Data protection information for the use of the electronic whistleblowing system of the National Association of Statutory Health Insurance Funds

Information in accordance with Articles 13, 14 and 21 of the European General Data Protection Regulation (GDPR)

Good afternoon,

Below, we will inform you about the processing of your personal data (Art. 4 No. 2 GDPR) in connection with the use of the electronic whistleblowing system of the Statutory Health Insurance Funds Association.

Responsible person within the meaning of Art. 13 No. 1 lit. a and b and

Art. 14 No. 1 lit. a and b GDPR

Berlin office

Bonn Office (DVKA Department)

National Association of Statutory Health Insurance Funds,

represented by the Executive Board,

Reinhardstraße 28, 10117 Berlin

Statutory Health Insurance Association — Department of German Liaison Office for Health Insurance — Abroad (DVKA), represented by the management,

Pennefeldsweg 12c, 53177 Bonn

Erik Berger

Internal Audit Office/Internal Reporting Office

Telephone: 030 206288-4500

Peter Wiercimok

Data Protection Officer

Telephone: 030 206288-4403

Carolin Birker

Local Deputy of

data protection officer

Telephone: 0228 9530-717

Which data do we process and from which sources do they originate?

We process your personal data, which we receive from you or third parties as part of a notice in accordance with the Whistleblower Protection Act (HinSchG), in accordance with the provisions of the GDPR and the Federal Data Protection Act (BDSG) for various purposes. The data comes either from the online form you filled out on the whistleblowing portal of the National Association of Statutory Health Insurance Funds (digital whistleblowing system) or from files or documents submitted by other means (including e-mail, post, etc.).

We process the following data or categories of data, which we receive from you directly or from persons commissioned by you as part of reporting an infringement within the meaning of the HinSchG:

information to personally identify the whistleblower, such as first and last name, gender, address, telephone number and email address;
employee status for verification;
Information about data subjects, i.e. natural persons who are described in a report as a person who has committed the infringement, or with whom the designated person is associated. Such information includes first and last name, gender, address, telephone number and email address, or other information that enables identification;
information about breaches, which may allow conclusions to be drawn about a natural person;
Audio recordings via the whistleblowing portal, if applicable.

For what purposes do we process your data and on what legal basis?

We process the personal data for the purpose of investigating the reports, in order to prevent, detect and/or carry out follow-up measures (such as measures to verify the validity of the allegations made in the report and, if applicable, to take action against the reported infringement, including through internal investigations, investigations, prosecution measures, measures to (re) confiscate funds or complete proceedings.

Legal basis for processing

We only process your data if there is a legal basis for doing so.

We only process information to personally identify the whistleblower if the whistleblower has given us consent to do so in accordance with Article 6 (1) (a) GDPR. According to this, processing is only lawful if the data subject has given consent to the processing of personal data concerning him or her for one or more specific purposes.

We process information on employee status, information on data subjects and other information that allows conclusions to be drawn about natural persons on the basis of Art. 6 (1) lit. f GDPR. According to this, processing is lawful if processing is necessary to protect the legitimate interests of the controller or a third party, unless the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, prevail.

Depending on the specific individual case to be examined, our legitimate interest lies in processing reports in order to be able to carry out follow-up measures, such as measures to verify the validity of the allegations made in the report and, if necessary, to take action against the reported infringement, including through internal investigations, investigations, prosecution measures, measures to (re) confiscate funds or conclude proceedings. Whether the interests or fundamental rights and freedoms of the data subject conflict with such data processing will be examined on a case-by-case basis — including with regard to the infringement.

We may process personal data of employees on the basis of Section 26 (1) sentence 2 BDSG. According to this, personal data of employees may be processed in accordance with Section 26 (8) BDSG to detect criminal offences if there is factual evidence to be documented that the person concerned has committed a criminal offence in the employment relationship, processing is necessary for detection and the employee's legitimate interest in excluding processing does not prevail, in particular the nature and extent are not disproportionate with regard to the cause.

Who receives your data?

In principle, personal data is only transferred to third parties if there is a legal basis for this. This is particularly the case if the transmission serves to comply with legal requirements, according to which we are obliged to provide information, report or transfer data, or if you have given us your consent to do so, or a balancing of interests justifies this. In addition, external service providers, such as external data centers or telecommunications providers, process personal data on our behalf as contract processors. Depending on the focus of responsibility of the report and in order to effectively initiate follow-up measures, the personal data may be passed on to our relevant relevant specialist departments. We may also share personal data with government security and/or law enforcement agencies, other competent authorities and/or persons bound to secrecy, such as auditors/lawyers.

How long will your data be stored?

As a rule, the data from a report will be deleted after 3 years after the proceedings have finally been completed, unless the initiation of further legal action (e.g. initiation of criminal or disciplinary proceedings) requires further storage; in accordance with Art. 6 (1) (c) GDPR, there is an obligation to store the data for a longer period of time or due to legal or professional storage and documentation obligations or one of the persons concerned has in a Transitional Storage is consented to in accordance with Art. 6 (1) S. 1 lit. a DSGVO. Subject to such storage obligations, data will be deleted when the purpose for which it was collected ceases to exist. We will immediately delete personal data in connection with reports if we consider them to be manifestly factually unfounded. To the extent permitted by law, data is also stored if this is necessary to assert or defend against legal claims.

Is data transferred to a third country or to an international organization?

A transfer of data to a third country or to an international organization does not take place and is not intended.

What data protection rights do you have?

Your right of information, rectification, restriction, cancellation, notification, transfer, objection and appeal is described separately. Please read the “Rights of the data subject” section in the data protection guidelines of the National Association of Statutory Health Insurance Funds at or the German Liaison Office for International Health Insurance at https://www.dvka.de/de/global/datenschutzbestimmungen.html.

Separate information about the right of objection under Article 21 GDPR

In accordance with Article 21 (1) GDPR, you have the right, for reasons arising from your particular situation, to object at any time to the processing of personal data concerning you, which is carried out on the basis of Article 6 (1) lit. f of the GDPR (processing to protect the legitimate interests of the responsible body or a third party). This applies to:

fraud prevention;
measures to ensure and improve the security of IT systems;
measures to protect against unlawful acts;
assertion of claims for damages.

If you file an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate reasons for processing that outweigh your interests, rights and freedoms, or the processing is for the establishment, exercise or defense of legal claims.

The objection can be made form-free and must be addressed to the National Association of Statutory Health Insurance Funds, Internal Reporting Office, Reinhardtstraße 28, 10117 Berlin.

We would like to expressly point out that cases are possible in which processing could be based on several legal bases that apply side by side. In such a case, we reserve the right to base processing on another legal basis, even if consent is withdrawn. In the event of withdrawal of consent, we will inform you accordingly.

Is there an obligation for you to provide data?

There is a legal obligation to provide data from the whistleblower

Don't. Failure to provide personal data by the whistleblower

As a rule, the result is that not informed about follow-up measures

can become. The facts may not be fully clarified

become.

Is there automated decision-making in individual cases?

In connection with the receipt, processing or other processing of personal data in relation to the Whistleblower Protection Act, no automated monitoring or evaluation systems are used in accordance with Article 22 GDPR.

Is your data used for profile creation?

Profiling is any type of automated processing of personal data that consists of using this data to analyze or predict certain personal aspects. Your data will not be used to create profiles (profiling).