Data processing and your rights in the context of various civil protection procedures

Information from the Mainz city administration in accordance with Art. 13 of the General Data Protection Regulation.

Name of the processing operation

Contact details of persons affected by a disaster/evacuation at a care center.

Responsible for the processing of your data

(Art. 13 (1) (a) GDPR)

State capital Mainz
37 - Fire department
Jakob-Leischner-Straße 11
55128 Mainz
P.O. Box 3820 55028 Mainz
Phone: 06131-12 4500
Email: feuerwehrstadt.mainzde

Data protection officer of the controller

(Art. 13(1)(b) of the GDPR)

State Capital of Mainz
Data Protection Officer
Stadthaus Große Bleiche
Große Bleiche 46 / Löwenhofstraße 1
55116 Mainz
Phone: 06131-12 2216
Email: datenschutzstadt.mainzde

Purposes and legal basis of the processing of personal data

(Art. 13(1)(c) GDPR)

The data collected at the care center is used to register individuals affected by a disaster or evacuation situation or other events that fall within the scope of the Rheinhessen Health Emergency Plan and the State Law on Fire Protection, General Assistance, and Disaster Relief (Fire and Disaster Relief Act — LBKG —). The data is collected upon the arrival of the affected individuals and used, if necessary, to track their whereabouts until they are discharged from the care center. The information may be used by the joint information center of the volunteer aid organizations (tracing service) to notify relatives and authorities. The extended contact information is used to identify potential close contacts in the event of a confirmed COVID-19 infection. Legal basis: Art. 6(1)(c), (e), (2), (3) of the GDPR; § 39 of the LBKG; exercise of the right to manage the premises as a measure to contain the COVID-19 pandemic.

Affected persons

Persons affected by damage or evacuation.

Data concerned/data categories

Identification data, address data, telephone data, date and time of stay at a care center

Recipients or categories of recipients

(Art. 13 (1) (e) GDPR)

The data collected is stored by the health section management for the purpose of documenting the event and recording those affected and patients, and is made available to the tracing service and the competent authority if necessary. This is done within the scope of the assignment given. The extended contact details must be forwarded to the health authorities on request if this is necessary for them to perform their duties.

Transfer to a third country

(Art. 13 para. 1 lit. f GDPR)

No data is transferred to third countries.

Duration of storage

(Art. 13 (2) (a) GDPR)

The data will be stored in accordance with the statutory period of 10 years plus a two-year final deletion period. The extended contact details will be deleted four weeks after collection. If processing is necessary in the context of investigating contact persons, these will be deleted after the investigation process has been completed.

Rights of data subjects

(Art. 13 (2) (b) to (d) GDPR)
Every person affected by data processing has the following rights under the GDPR:

Right to information about the personal data stored about them and its processing (Art. 15 General Data Protection Regulation).
Right to withdraw consent given in accordance with Art. 7 GDPR at any time in the processing cases of Art. 6(1)(a) or Art. 9(2)(a) GDPR.
Right to rectification if the data concerning them is inaccurate or incomplete (Art. 16 GDPR).
Right to erasure of data stored about you, insofar as one of the conditions under Art. 17 GDPR applies. Article 17(3) GDPR contains exceptions to the right to erasure for the exercise of freedom of expression and information, for the fulfillment of legal storage obligations, for reasons of public interest in the area of public health, for public archiving purposes, scientific, historical, and statistical purposes, and for the enforcement of legal claims.
Right to restriction of processing pursuant to Art. 18 GDPR, in particular
o if the accuracy of the data is disputed, for the duration of the verification of accuracy,
o if the data is processed unlawfully, but the data subject requests restriction of processing instead of erasure,
o if the data subject needs the data to assert or exercise legal claims or to defend against such claims and therefore cannot be deleted, or
if, in the event of an objection pursuant to Art. 21 (1) GDPR, it is not yet clear whether the legitimate interests of the controller outweigh those of the data subject.
Right to data portability of personal data concerning them pursuant to Art. 20 GDPR
Right to object to the processing of personal data for personal reasons, unless there is a compelling public interest in the processing that
outweighs the interests, rights, and freedoms of the data subject, or the processing serves to assert, exercise, or defend legal claims (Article 21 GDPR).

Right of appeal

(Art. 77 GDPR) Every data subject has the right to lodge a complaint with the State Commissioner for Data Protection and Freedom of Information in Rhineland-Palatinate if they believe that their personal data is being processed unlawfully.

The State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate
Hintere Bleiche 34
55116 Mainz
Phone: 06131 208-2449
Fax: 06131 208-2497
Website: https://www.datenschutz.rlp.de (opens in a new tab)
Email: poststelledatenschutz.rlpde