Data protection information about POLYAS

The University of Vienna informs you that it intends to conduct selected elections at the University of Vienna using the online voting system POLYAS (henceforth referred to as ‘POLYAS’) provided by POLYAS GmbH. In this context, POLYAS GmbH acts as the processor in accordance with data protection regulations.

Therefore, a data protection impact assessment in accordance with article 35 of the GDPR was carried out in consultation with the Data Protection Officer of the University of Vienna. The data protection impact assessment has shown that from the perspective of data protection, the University may use POLYAS to process the required personal data.

If POLYAS is used, please note that the personal data used by POLYAS will be processed exclusively for the purpose of the relevant election. This also applies mutatis mutandis for the duration of the storage of personal data.

The legal basis for the processing of personal data (in connection with the administration of POLYAS) of the civil servants, employees and other staff of the University of Vienna eligible to vote and of the students eligible to vote is usually the employment relationship, the working relationship or the training relationship under public law in accordance with article 6, para. 1, sub-para. b and sub-para. c of the GDPR. In this context, the system usually processes master data (e.g. e-mail address, first and last name, if necessary, and the u:account UserID).

The processing of personal data in the course of elections is based on article 6, para. 1, sub-para. c of the GDPR and article 9, para. 2, sub-para. b of the GDPR. The necessity of data processing results from national law, depending on the type of election. For example, the following specifications are made:

• Secret election of the chairperson of a collegial body in accordance with section 20, para. 3 in conjunction with section 19, para. 3 of the 2002 Universities Act
• Secret election of members of the faculty conference or centre conference in accordance with the Organisation Plan issued pursuant to section 20, para. 4 of the 2002 Universities Act in accordance with article 81c, para.1 of the Austrian Federal Constitutional Law

If (in exceptional cases) the processing of personal data is based on the data subject’s consent, the legal basis is article 6, para. 1, sub-para. a of the GDPR and article 9, para. 2, sub-para. a of the GDPR. In this case, the related informed consent is relevant for the specific data categories, storage duration, etc. and the principles mentioned above also apply.