About This Page

Navigation

Authorization required:

Here you will find some introductory information about this website and the collection process, that will form the QUEST records of processing activities. For more details, please see the manual.

Table of Contents

What is Data Processing?

According to Wikipedia, data processing is the collection and manipulation of digital data to produce meaningful information. Data processing is a form of information processing, which is the modification (processing) of information in any manner detectable by an observer. A processing activity in the sense of the GDPR is any electronic, repeated data processing, where, among others, personal information within the meaning of the GDPR is concerned.

What are Records of Processing Activities?

European data protection regulations require every institution or enterprise beyond a certain size to compile records of processing activities. Article 30 of the GDPR (General Data Protection Regulation) defines two entities, a controller and a processor. The controller usually initiates a particular data processing activity, thereby becoming responsible for it. The processor then acts on behalf of the controller.

For the controller role, the following information is requested, if applicable:

  • Contact info of the controller, where applicable joint controller, and data protection officer.
  • Purposes of the processing.
  • Description of the categories of data subjects and the categories of personal data.
  • Categories of recipients to whom personal data disclosed, recipients in third countries or international organizations.
  • Where applicable, transfers of personal Data to a third country or international organization, identification of that third country or international organization, suitable safeguards.
  • Where possible, envisaged time limits for the erasure of data categories.
  • Where possible, description of technical and organizational security measures.

Similarly, information on the processor is requested:

  • Contact info for the processor, where applicable joint processor, and data protection Oofficer.
  • Categories of processing carried out on behalf of each controller.
  • Where applicable, transfers of personal data to a third country or international organization, identification of that third country or international organization, suitable safeguards.
  • Where possible, description of technical and organizational security measures.

Obviously, the collection of all of this information could be quite time consuming. Moreover, it would require more than just passing knowledge of GDPR internals. This website therefore compiles the QUEST records of processing activities in two steps.

Step 1: Your Contribution is Required!

As a first step, every member of QUEST that uses IT processing activities in one of the roles mentioned above, is asked to give some preliminary information about the processing activity in question, see Add Item. Here, the contact information of the issuer is collected. Next it is asked, if the roles of technical-, application-, or general responsible persons are known or defined. If in doubt, leave these fields blank.

It then proceeds to the title, a brief (!) description, and possible additional remarks about the processing activity in question.

Classification: Personal Information and its Sensitivity

Now comes the most important part of this form, your estimate about the sensitivity of the data processed with respect to the GDPR:

  • Are personal data of any kind involved in your data processing?
  • If so, please rank the sensitivity of the personal information in question.

At the Charité, there is a standardized classification scheme for the processing of personal data.

According (among others), to the ZVA Nutzung von Cloud-Diensten (Central Board of Management instruction: Use of cloud services), the following classification of data categories and their impact, if a data breach of any kind occurs, is used at the Charité:

Data Category Need for Protection Examples
IV: Patient Data high to very high Medical diagnostics, diseases, blood group, health data.
III: Person-Related Data medium to high Phone list, birthday list, address list, personnel files.
II: Corporate Data medium to high Evaluations of data from the SAP system, inventions.
I: Personal / Private Data low Individual data, certificates, private correspondence.

Here, select the category that best fits your data use.

After clicking on submit your information is entered into a database, and a handle (a random, unique string) is generated. Keep this handle in a safe place. You can use it later on to view, edit, or delete your submission, see Edit Item.

Step 2: Curation and Compilation of QUEST Records of Processing Activities

What happens next?

Based on your input, a curated QUEST records of processing activities file is then produced. The format and publication schedule is currently (October 2023) not entirely determined. Please watch this space for any updates in that matter.

Resources
© 2023 QUEST Center for Responsible Research | Imprint | Terms of Use | About this Page | quest.bihealth.org