Verarbeitung personenbezogener Daten in der Justizvollzugsanstalt Dieburg (engl.)

This information does not replace the statutory provisions. It is purely for information purposes. The applicable statutory provisions contain, in part, extremely detailed rules. It is, therefore, always necessary to consult the applicable statutory text in order to carry out a legal assessment. However, the statutory provisions have been published, including on the Internet. If you have access to the Internet – which does not apply to persons who subject to imprisonment – you will find the laws of the German State of Hesse which are referred to in this informationÖffnet sich in einem neuen Fenster and the European legal provisionsÖffnet sich in einem neuen Fenster mentioned.

Personal data means all information which is related to an identified or identifiable natural person (hereinafter referred to as “data subject”). For example, this can be the name of a person or his or her date of birth.

This is defined as any process in connection with personal data.

In particular, this includes the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transfer, dissemination or other form of provision, alignment or combination, restriction, erasure or destruction.

This applies regardless of whether the processing of the data takes place in electronic or non-electronic form.

The processing of personal data also includes numerous pieces of information about the living situations of persons who come into contact with judicial enforcement in the German State of Hesse.

Judicial enforcement authorities can gather personal data from the data subject as well as from other bodies and persons. 

... in the judicial enforcement process in the German State of Hesse?

The Hessian Data Protection and Freedom of Information Act (HDSIG) applies where personal data is processed for the purpose of preventing, investigating, detecting or prosecuting criminal offenses or for the execution of sentences, in particular the third part, which implements the European Directive (EU) 2016/680.

In addition, the judicial enforcement laws of the German State of Hesse include special rules – depending on the type of imprisonment these can include the Hessische Strafvollzugsgesetz (HStVollzG) for the criminal act, the Hessische Jugendstrafvollzugsetz (HessJStVollzG) for the criminal act by a minor, the Hessische Untersuchungshaftvollzugsgesetz (HUVollzG) for pre-trial detention, the Hessischen Sicherungsverwahrungsvollzugsgesetz (HSVVollzG) for preventative detention and the Hessischen Jugendarrestvollzugsgesetz (HessJAVollzG) for the detention of juveniles. For the enforcement of the prison sentences referred to above (hereinafter “prison sentences referred to above”), the provisions of the enforcement acts referred to above apply as a matter of priority. Should these not contain any specific regulation, the general provisions of the HDSIG apply.

Within the scope of the European Directive (EU) 2016/680 and its implementing laws – the HDSIG in particular – its provisions apply as a rule and not the European Regulation (EU) 2016/679 (known as the General Data Protection Regulation).

In relation to the processing of data during the enforcement of the prison sentences referred to above, special information can be found under B. 

... does the General Data Protection Regulation apply?

Within the prison system in the German State of Hesse, the General Data Protection Regulation applies to those areas in which personal data is not processed for the purposes of preventing, investigating, detecting or prosecuting criminal offenses or for the execution of sentences.

Therefore, the General Data Protection Regulation generally applies, for example, to the employment relationships of employees in the judicial enforcement department of the German State of Hesse and, in individual cases, to contractual relationships of the judicial enforcement department with external bodies.

Furthermore, the General Data Protection Regulation applies to the processing of personal data which is gathered for the purposes set out in the (EU) 2016/680 Directive, but which is not further processed for its purposes, for example if personal data of prisoners needs to be passed on to the health, immigration or social authorities. This takes place in accordance with Article 9 Paragraph 1 Sentence 2 of the European (EU) 2016/680 Directive.

Other types of imprisonment which have not been ordered due to a criminal conviction or due to criminal investigation (such as so-called civil imprisonment according to §§ 171 et seq. of the Federal Prison Act (Strafvollzugsgesetz), such as detention or imprisonment prior to deportation in accordance with § 62a of the Federal Residence Act (Aufenthaltsgesetz) also come under the General Data Protection Regulation.

Special information is provided under C in the event that the General Data Protection Regulation applies in an individual case.

... of Information?

Regardless of whether the processing of personal data comes under the area of applicability of the HDSIG or the General Data Protection Regulation, according to the HDSIG you can contact the Hessian Commissioner for Data Protection and Freedom of Information should you be of the opinion that your rights have been infringed during the processing of your personal data by public bodies, including those in the area of judicial enforcement. 

The data protection officer of the German State of Hesse can be contacted via the following address:

The Hessian Commissioner for Data Protection and Freedom of Information
Postfach 3163
65021 Wiesbaden
Telephone: +49 611 1408 161

If you have access to the Internet – this does not apply to persons who are subject to imprisonment – you can also contact the Hessian Commissioner for Data Protection and Freedom of Information via the following email address:  poststelle@datenschutz.hessen.de.

... where it serves the purpose of enforcement of imprisonment?

The prisons and the Hessian Ministry of Justice – as the supervisory authority for the prisons under the rule of law – process personal data in accordance with § 58 HStVollzG and § 58 HessJStVollzG, § 54 HUVollzG, § 58 HSVVollzG and § 38 HessJAVollzG if this is stipulated or defined as mandatory under a specific legal provision, and otherwise insofar and for as long as is necessary for the execution of a custodial sentence.

... when enforcing imprisonment takes place with your consent?

As a data subject, you have the right in accordance with § 46 HDSIG to revoke your consent at any time. By means of the revocation of consent, the lawfulness of the processing which took place with your consent prior to the revocation will not be affected. You must be informed of such prior to issuing the consent. As a data subject, you must be informed of the intended purpose of the processing. Should this be necessary according to the circumstances of the individual case or should you so request, you must also be informed of the consequences of refusal to issue consent.

... when enforcing the prison sentences referred to above?

According to § 52 of the HDSIG, you as a data subject have the right in principle to receive free of charge information on request as to whether the competent authority processes personal data relating to you. You also have the right to receive information concerning:

• the personal data which is being processed and the category to which it belongs
• (where available) the origin of the data
• the purpose of the processing and its legal basis
• the recipients to whom the data has been disclosed
• the applicable duration of the saving of the data or, should this not be possible, the criteria for determining the duration of the saving of the data
• the existence of a right to rectification or erasure or to have the processing of the data by the controller restricted
• the right under § 55 HDSIG to contact the Hessian Commissioner for Data Protection and Freedom of Information and
• Information on how to contact the Hessian Commissioner for Data Protection and Freedom of Information

Should you be informed of a refusal to provide the information or of a restriction concerning the provision of the information in accordance with § 52 HDSIG, you can also exercise your right of information via the data protection officer of the German State of Hesse. The controller must inform you of this option and also that according to § 55 HDSIG you have the right to contact the data protection officer of the German State of Hesse or to seek legal remedies before a court.

The data protection officer of the German State of Hesse must inform you that all necessary inspections have taken place or that he or she has carried out an investigation. The notification provided to the data subject by the Hessian Commissioner for Data Protection and Freedom of Information must not permit any conclusions on the controller’s state of knowledge, unless the controller agrees to further information. The data protection officer of the German State of Hesse must also inform you of your right to pursue legal remedies before a court. The controller must document the factual or legal reasons for the decision.

... as well as to have the processing of personal data restricted, should the data processing take place in order to enforce the prison sentences referred to above?

According to § 53 HDSIG, you have the right to request that the competent authority immediately corrects incorrect data relating to you. Should it not be possible to determine the correctness or incorrectness of the data, you can request that instead of correction the processing be restricted. In such a case, the controller must inform you prior to lifting the restriction. You can also request the completion of incomplete personal data, should this be reasonable when taking the purposes of the processing into account.

According to § 53 HDSIG, you have the right as a rule to request erasure without undue delay by the competent authority of data relating to you, should its processing be unlawful, should the knowledge of the data no longer be necessary in order to fulfil the task or should the data need to be erased for compliance with a legal obligation.

Instead of deleting the personal data, the competent authority can restrict its processing if

• there are reasons to assume that erasure would impair the legitimate interests of a data subject,
• the data needs to be retained for proof purposes or
• erasure is not possible due to the special type of saving or is only possible with disproportionately high expense.

Data whose processing has been restricted may only be processed for the purpose which prevented its erasure or otherwise with the consent of the data subject.

Should the competent authority have carried out a correction, it must inform the body to whom it previously transferred the personal data of the correction. In cases where the personal data is rectified or erased or where the processing is restricted, the competent authority must inform the recipients to whom the data was transferred of the said measures. The recipient must correct or erase the data or restrict its processing.

The competent authority must inform you in writing should it refuse to rectify or erase personal data or should it not carry out the restriction of processing in place of the rectification or erasure, apart from in the exceptional cases set down in § 52 HDSIG. The notification must be explained, unless the notification of the reasons would endanger the purpose pursued by means of refusal to provide the information. The provisions in § 52 HDSIG concerning the engagement of the data protection officer of the German State of Hesse shall apply accordingly.

... when enforcing the above-mentioned prison sentences?

Special rules which take precedence over the general provisions of the HDSIG apply to the erasure of personal data and the restriction of its processing in the judicial enforcement department.

According to § 65 HStVollzG and § 65 HSVVollzG, in case of adult imprisonment and when enforcing security, personal data which was gathered using an electronic monitoring system or which was acquired by such must be erased without undue delay after completion of the measure, and video recordings or results from the reading of data carriers must be erased at the latest 72 hours after the end of the calendar day on which these were obtained. This does not apply should the continued retention of the personal data be absolutely necessary in case the processing is restricted for concrete proof purposes at the time of the decision concerning the erasure.

Should personal data have been processed even though it concerns the core area of private life, this must be erased without undue delay, at the latest 24 hours after the end of the calendar day on which it was acquired. Personal data which is saved in the prisoner’s or detained person’s file or in other documents and files which concern the prisoner or detained person must be erased at the latest following the release of the prisoner or detained person or his or her transfer to a different prison. Other personal data which is saved in other documents and files must be erased without undue delay, at the latest after the expiry of five years following its gathering, unless the continued saving of the personal data is necessary.

The restriction of the processing ends if prisoners or detained persons are readmitted to prison by means of the enforcement of a sentence or if the data subjects have issued their consent.

In case of the enforcement of prison sentences against juveniles and in case of juvenile detention, corresponding provisions apply with the condition that the date after whose expiry personal data must be erased at the latest is three years instead of five years in case of the enforcement of prison sentences against juveniles (§ 65 HessJStVollzG) and two years instead of five years in case of juvenile detention (§ 38 HessJAVollzG).

In case of the enforcement of pre-trial detention, corresponding provisions apply with the condition that the date after whose expiry personal data must be erased at the latest is two years instead of five years in case of pre-trial detention. However, a period of one month from the date on which the prison becomes aware of this shall apply instead if the prison becomes aware of a discontinuation of the proceedings that is not merely temporary, an incontestable refusal to open the main proceedings or a legally binding acquittal (§ 61 HUVollzG).

According to the principles of the judicial enforcement laws of the German State of Hesse, the following maximum periods for the retention of documents and files exist:

• 20 years in case of data from the personal files of prisoners, detained persons and arrested persons, as well as health files and medical records
• 30 years in case of data from records of prisoners and detained persons.

... should this take place in order to enforce the prison sentences referred to above?

Corresponding rights are listed below, stating the respective legal basis and the purpose of the processing. The duration of saving of the personal data which is acquired in this process depends on the deadline for the erasure of personal data; to this extent, reference is made to the above information concerning your right to have data erased.

... should this concern the enforcement of the above-mentioned prison sentences?

Should a breach of the protection of personal data be expected to represent a high risk to the rights and freedoms of natural persons, the controller must notify the data subjects of the breach without undue delay in accordance with § 61 HDSIG. 

... who are subject to the above-mentioned prison sentences?

In case of severe illness or death of a person who is subject to imprisonment, then in accordance with § 24 HStVollzG and § 24 HessJStVollzG, § 17 HUVollzG or § 24 HSVVollz, the nearest relatives known to the prisons, in particular the primary carers, must be notified immediately. In case of severe illness, this only applies if the persons subject to imprisonment have issued their consent. To this extent, there is the right but not the obligation to issue consent. Where possible, the request to also inform other persons should be complied with. 

Depending on the circumstances of the individual case, prison visits can generally be observed (but not visits by the defense lawyer) for reasons connected to the security or order of the prison or for care or treatment reasons, also by means of video monitoring. Also depending on the circumstances of the individual case, the knowledge acquired during this process can also be recorded and stored for reasons connected to security or order of the prison or for care or treatment reasons, including by means of video monitoring. Depending on the type of imprisonment to be enforced, the legal basis for the above is § 34 HStVollzG, § 33 HessJStVollzG, § 26 § HUVollzG, § 34 HSVVollzG and § 19 HessJAVollzG. The monitoring concerns both the visit and the person who is subject to imprisonment and also the conversations which take place during the visit.

... who are subject to the above-mentioned prison sentences monitored?

Depending on the circumstances of the individual case, the written correspondence of persons who are subject to imprisonment can be monitored as a rule for the same reasons as visits, depending on the type of imprisonment to be enforced in accordance with § 35 HStVollzG, § 34 HessJStVollzG, § 27 HUVollzG, § 35 HSVVollzG. However, this does not apply to written correspondence with the defense lawyer. In accordance with Section 18 HessJAVollzG, there is as a rule no monitoring of the content of youth detention.

... who are subject to the above-mentioned prison sentences monitored?

Depending on the circumstances of the individual case, persons who are subject to imprisonment who are entitled to telecommunications can generally be monitored for the same reasons as visits depending on the type of imprisonment to be enforced in accordance with § 36 HStVollzG, § 35 HessJStVollzG, § 28 HUVollzG, § 36 HSVVollzG and § 19 HessJAVollzG, however not the telecommunications with the defense lawyer. Should a telecommunications system be set up, then depending on the circumstances of the individual case, participation in such can be made dependent on the prisoners’ and other conversation participants’ agreeing to possible random monitoring of the telecommunications. 

Depending on the particular type of prison sentence referred to above being enforced, prisoners or persons in preventative detention can be subject to open optical monitoring outside of prison cells and persons detained for security reasons in accordance with § 45 HStVollzG, § 44 HessJStVollzG, § 30 HUVollzG, § 45 HSVVollzG including with technical equipment (in particular video monitoring) in order to ensure security and order in the prison. The information obtained may also be recorded and stored, depending on the circumstances of the individual case.

If prisoners or persons in preventive detention are subject to monitoring as part of a special security measure in accordance with § 50 HStVollzG, § 49 HessJStVollzG, § 35 HUVollzG § 50 HSVVollzG, this may also be carried out using technical equipment, in particular video surveillance. The information obtained may also be recorded and stored, depending on the circumstances of the individual case.

Depending on the type of prison sentence in each case, outside areas of the prisons may be monitored with technical equipment (in particular by means of video surveillance) in accordance with § 58 HStVollzG, § 58 HessJStVollzG, § 54 HUVollzG, § 58 HSVVollzG and § 38 HessJAVollzG in order to maintain security and order (including the prevention of dangers to security and order), provided there are no indications that the legitimate interests of the data subjects outweigh these concerns. The information obtained may also be recorded and stored, depending on the circumstances of the individual case. 

Persons who work in judicial enforcement and who are not in a service or employment relationship with the prison and who are not requesting access on behalf of another authority can only be admitted for this purpose if no security concerns exist. Depending on the type of imprisonment in accordance with § 58a HStVollzG, § 58a HessJStVollzG, § 54a HUVollzG, § 58a HSVVollzG and § 38 HessJAVollzG, the prison will carry out a reliability check with the consent of the relevant person in order to maintain security and order in the prison. For this purpose, the prison may

• obtain information in accordance with § 41 Paragraph 1 Number 1 of the Federal Central Register Act (Bundeszentralregistergesetz)
• or information from the police authorities
• and, where necessary, information from the State Office for Protection of the Constitution.

Furthermore, but never during visits by defence lawyers, the prison may also carry out a reliability check with consent in relation to persons who wish to visit prisoners, persons detained for security reasons or arrested persons or who wish to visit the prison in order to maintain security and order. In case of visitors, the authorities consulted during this process will also be informed that access to the prison is being requested and for which prisoners, persons detained for security reasons or arrested persons. Should the prison become aware of facts which are relevant to security, the data subject will not be permitted to carry out the work or visit the prison or permission will only be granted with restrictions. The same applies if the data subject refuses to consent to a reliability check.

Depending on the type of prison sentence to be enforced, § 59 HStVollzG, § 59 HessJStVollzG, § 55 HUVollzG, § 59 HSVVollzG or § 38 HessJAVollzG, it is permissible – for the purposes of execution, in particular to maintain the security or order of the prison – to obtain data from electronic devices with data memories that have been brought into the prison without permission. This shall require a written order from the prison management and must be based on specific evidence that justifies the assumption that this is absolutely necessary for the fulfillment of the objective and task of the execution of one of the aforementioned prison sentences and in particular to maintain the security or order of the prison. The reasons must be set out in the order. Should the persons concerned be known, they must be informed of the reasons prior to the reading. 

... in case of imprisonment, juvenile detention, detention for security reasons and the arrest of juveniles?

Depending on the type of prison sentence to be enforced, § 60 HStVollzG, § 60 HessJStVollzG, § 60 HSVVollzG and § 38 HessJAVollzG permit prisons or the supervisory authority, in conjunction with the relevant provisions of the HDSIG, to provide information on request as to whether someone is in custody, preventive detention or youth detention and whether and when they are likely to be released. In addition, including in case of the arrest of juveniles, information concerning the assets of the prisoners or their release address can also be issued following a written request, if this is necessary in order to determine or assert legal claims in connection with the criminal offence.

Subject to additional requirements, except in the case of the arrest of juveniles, notifications concerning the initial granting of measures leading to the initiation of enforcement can be provided by the prison. The persons who are subject to imprisonment will be heard prior to the above-mentioned notifications, unless concerns exist that the attainment of the interests of the applicant would be frustrated or made significantly more difficult as a result. Should the hearing not take place, notification concerning the information from the prison or supervisory authority will then be issued.

According to § 56 HSVVollzG, the prison or the supervisory authority can, following a request, provide notification as to whether

somebody is subject to pre-trial detention and the expected date of release. The persons who are subject to pre-trial detention will be heard prior to the notification, unless concerns exist that the pursuit of the interests of the applicant would be frustrated or made significantly more difficult as a result. Should the hearing

not take place, notification concerning the disclosure by the prison or supervisory authority will then be issued.

The authorities that have been notified in this regard must be informed in the event of a discontinuation of the proceedings that is not merely temporary, an incontestable refusal to open the main proceedings or a legally binding acquittal. The persons subject to pre-trial detention must be informed of their right to make a request during the hearing.

Depending on the type of imprisonment to be enforced, in accordance with § 61 HStVollzG, § 61 HessJStVollzG, § 57 HUVollzG, § 61 HSVVollzG and § 38 HessJAVollzG, certain persons subject to professional secrecy, in particular doctors, psychologists and social workers and, in individual cases, other persons, are entitled and in part also obliged to disclose personal data which has been entrusted to them in confidence by prisoners, or of which they have otherwise become aware, to prison management, should this be absolutely necessary for the security of the prison, for the planning of enforcement measures, or in order to defend against significant risks to the life or health of prisoners or third partis.

Disclosure is also permitted if this concerns determination of whether persons who are subject to imprisonment are capable of participating in certain measures of an enforcement nature or taking part in and co-operating with treatment measures. 

... in the area of applicability of the General Data Protection Regulation?

According to Article 6 GDPR, personal data can be processed, provided that one of the following reasons applies:

• the data subject has issued his or her consent to the processing of personal data concerning him or her for one or more specific purposes
• the processing is necessary in order to fulfil a contract whose contracting partner is the data subject or in order to perform pre-contractual measures which take place on the request of the data subject
• the processing is necessary to fulfil a legal obligation to which the controller is subject
• the processing is necessary to protect key interests of the data subject or another natural person
• the processing is necessary to fulfil a task which is in the public interest or which takes place in the course of exercising public powers which have been assigned to the controller.

A conclusive list of all conceivable instances in which personal data can be processed is not possible, in particular in relation to the numerous possible legal obligations to which prisons are subject.

... in the area of applicability of the General Data Protection Regulation?

Should data be processed within the scope of the General Data Protection Regulation, then you have the right in accordance with Article 15 to obtain information as to whether and to what extent the judicial enforcement authority processes your personal data. It must be borne in mind that this right of information can be restricted under individual provisions of the HDSIG, in particular in accordance with §§ 24 to 26 and 33.

... in the area of applicability of the General Data Protection Regulation?

Should processed data (no longer) be applicable, you can request rectification in accordance with Article 16 GDPR. Should the personal data be incomplete, completion can be requested.

In accordance with the conditions set out in Article 17 GDPR and § 34 HDSIG, you can request the erasure of your personal data. Your claim to erasure depends on various factors including whether the data concerned is still required by the competent authority in order to fulfil its statutory tasks.

... in the area of applicability of the General Data Protection Regulation?

Within the framework of the provisions set out in Article 18 GDPR, data subjects have the right to request a restriction of the processing of the personal data relating to them. Should the processing have been restricted, with the exception of saving, this personal data may only be processed with the consent of the data subject or in order to assert, exercise or defend legal claims or to protect the rights of another natural or legal person or for reasons connected to an important public interest of the EU or of a Member State. 

... in the area of applicability of the General Data Protection Regulation?

According to Article 20 GDPR, data subjects have the right to receive data in a specified format and to transfer this to third parties. This right does not exist if the judicial enforcement authority does not process the personal data on the basis of consent or by using automated procedures.

... in the area of applicability of the General Data Protection Regulation?

In accordance with Article 21 GDPR, data subjects have the right to raise an objection to the processing of personal data relating to them for reasons which are related to their particular circumstances. However, the right to raise an objection does not apply if a mandatory public interest in the processing applies that outweighs the interests of the data subject or if processing is required for compliance with a statutory regulation (§ 35 HDSIG).

The following data protection notices apply to the Internet service of the authority named under A – which is not accessible to persons who are subject to imprisonment – and to the personal data gathered via this website. To this extent, the named authority is also responsible for such. For Internet sites of other providers which are referred to via links for example, the data protection notices and declarations there apply.

The Internet service is maintained by the  Hessische Zentrale für DatenverarbeitungÖffnet sich in einem neuen Fenster as a technical service provider on behalf of the competent authority and in accordance with its guidelines.

Each time an Internet file is requested, the following access data is saved by the Hessische Zentrale für Datenverarbeitung for statistical evaluations by the employees of the state administration or the HZD:

• the site from which the file was requested
• the name of the accessed file
• the date and time of the request
• the transferred data quantity
• the access status (file transferred, file not found etc)
• the type of access (GET, POST)
• description of the browser and operating system used
• the anonymised IP address of the requesting computer
• the session ID
• cookies

For reasons connected to data security, i.e. in order to clarify unauthorised access or prevent misuse of the Internet site, the full IP address of the requesting computer will be recorded, saved and automatically erased seven days after the end of the access. Cookies or JAVA applets can be used on this Internet site. The use of these functions can be turned off by the respective user by setting the browser program accordingly.