Study Study

A chip card system necessitates the storage of personal data, otherwise it will not function properly. To adequately address this critical aspect, particularly with regard to student privacy, the Student Union, the HAW Hamburg Executive Board, and the project managers have agreed on the following points:

• The amount of personal data stored shall be kept to a minimum.
• The student ID card shall not be used to store personal data or a record of card use.
• Wherever possible, card use shall not be recorded.
• Where card use is recorded, this shall be done exclusively on an anonymised basis (for example, using the card number).
• Card-use history shall only be accessed in exceptional cases – for example, in criminal investigations.
• Card-use logs can only be accessed by a specified group of people in accordance with the two-person rule and the use of a split password (i.e. the log data can only be accessed when a member of the Staff Council (Personalrat), who knows one part of the password, and a member of staff from the Chip Card Services Office, who knows the other part of the password, are present).
• Consultation with the Hamburg Data Protection Officer shall take place regarding all aspects of the project related to data protection on the basis of a risk analysis and process description.

The conditions governing the processing of students' personal data and access to log data are defined in agreements between the Student Union and the Executive Board.

When you receive your electronic student ID card, you will also receive an individualised data record that clearly lists which personal data will be processed.

The HAW Hamburg staff responsible for the project have chosen a secure chip card technology for the student and staff ID cards. We are not using the 'MIFARE classic' RFID chip, which has come under fire for being 'hackable'. Instead, we use the 'MIFARE DESfire' chip in all HAW Hamburg chip cards.

The MIFARE DESfire chip has its own processor and is therefore able to meet much stricter security requirements. The encryption procedure is based on the proven advanced encryption standard and is activated on the chip card three times with three different keys each time the card is used (Triple DES). The key length is 128 bits, compared to 48 bits for the MIFARE classic.

In simple terms, this means that if it took one minute to decrypt a 48-bit key, decrypting a 128-bit key would take so long that the universe could re-form multiple times.

No! The individual card applications (cafeteria, access, library, printing and copying) are completely separated in the card's chip. The electronic applications can only access that part of the card for which they have the required keys. Just as you cannot open your letterbox with your door key, the card reader for electronic access to particular rooms cannot access the e-wallet.

Your photo is deleted directly after the card is issued. If you require a replacement card, the Chip Card Services team will take a new photo.

The chip card cannot be located, as the transmission range of the RFID chip is only 10 cm. The radio communication is also encrypted.

• Photo (CMYK)
• Doctor title (if applicable)
• First name
• Surname
• Surname prefix (e.g. 'von' or 'de')
• Title (e.g. 'Count', 'Baroness', etc.)
• Student number
• Chip card serial number
• Period of validity (printed on card when it is validated)
• HVV semester ticket
• Library account number (on the back)
• Library barcode for borrowing (on the back)

• Status (HAW Hamburg student)
• Personal ID number (for cafeteria discount)
• Student number
• Valid from (date of validation)
• Valid until (end of the semester for which the semester contribution has been paid)
• Library account number
• Access number
• Access sequence number (for replacement cards)
• Chip card serial number
• Cafeteria project number (for use in cafeteria till system)

The food and drink you pay for in the cafeteria is recorded under the chip card serial number. This number cannot be matched to a person either by a payment system or by the staff of Studierendenwerk Hamburg. This 'anonymous number' will only be matched to the cardholder and provided to the investigating authorities in the event of a serious crime.

When you enter and exit electronically secured areas using the card access system, the date, time and access ID are saved. This log data is automatically deleted after six weeks. The data will only be accessed and analysed in the event of a crime such as theft or vandalism. Access to this data is protected by a split password: one part of the password is held by the Staff Council (Personalrat) and the other part by the Chip Card Services Office (which administers the chip cards).

The only people with access to your card data are the staff of the HAW Hamburg Chip Card Services Office. This data is only accessed to produce the card and to provide chip card support. All staff have signed a written statement requiring them to protect the confidentiality of this data.