Data protection notice
We (the Dezernat Interne Ermittlungen / Department of Internal Investigations) appreciate your interest in the corruption whistleblower system (BKMS® System). We take the subject of data protection and confidentiality very seriously and follow the provisions of the EU General Data Protection Regulation (EU GDPR) and applicable national data protection regulations. The responsible handling of personal data is very important to us. Please read this data protection information carefully before submitting a report.
With Directive (EU) 2016/680 on the processing of personal data by the competent authorities for the purpose of preventing, investigating, detecting or prosecuting criminal offenses or the execution of sentences - the so-called Richtlinie für Justiz und Inneres / Justice and Home Affairs Directive (JI-RL) the European Union has standardized the rules on the processing of personal data by the judicial and police authorities. These have been implemented in national law in Part 3 of the Federal Data Protection Act (BDSG) and in the law on data processing by the police (HmbPolDVG).
Data are personal if they can be used to identify a natural person; legally, this also includes pseudonymised data. However, completely anonymous data is not considered to be personal data. They no longer have any personal reference.
Use of the whistleblower portal
Communication between your computer and the whistleblower system takes place via an encrypted connection (SSL). The IP address of your computer is not secured while you are using the whistleblower portal. To maintain the connection between your computer and the BKMS® System, a cookie is stored on your computer that only contains the session ID (so-called zero cookie). The cookie is only valid until the end of your session and becomes invalid when you close the browser.
You have the option of setting up a secured postbox in the whistleblower system with a pseudonym / user name and password of your choice. In this way, you can send reports to the responsible employee in the Department of Internal Investigations by name or anonymously and securely. In this system, the data is only stored in the whistleblower system and is therefore particularly secured; it is not an ordinary e-mail communication.
Notes for sending attachments
When submitting a report or sending an addendum, you have the option of sending attachments to the responsible employee from the Department of Internal Investigations. If you would like to submit a report anonymously, please note the following security notice: Files can contain hidden personal data that endangers your anonymity. Remove this data before sending. If you cannot remove this data or if you are unsure, copy the text in your attachment to your message text or send the printed document anonymously to the address given in the footer, quoting the reference number that you will receive at the end of the reporting process.
Responsible and data protection officer
The Department of Internal Investigations is the Service provider within the meaning of the Telemediengesetz (TMG) / Telemedia Law and the person responsible within the meaning of the Datenschutz-Grundverordnung (DSGVO) / General Data Protection Regulation and for the processing of personal data:
Dezernat Interne Ermittlungen
(Department of Internal Investigations)
Burchardstraße 8
20095 Hamburg
Mail: kontakt-die@bis.hamburg.deIf you have any questions about the protection of your data and the exercise of your rights, you can contact the responsible data protection officer:
Behördlicher Datenschutzbeauftragter
Polizei Hamburg
Steindamm 82, 20099 Hamburg
Mail: Datenschutz-Polizei@polizei.hamburg.dePlease consider the limited security of unencrypted email communication.
The whistleblower system is operated by a specialized company, EQS Group GmbH, Bayreuther Str. 35, 10789 Berlin in Germany, as a processor for the Department of Internal Investigations. We have taken technical and organizational measures to ensure that the data protection regulations are observed both by us and by the processor.
Personal data and information entered into the whistleblower system are stored in a database operated by EQS Group GmbH in a high-security computer center. Authorized persons in the Department of Internal Investigations can only view the data. EQS Group GmbH and other third parties have no access to the data. This is guaranteed in the certified process through extensive technical and organizational measures.
All data is encrypted and stored with multiple password protection levels and is subject to an authorization concept so that access is restricted to a very small group of recipients who are expressly authorized by the Department of Internal Investigations.
Purpose and legal basis for data processing
In general, police data processing takes place based on various legal bases for a specific purpose. The consent of the person concerned is also partially legally permissible. Amongst other things
- in order to prosecute criminal offenses and administrative offenses, personal data are usually processed based on the statutory provisions of the Strafprozessordnung / Code of Criminal Procedure (StPO). In addition, data processing for these purposes also takes place in accordance with the provisions of the Federal Data Protection Act (BDSG), parts 1 and 3;
- the data processing for general police security is based on the Hamburg law on data processing by the police (HmbPolDVG);
- as part of the cooperation with the Federal Criminal Police Office, personal data are processed by the Department of Internal Investigations, also based on the Bundeskriminalamtgesetzes / Federal Criminal Police Office Law (BKAG).
If personal data of data subjects are processed for other purposes or further processed for other purposes, this is only done within the framework of legal provisions.
The corruption whistleblower system is used to receive process and manage reports on committed or imminent corruption crimes in a secure and confidential way. This is intended to prevent, investigate, detect or prosecute corruption crimes within the meaning of Article 1, Paragraph 1 of the JHA Directive (EU) 2016/680 and to protect whistleblowers. If the report concerns a compliance violation with regard to an administrative or operational sequence at risk of corruption or an organizational structure of a government body that is at risk of corruption, the data required for the risk management check will be disclosed to the responsible government body. The legal basis of the data processing are the §§ 483 Abs. 3, 500 StPO (Code of Criminal Procedure) in conjunction with § 36 Abs. 1 HmbPolDVG (Hamburg law on data processing by the police).
Type of personal data collected
The whistleblower system is used on a voluntary basis. If you submit a report via the whistleblower system, we collect the following personal data and information:
- Your name, if you disclose your identity,
- If applicable, the names of the companies and authorities you have communicated and
- If applicable, names of persons and other personal data of the persons you name in your report (this can include, for example, personal master data, electronic communication data, employee master data, employment relationship and scope, contact data, log data, financial data, company and customer data, contract and contract master data).
Confidential treatment of information
Incoming information is received by a narrow group of expressly authorized and specially trained employees in the Department of Internal Investigations and is always treated confidentially. The employees in the Department of Internal Investigations examine the facts and, if necessary, carry out further case-related clarifications of the facts.
As part of the processing of a report, it may be necessary to pass on information to a responsible federal and state law enforcement authority or another competent authority. This can be the case, for example, if there is a reference to a company or to authorities based in another federal state or the responsibility for investigating a criminal offense does not lie with the Department of Internal Investigations. Companies can also be based in countries outside the European Union or the European Economic Area, in which there may be different regulations for the protection of personal data. We always make sure that the relevant data protection regulations are complied with when forwarding information.
Anyone who has access to the data is obliged to maintain confidentiality.
Informing the accused
In principle, we are legally obliged to inform the accused that we have received a notice about them as soon as this information no longer jeopardizes the follow-up of the notice. Insofar as your identity as the whistleblower is known to us, it will not be disclosed - as far as legally permissible.
Rights of the data subject
According to European data protection law, data subjects have the right to information, correction, deletion, restriction of processing and the right to object to the processing of their personal data. If the right of objection is exercised, we will immediately check to what extent the stored data is still required to process a note. Data that is no longer required will be deleted immediately. You also have the right to lodge a complaint with a supervisory authority.
Right to access information
Any person concerned can request information about the personal data processed by the Department of Internal Investigations. In the request for information, the request should be specified in terms of the occasion, type and scope of the data concerned in order to facilitate the compilation of the required data. Therefore, the application should also contain as specific information as possible on the facts on which the data processing is based.
Requests for information to be sent to the Department of Internal Investigations should be addressed to:
Dezernat Interne Ermittlungen
Burchardstraße 8
20095 Hamburg
Mail: kontakt-die@bis.hamburg.dePlease do not use the above e-mail address for confidential contact with the official data protection officer.
Right to rectification
If the data processed on the data subject is no longer correct, they can request a correction. If the data processed about them are incomplete, the person concerned can request completion.
Right to erasure
The data subject can request the deletion of their personal data if the reason for the processing no longer applies.
However, further processing can only be restricted if the accuracy of the processed personal data is disputed or the personal data must be kept for evidence purposes.
Right to complain
If a person concerned is of the opinion that the Department of Internal Investigations has not or not fully complied with their request, they can lodge a complaint with the competent data protection supervisory authority:
Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
(The Hamburg Commissioner for Data Protection and Freedom of Information)
Ludwig-Erhard-Straße 22, 20459 Hamburg
Tel.: (040) 4 28 54 - 40 40
Mail: mailbox@datenschutz.hamburg.deGeneral information on the rights of data subjects
Due to the relevant legal provisions, the aforementioned rights of data subjects may be subject to restrictions.
In some cases, the Department of Internal Investigations may or may not respond to the concern or application of the person concerned, not at the current point in time or not fully. Should a request be partially or completely refused, the person concerned will be informed of the reason to the extent possible and permissible in each case. Regardless of this, those affected receive an answer from the Department Internal Investigations within three months of receiving their request. Regardless of this, those affected receive an answer from the Department of Internal Investigations within three months of receiving their request. If a final clarification takes longer than three months, the person concerned will receive an interim message.
Retention period of personal data
Personal data are kept or stored for as long as the clarification and final assessment of the information require, as is necessary for the respective task fulfillment (see above purpose) or a legitimate interest of a competent authority exists or this is required by law. The different periods of retention or storage or deletion periods are specified in more detail in the relevant provisions (see above purpose). After processing the information, this data will be deleted in accordance with the legal requirements.
Status: March 2021