Data protection and privacy policy for the Charité YouTube channel

The controller responsible for the processing of your personal data as described in detail in Sec. 3 below, as defined in Article 4(7) GDPR, is

Charité – Universitätsmedizin Berlin, represented by Prof. Heyo K. Kroemer, Chief Executive Officer of Charité,
Charitéplatz 1, 10117 Berlin, Germany
Tel.: +49 (0) 30 450 50 (also referred to in this text as “we” or “us”).

We are not the controller responsible for the processing of personal data originating with YouTube that occurs when you visit the YouTube channel. When you do this, Google Ireland Limited, having its registered office at Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), processes information including your IP address and further information stored in the form of cookies on your device or in your browser. Google processes this information for purposes including preparing statistics concerning our YouTube channel. As the operator of the channel, these statistics are provided to us in anonymized form by Google. This includes but is not limited to the total number of times our YouTube channel is accessed and the reach of individual videos.

Google bears sole responsibility for this data processing as the controller for purposes of data protection and privacy law. Charité has no influence over the nature or scope of the data processed by Google, the nature of processing, or the disclosure of these data to third parties.

Which information Google processes, how, and for what purposes is described in Google’s privacy policy. You can also consult this policy for information on ways to contact Google. The privacy policy is available at https://policies.google.com/privacy?hl=en. For further information, such as information on the cookies Google uses, please visit https://policies.google.com/technologies/cookies?hl=en.

You can reach our data protection officer by e-mail at datenschutzbeauftragte(at)charite.de or by postal mail at the above address, adding “An die Datenschutzbeauftragte” (“Attn.: Data Protection Officer").

The following data processing is performed at our end when you visit our YouTube channel.

a)    Comment and subscribe function

If you comment on one of our videos, we use your personal data. This includes but is not limited to your YouTube username (which need not necessarily be your actual name; it may also be a nickname), the link to your YouTube profile, the content of your comments, and the point in time at which you commented on the video on our YouTube channel. If you also subscribe to our YouTube channel, we process that information as well. Please note that Google also processes these data as a controller for purposes of data protection and privacy law in its own right.

We process the data concerning you as outlined above for the purpose of, and in our interest in, targeted and balanced public relations work. The goal of our YouTube channel is to provide as many users as possible with access to credible, professional health information. We also aim to let you know more about professional roles within Charité, and particularly the allied health professions. With society as a whole aging and allied health professionals in increasingly short supply, we – like the entire healthcare sector – are looking for new employees. Our videos are intended to spark your interest in a healthcare profession in general and possibly in Charité as an employer. We aim in particular to reach those persons who primarily get their information from social networks. In this regard, we see this YouTube channel as a contemporary addition to our public relations work. We also aim to give you the opportunity to express your opinion through activities and responses to our videos, thereby supporting and promoting the process of public formation of opinions. The legal basis for this is point (f) of Article 6(1) GDPR.

Please do not disclose any special categories of personal data as defined in Article 9(1) GDPR in your comments, particularly not health data. If you do so anyway and make this information public on our YouTube channel, our data processing is based on point (e) of Article 9(2) GDPR.

For purposes of community management, we transfer your personal data as detailed above to a service provider with which we have entered into an agreement concerning processing of data on another entity’s behalf in accordance with Article 28 GDPR. We remain the controller.

The personal data detailed above remain visible and thus stored on our YouTube channel until your YouTube profile is deleted or the relevant data, such as the video you have commented on, are erased.

b)    Reporting

You can also report videos to us if you believe they show inappropriate content. In this case, we use and store your YouTube username, your contact details, the content, and the time of your report. We also use the YouTube username of the person who has occasioned the report and the reported content and the time of disclosure of the content on the YouTube channel.

We use the data listed above to review your report with an eye to the inappropriate content, remove the content where appropriate, and notify you of the results of our investigation. The legal basis is point (f) of Article 6(1) GDPR. Where the matter should be brought to the attention of law enforcement, we may disclose the personal data we have collected concerning the person who made the report and the person who has been reported to law enforcement agencies. We may store the personal data to the extent that, and for as long as, this is necessary for legal proceedings or to fulfill our retention obligations.

c)    Blocking of users

We reserve the right to block certain users if their comments contain inappropriate content, particularly insulting or defamatory content. To do this, we use the YouTube username, the link to your YouTube profile, the content of your comments, and the time at which you have commented on the video on our YouTube channel.

We use the personal data detailed above to establish and maintain an appropriate exchange of opinions on our YouTube channel. In particular, we aim to prevent defamatory content. The legal basis is point (f) of Article 6(1) GDPR.

After we have blocked a user, we store that person’s personal data as long as the block is in place.

You are not obligated either by law or under contract to provide your personal data to us. However, if you do not provide your personal data to us, you may not be able to use the functions mentioned in point 3 hereof, such as the comment or reporting function.

We do not engage in automated decision making.

Google may transfer the personal data mentioned above to countries outside the European Economic Area (“EEA”). Google bears sole responsibility for this data processing as the controller for purposes of data protection and privacy law. According to information from Google, the lawfulness of this transfer to what are known as “third countries” is ensured through the EU standard contractual clauses and adequacy decisions.

We use the Facelift tool from processor Facelift brandbuilding technologies GmbH, Gerhofstr. 19, 20354 Hamburg, Germany, to be able to manage our social media channels more easily. You can find the Facelift data privacy policy here: https://facelift-bbt.com/en/data-protection.

Facelift serves primarily to make it easier to manage all the social media channels we maintain. If a user uses the comments function on our social media page to ask a question specified in further detail in Facelift, then the text and the user’s username flow into the tool together and are displayed to us. The text that has been transmitted and the username are deleted once the inquiry has been answered.

The legal basis for the data processing is point (f) of Article 6(1) GDPR. We use Facelift because we have a legitimate interest in managing the content on our Twitter profile in a way that saves both time and costs but is equally effective, which includes collecting and responding to comments by visitors to our profile. In this regard, it is also in the interest of visitors for their comments to be acknowledged centrally and promptly and – depending on the content – recognized or answered by Charité. This gives us a better overview of user comments, which facilitates communication with the users of our social media presence.

Charité uses Talkwalker for the purposes of brand monitoring on our social media websites and to optimize our campaigns. The brand monitoring encompasses monitoring, collection, and analysis of mentions, statements, and perceptions relating to Charité on the various social media websites. Primary goals here include monitoring the reputation and acceptance of Charité in the public and among consumers and assessing these factors on a targeted basis in terms of demographics.

This Web analytics service is provided by Talkwalker Sàrl, 12-16 Avenue Monterey, 2163 Luxembourg, Luxembourg. The service includes extensive data analysis and provision of all information and opinions mentioned regarding Charité on social media platforms, a search engine option for brand and trend checks and for comparison with competitors, and tracking of campaigns placed by Charité.

We process your personal data on the basis of our legitimate interest pursuant to point (f) of Article 6(1) GDPR. Our interest consists in keeping abreast of what is being published and said about Charité and having this information in order to be able to respond to issues such as fake news or security problems. The data collected in this context are deleted after this purpose ceases to apply and after we stop using Talkwalker.

Where your personal data are processed, you have, pursuant to the GDPR, the rights of access to and rectification or erasure of personal data, the right to data portability, and the right to restriction of processing.

Since we process your personal data on the basis of our legitimate interest (point (f) of Article 6(1) GDPR), you can object to the processing by contacting us or the data protection officer (by e‑mail, for example; for contact details, see points 1 and 2 above).

If you are exercising your right to object, please specify the reasons that your personal data should not be processed. In case of an objection, the facts of the matter will be reviewed and the data processing will either be discontinued or adjusted to fit the circumstances, or you will be informed of the compelling legitimate grounds on which the processing is being continued.

In cases in which Google alone is the controller responsible for data processing, please contact Google to assert your rights as a data subject as described at https://policies.google.com/privacy?hl=de#europeanrequirements.

You also have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.

The data protection supervisory authority with jurisdiction over us is:

Berlin Commissioner for Data Protection and Freedom of Information

Alt-Moabit 59-61    
10555 Berlin, Germany    
Entrance: Alt-Moabit 60    
T: +49 30 13889 0    
F: +49 30 2155050    
E-mail: mailbox(at)datenschutz-berlin.de