Regulations for Protecting Data from Language Examinations Administered by the Foreign Language Centre at the University of Pécs
The University of Pécs ensures that its data management activities adhere to the following stipulations: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (henceforward referred to as General Data Protection Regulation); Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Information Act); other relevant regulations; the data protection practice developed by the Hungarian National Authority for Data Protection and Freedom of Information (NADF); Government Decree No. 137/2008 (V. 16.) on the certified examination of foreign language attainment and on the nostrification in the Republic of Hungary of language certificates of foreign language attainment issued abroad (Govt. Decree 137/2008); the internal operating procedures of the ECL Examination Centre; and the Accreditation Handbook.
1. The Purpose of This Handout
The purpose of this document is to provide information on the data protection and data management principles applied by the data controller related to the personal data of the candidates taking the language exams the controller organizes.
2. Name of Data Controller
Name: University of Pécs
Headquarters and postal address: 7622 Pécs, Vasvári Pál Street 4. Hungary
Representative: Rector Dr. Attila Miseta, and Chancellor Zoltán Jenei
Organisational unit carrying out data management activities: Foreign Language Centre, ECL Language Examination Centre
Representative: Réka Werner
Name of contact person: Veronika Bereczki
Telephone: +36 72/501-500
E-mail address: werner.reka@inyk.pte.hu
Name of data protection officer: Dr. Gergely László Szőke
E-mail address: adatvedelem@pte.hu; +36 (30) 179 5672
Accreditation identification number of the Examination Centre on the basis of which it is permitted to conduct language exams: AK-XII/1/2001 (ECL language examination system and Hungarian language) and AK-XII/3/2002 (English and German languages).
3. The Scope of Personal Data Management
The scope of the personal data managed by the controller includes any data that the Candidate provides to data controller when she/he applies to take a language exam, and any other data that the Candidate sends to data controller in connection with the exam.
Should there be any change in data handled by the data controller during the time it manages the data, the candidates must report this change immediately to the contact person identified in point 2 above.
4. The Aim and Legal Basis of Data Management
4.1 When a candidate enters a language exam, the controller identifies her/him and verifies their entitlement data. With the permission of the candidate and according to Point a) in Paragraph (1) Article 6 of the General Data Protection Regulation, the controller acquires the candidate's first and family name, place and time of birth, address and mother's maiden name. If the Candidate revokes her/his consent to providing the necessary data to management, the controller has no way of ensuring the Candidate's participation in the language exam.
4.2 The data controller uses the name, address and email-address of the Candidate with her/his permission – Point a) in Paragraph (1), Article 6 of the General Data Protection Regulation – for the purposes of communicating during the exam. If the Candidate revokes her/his consent, the data controller has no way of providing more information about the exam.
4.3 On the basis of the permission given by the Candidate – Point a) in Paragraph (1), Article 6 of the General Data Protection Regulation – the data controller manages the audio recording during the oral exam for the purposes of reviewing the speaking section of the exam and standardizing procedures. If requested, a scoring appeal can be submitted by the Candidate. The Candidate also agrees to terms and conditions permitting the reading, writing and listening exams to be video recorded by on-site CCTV systems as well as the speaking exam to be audio recorded at the exam locations. If the Candidate revokes her/his consent to this data collection, the Candidate will not be permitted to take reading, writing and listening exams at the testing sites, and the controller cannot approve the request for reviewing the oral exam results without an audio recording.
4.4 In order to ensure that the exam is administered properly and the results are determined in accordance with Point b) in Paragraph (1), Article 6 of the General Data Protection Regulation, the data controller manages the data for the selected language exam (language, examination site, level, type, date and selected partner – if applicable) and the tests written and submitted during the written exam.
4.5 To issue an invoice, the data controller – according to Point c) in Paragraph (1), Article 6 of the General Data Protection Regulation, which is a legal requirement of the Act CXXVII of 2007 on value added tax (VAT Act) – handles the name and address of the person who paid for the exam and any other related fees.
4.6 In order to preserve the invoice, the data controller – according to Point c) in Paragraph (1), Article 6 of the General Data Protection Regulation and based on a legal requirement – handles the name and address of the person who paid for the exam and any other related fees.
4.7 Data controller uses the information regarding the gender and the highest completed level of education of the Candidate on the basis of the permission given by Candidate – Point a) in Paragraph (1), Article 6 of the General Data Protection Regulation – for the purposes of statistics and quality assurance. This is necessary to enable the individuals responsible for test development to adjust the content of the exam to the interests of the Candidates.
4.8 To determine whether Candidates take their exam in a foreign language, the data controller manages the data regarding the nationality of the candidate according to a legal requirement – Point c) in Paragraph (1), Article 6 of the General Data Protection Regulation, i.e. Chapter (2) in § 3 of Government Decree No. 137/2008.
4.9 As required by law – Point c) in Paragraph (1), Article 6 of the General Data Protection Regulation, i.e. on the basis of Chapter (4) in § 4 and Paragraph (2a) in § 5 of Government Decree No. 137/2008 – and for the purposes of filling in the language exam register, the data controller is permitted to use the personal data of the Candidate (name, mother's maiden name, place and date of birth), the data related to the chosen language exam (language, examination site, level, type and date of exam), the tests written and submitted at the written exam, the assessment and result of the exam, the score achieved on each test, the score achieved on the exam expressed as a percentage of the maximum score, and the number of the certificate.
4.10 As required by law, according to Point e) in Paragraph (1), Article 6 of the General Data Protection Regulation, in order to confirm the results of the language exam and the decisions made in connection with the application, appeal and review processes, the data controller manages the data and documents supporting the result of the exam and the other related decisions, especially the test papers, the writing and speaking tasks, and data verifying entitlement for individual treatment.
4.11 As required by law, according to Point e) in Paragraph (1), Article 6 of the General Data Protection Regulation, in order to handle the request for reviewing the result of the language exam, the data controller manages the data necessary to assess requests for review.
4.12 As required by law, according to Point e) in Paragraph (1) Article 6 of the General Data Protection Regulation, in order to verify participation in the language exam, the data controller handles the data of the Candidate as submitted on the list of participants.
5. Duration of Data Management
The duration of data management is stipulated as follows: in the case of points 4.1 and 4.2, the data is valid until the candidate revokes their permission; in the case of point 4.3, the data is valid for three years or until the candidate revokes their permission; in the cases described under points 4.4 and 4.10–4.12, the data is valid for three years according to the Accreditation Handbook (http://www.nyak.hu/nyat/doc/ak2015/ak2015.htm) made public by the Educational Authority Accreditation Centre for Foreign Language Examinations on the basis of Government Decree no. 137/2008; in the case of point 4.5, the data is valid until the invoice is issued; in the case of point 4.6, the data is valid for eight years according to § 169 of Act C of 2000 on Accounting; in the case of point 4.7, the data is valid until the candidate revokes their permission; in the case of point 4.8, the data is valid until the existence of the legal obligation.
6. The Scope of Personnel Involved in Data, Data Supply, and Data Processing
Personal data may be shared with the authorised colleagues of the data controller, as well as with individuals who process data as part of their job responsibilities. Employees involved with such data sign a declaration of confidentiality. The data controller supplies data to other organisations or people solely on the basis of a possibly existing legal obligation.
Language exams are administered in the Examination Centre and the examination sites under contract with the Centre. The examination sites function as locations for data processing. The list of examination sites (data processors) can be found at https://eclexam.eu/exam-sites/
Test papers are assessed by professionals employed either full-time or on a contractual basis by the Examination Centre or the examination sites. In the latter case, according to Article 29 of the General Data Protection Regulation, these raters are qualified as employees working under the control of the data controller or processor.
Data processors are not allowed to make any decisions regarding data management. They are only allowed to process personal data they encounter in accordance with the directives of the data controller, and they are not allowed to process data for private use. The examination sites are only allowed access to the personal data of candidates who take their exams at their location, while the raters only have access to the test papers they rate and the data necessary to complete their work. They are required to keep data confidential according to the instructions provided by the data controller.
In order to guarantee the high quality assessment of the written communication test papers (composition) by native speakers – in line with the requirements of accreditation – these tests may be given to foreign raters (placed in an EEA member state or in a third country) for assessment. Sending the test papers to a third country may happen only in the case of language exams taken in English (United States of America), Serbian (Serbia) and Russian (Russia) languages. The Examination Centre only forwards the code of the examination site, the date of the exam, the name and signature of the Candidate and a computer-generated code (which makes identification clear in the future) to the foreign raters. Other personal data is not sent to foreign raters. Following the assessment process, the foreign raters send the test papers back immediately, but no later than six weeks after the exam was administered. When forwarding personal data to data processors outside the EEA, the data controller employs a data processor whose country the European Commission acknowledges as a place which guarantees an appropriate level of data protection. For example, for raters in the United States of America, there is a mechanism employed which, according to the General Data Protection Regulation, offers adequate assurances and protects personal data.
On the basis of Point 3a) § 4 of Government Decree 137/2008, the data controller forwards the necessary data to the Education Authority in order to make a decision regarding an appeal submitted by a Candidate. On the basis of Paragraph (4) § 4 of Government Decree 137/2008, the data controller forwards the necessary data to the Education Authority to be used for the language exam register.
7. Data Security
Employing adequate technical or organisational measures, the data controller guarantees appropriate protection for candidates' personal data, including protection against unauthorised and unlawful management, accidental loss, destruction or damage of personal data. For further information on data protection measures employed by the University of Pécs, please see § 20–22 of the Data Protection Regulation and Chapter IV of the Regulation on Informatics.
7. Rights of the Candidate
7.1 The Candidate is entitled to have access to information determined by Article 15 of the General Data Protection Regulation, and it is imperative that the data controller informs the Candidate about the following information the controller manages:
- the type of personal data,
- the purpose and legal basis for collecting data,
- the sources used for collecting data,
- the duration the data will be archived in company records,
- the recipients of the personal data (i.e. who has access to the data, when was access given, on what legal grounds was access granted),
- the Candidate's rights and means of appeal regarding data management.
7.2 On the basis of Article 16 of the General Data Protection Regulation, candidates are entitled to have their inaccurate (incorrect or incomplete) personal data corrected or rectified.
7.3 In the case of data management on the basis of the consent provided, according to Paragraph (3) Article 7 of the General Data Protection Regulation, the Candidate is entitled to revoke their consent in writing without giving any reasons at any time. Such revocation does not affect the legality of data management carried out before revocation was submitted.
7.4 According to Paragraph Article 17 of the General Data Protection Regulation, the Candidate is entitled to have their personal data deleted, especially if the purpose for data management no longer exists, if data management is unlawful, if the Candidate revokes their consent (and there is no legal basis for managing data further) or if the data controller gives way to raising objection on the basis of their right to object.
7.5 According to Article 18 of the General Data Protection Regulation, the Candidate is entitled to request a restriction with regards to managing their personal data. If this is the case, besides storing the information, the personal data subject to restriction can be used only with the consent of the Candidate. Additionally, it can be used only to submit, realize or protect a legal claim, protect the right of natural or legal entities, and if the public interest of the EU or any of its member states requires it.
7.6 According to Article 20 of the General Data Protection Regulation, the Candidate is entitled to receive the personal data they submitted in a widely used electronic form and forward such data to other data controllers.
7.7 According to Article 21 of the General Data Protection Regulation, the Candidate is entitled to protest against data management.
7.8 Detailed information on how Candidates may exercise their rights connected to data management is included in the Data Protection Regulation of the University of Pécs: https://pte.hu/sites/pte.hu/files/share/UQA/Adatvedelmi_szabalyzat_20250325.pdf
8. Candidates Exercising Their Legal Rights and Filing Complaints
Should anyone need to submit a complaint, it can be done by sending an e-mail either to the contact person defined in Point 2 or to the university's data protection officer (adatvedelem@pte.hu). If the Candidate wishes to submit their complaint by post, they should send it to Dr. Gergely László Szőke (as mentioned in Point 2) at the following address: 7622 Pécs Vasvári P. u. 4.
Candidates may also consult the Hungarian National Authority for Data Protection and Freedom of Information (mailing address: 1530 Budapest, Pf.: 5., phone: +36 (1) 391-1400, e-mail: ugyfelszolgalat@naih.hu, website: www.naih.hu), if they feel that their rights have been violated with regards to the management of their personal data or if there is an immediate danger that such data may be violated. If the rights of the Candidate are violated, they may turn to a court of their choice and initiate proceedings at the court assigned to their place of residence.