PERSONAL DATA JOINT CONTROLLERSHIP AGREEMENT

(Art. 26, Regulation (EU) 2016/679 of the European Parliament and of the Council of

27th April 2016 (hereinafter Regulation (EU) 2016/679))

Art. 1 – Object of the agreement

1.1 – The Università degli Studi di Napoli Federico II, Leopold-Franzens-Universität

Innsbruck and Univerzita Palackého v Olomouci assume the role of joint controllers

pursuant to Article 26, of Regulation (EU) 2016/679, in the execution of the Cooperation

Agreement ‘European Joint Master Study Programme Digital Society, Social Innovation and

Global Citizenship’, of which this agreement is annex, hereinafter also referred to as the

‘Main Agreement’.

1.2 – By the present Agreement, the University of Naples Federico II, Leopold-Franzens-

Universität Innsbruck and Univerzita Palackého v Olomouci, hereinafter referred to as

‘Parties’ or ‘joint controller’, jointly establish the purposes and means of the processing of

personal data in the context of the execution of the Main Contract and determine their

respective responsibilities regarding compliance with the obligations arising from Regulation

(EU) 2016/679 with regard to the processing of personal data.

Art. 2 – Purpose and data subject of processing

2.1 – Personal data acquired by paper or computerised means are processed exclusively for

the purposes envisaged by the Main Contract and for the fulfillment of obligations envisaged

by EU legislation, laws, regulations and provisions of Authorities empowered to do so by

applicable law or by supervisory and control bodies.

2.2 -The performance of activities connected to the execution of the main Contract provides

for the processing of personal data for the following purposes: activation and operation of

the international inter-university Joint Master’s Degree Course in Digital Society, Social

Innovation and Global Citizenship, hereinafter referred to as the ‘Course’, which enables

students to:

a) participate in an in-person summer school in the first semester, offered jointly by all

degree-awarding universities (i.e. parties hereto);

b) participate in an in-presence sector summer school of their choice at the end of the

second semester, offered separately by the degree-awarding universities;

c) have the opportunity to follow hybrid modules/courses at all three degree-awarding universities;

d) carry out the Master’s degree dissertation, including the discussion of the dissertation, at any of the degree-awarding universities, with the evaluation carried out by a committee composed of representatives of the three degree-awarding universities.2.3 – In the performance of the Main Contract, personal data of the following categories of data subjects are processed:

1. lecturers, researchers and contractors in charge of individual teaching;
2. those taking part in the selection for admission to the Course;
3. students enrolled in the Course;
4. teachers, researchers and technical-administrative staff of each university awarding

the joint degree who are members of the coordination committee, the administrative

secretariat and the admission committee.

2.4 – For the execution of the Main Contract, the following types of personal data shall be

processed: as regards those who take part in the selection for admission to the Course:

common personal data such as personal details, contact data, special categories of data

such as health data. Regarding students enrolled on the Course: common personal data

such as personal details, contact details, matriculation number; admission data, enrolment

data, career data, data relating to attendance at Course lectures, special categories of data

such as health data. As far as teaching staff, researchers and contract staff are concerned,

the categories of personal data processed are ‘common’ personal data such as personal

details, contact data, career data, data relating to attendance at Course lectures, special

categories of data such as health data. For the implementation of the Course, the Parties

may communicate to each other the personal and contact data of their respective

representatives within the coordination committee, the administrative secretariat and the

admission committee.

2.5 – The Parties shall jointly process the aforementioned personal data.

2.6 – Activities that are understood to be carried out by the Parties with respect to further

personal data as autonomous data controllers are excluded from the scope of this

Agreement.

Art. 3 – Obligations of the Parties

3.1 – The University of Naples Federico II undertakes to publish the privacy policy at

http://www.unina.it/ateneo/statuto-e-normativa/privacy.

Leopold-Franzens-Universität Innsbruck undertakes to publish its privacy policy at

https://www.uibk.ac.at/datenschutz/

Univerzita Palackého V Olomouci undertakes to publish the privacy policy at

https://www.upol.cz/univerzita/ochrana-osobnich-udaju/.

Art. 4 – Notifications of data breaches

4.1 – The Parties are obliged to mutually notify each other of any personal data breach

inherent to the Regulation (EU) 2016/679 promptly and in any case no later than 24 hour safter the discovery of the event, and to provide all necessary cooperation in relation to the

fulfilment of the obligations incumbent on this to notify the supervisory authority of the said

breaches, pursuant to Article 33, of Regulation (EU) 2016/679 or to communicate the same

to the data subjects pursuant to Article 34, of Regulation (EU) 2016/679.

4.2 – Such communication must be accompanied by all necessary documentation to allow,

where necessary, notification of such breach to the supervisory authority.

4.3 The University of Naples Federico Il handles notifications of possible data breaches in

accordance with the procedure for handling data breaches published on the institutional

website www.unina.it/ateneo/statuto-e-normativa/privacy.

4.4 – Leopold-Franzens-Universität Innsbruck handles notifications of possible data

breaches in accordance with the procedure for handling data breaches published on the

institutional website https://www.uibk.ac.at/datenschutz/data-breach/

4.5 – Univerzita Palackého v Olomouci handles notifications of possible data breaches in

accordance with the procedure for handling data breaches published on the institutional

website https://www.upol.cz/univerzita/ochrana-osobnich-udaju/.

Art. 5 – Data Processors

5.1 – Each joint controller shall designate their own Data Processors involved in the

processing operations performed under joint controllership, in compliance with the

provisions of Article 28 of Regulation (EU) 2016/679.

Art. 6 – Internal organisational contact persons

6.1 – For the coordination of the activities envisaged by this Agreement, internal

organisational contact persons shall be identified:

For the University of Naples Federico II, Department of Social Sciences, the contact person

may be contacted at the following email address: didattica@unina.it.

For Leopold-Franzens-Universität Innsbruck, the contact person may be contacted at the

following email address: datenschutzkoordination@uibk.ac.at

For Univerzita Palackého v Olomouci, the name and email address of the contact person

will be indicated following the signing of the present act and communicated to other parties.

Art. 7- Privacy and Confidentiality Instructions

7.1 – Each party undertakes to identify and provide specific instructions to its employees or

collaborators authorised to process personal data within the scope of the processing

activities indicated above.

7.2 – Each party also undertakes to ensure that the persons authorised to process data are

committed to confidentiality or have an appropriate legal duty of confidentiality and that they

have received the necessary training in personal data protection.

Article 8 – Information security

8.1 – Joint controllers shall take appropriate technical and organisational measures pursuant

to Article 32 of Regulation (EU) 2016/679, to ensure a level of security appropriate to the

risk, within the limits of the functions exercised and their respective prerogatives and

considering the state of the art, the costs of implementation, the nature, object, context and

purpose of processing.

8.2 – In assessing the adequate level of security, individual joint controllers shall consider

the risks of loss, destruction, alteration, unauthorised disclosure, accidental or unlawful

access to personal data transmitted, stored or otherwise processed.

8.3 – Joint controllers, as parties to this agreement, undertake to establish, implement,

maintain and improve an information security management system, with reference to tools,

archives and paper, digital and computer media.

Art. 9 – Joint liability and recourse action

9.1 – With respect to the data subjects, the joint controllers shall be jointly liable for any

damages or other harm resulting from the processing, without prejudice to the liability of

each joint controller for the operations directly attributable to them under this agreement.

Therefore, each joint controller may find itself in the condition of having to fully indemnify the

interested party who proves to have been damaged by the processing and, only at a later

stage, may have recourse against the other joint controllers responsible or co-responsible

for the actual damage, exercising the so-called recourse action.

9.2 – In the event of sanctions issued by the competent Authorities and referring to the

processing operations, the burden of the sanction shall be borne by all the joint controllers,

pro rata and jointly among them. If the liability of only one of the joint controllers emerges

unequivocally, the burden of discharging the sanction shall be borne solely by the joint

controller responsible for the breach.

9.3 – Without prejudice to the provisions of Article 82(4) of the GDPR, the Party that breaches

its obligations under this Agreement and/or in any case its obligations under European and

national legislation on the protection of personal data shall indemnify, hold harmless and

hold the other Party harmless from any damage, claim, compensation, penalty and/or

prejudice that may be suffered by the latter as a result of such breach.

Art. 10 – Procedures for exercising rights and contacts

10.1 – The Parties, for the exercise of the rights of protection of the personal data of the

interested parties, may contact:

For the University of Naples Federico II, the Data Controller in the person of the

Rector at the addresses email: ateneo@unina.it and PEC: ateneo@pec.unina.it, aswell as to the Data Protection Officer (DPO) at the addresses email: rpd@unina.it

and PEC: rpd@pec.unina.it;

For the Leopold-Franzens-Universität Innsbruck, the Data Controller: . in the person

of the Legal Representative: in the person of the Rector, who can be contacted at

the email addresses rektorin@ubk.ac.at. The Data Protection Officer can be

contacted at the email addresses datenschutzbeauftragter@uibk.ac.at,

For Univerzita Palackého v Olomouci the email address of the Data Controller and

of Data Protection Officer (DPO) will be indicated following the signing of the

present act and communicated to other parties

10.2 – Requests for the exercise of subjects’ rights may be made to and against each or all

joint controllers, as provided for in Article 26(3) of Regulation (EU) 2016/679.

10.3 – Joint controllers agree to forward the data subject’s request to each other, without

delay and, in any case, within forty-eight (48) hours of receipt of the same request.

10.4 – Joint controllers must cooperate and assist each other in fulfilling their obligation to

process the data subject’s requests, providing and making accessible the necessary

information and elements, in order to provide the data subject with a timely response in

compliance with the deadlines indicated in Article 12(3) and (4) of Regulation (EU) 2016/679.

Art. 11 – Signing, validity and amendment of the Agreement

11.1 – This Agreement shall be deemed signed for all legal purposes with the signing of the

Main Agreement, of which it is an integral part pursuant to Art. 9, of the Main Agreement.

11.2 – Amendments or supplements to this Agreement may only be made by means of a

declaration signed by the parties on one deed.

11.3 – For any other aspect not explicitly dealt with in this Agreement, reference is made to

the legislation in force concerning the protection of personal data.

Art. 12 – Duration

12.1 – This Agreement shall be effective for the duration of the Main Contract to which it

refers and shall, therefore, terminate with the termination, for any cause whatsoever, of the

Main Contract.