them without undue delay, provided that one of the grounds specified in Article 17 of the GDPR applies, e.g. if the data are no longer necessary for the purposes for which they were collected (right to erasure).

The data subject has the right to request from the controller the restriction of processing if one of the conditions set out in Article 18 of the GDPR applies, e.g. if the data subject has objected to the processing, for the duration of the controller’s assessment.

The data subject has the right to object at any time to the processing of personal data relating to them on grounds relating to their particular situation. The controller will then no longer process the personal data, unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing is necessary for the establishment, exercise or defence of legal claims (Article 21 of the GDPR).

If you have any questions or believe that the processing of your personal data is not lawful, you may contact the MHH’s Data Protection Officer:

MHH Data Protection Officer, OE 0007, Carl-Neuberg-Strasse 1, 30625 Hanover

Without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority if they consider that the processing of personal data relating to them infringes the GDPR (Article 77 of the GDPR). The data subject may exercise this legal right with a supervisory authority in the Member State of their place of residence, their place of work or the place where the alleged infringement occurred. In (federal state), the competent supervisory authority is: The State Data Protection Commissioner for Lower Saxony, Prinzenstraße 5, 30159 Hanover.

If you wish to exercise your Legal right to information in accordance with Art. 15 GDPR as a patient of MHH,
please contact PatientendatenanfragenDSGVO@mh-hannover.de

Data protection regulations for IT access