Research protocol
This protocol describes what LogoStats researches, how the data are collected, checked and analysed, where the limits of the results lie, and by which rules results about persons are released. It follows the criteria for scientific research named by the German Data Protection Conference (DSK) in its position paper of 2024 (section 7). Details are on the linked pages of the website.
1. Project
Title: "Citation frequencies of biblical texts: an empirical study of the visibility and neglect of biblical passages in church and theological practice"
The project studies the popularity, or citation frequency, of individual Bible passages. To this end it systematically analyses contexts in which Bible verses are quoted or used: sermons and devotions, materials from children's and youth work (e.g. children's church, youth groups), Christian literature (e.g. theological scholarship, parish newsletters, guides to faith), social media content and Christian merchandise (e.g. postcards, calendars, T-shirts). The aim is to determine on an empirical basis which Bible passages are quoted especially often, rarely or not at all. The focus is on so-called "blind spots": Bible verses that are hardly or not at all received in public and church communication.
The subject includes every use of the Bible, also outside church practice, for example in Jewish reading cycles (decision I-5 of 13 October 2026).
2. Research questions
| No. | Question | Where the website serves it | State |
|---|---|---|---|
| F1 | Which Bible verses are quoted most often in the different areas of Christian communication? | /top-100, /books, /chapters, verse pages under /units | built |
| F2 | Are there significant differences in use by medium or target audience? | /trends compares sources, denominations, translations, topics, audience sizes and periods (/compare leads there); /prescribed shows reading cycles apart from free use | descriptive comparisons built; significance tests planned |
| F3 | Which passages of the Bible remain largely unnoticed, and what might this say about theological or pastoral priorities? | /gaps: gaps, sliding windows, chapters and books with the most uncited verses; verse statuses on /methodology | gaps built; the interpretation is qualitative (section 4) |
| F4 | How often do theological concepts (topics) occur in the Bible, and how do the topics of a verse influence its citation frequency? | /concepts "Topics of the Bible" (topics from OpenBible.info, CC BY 4.0); topics as a series in /trends | topic assignment loaded; analysis of the influence planned |
F1 to F3 are the guiding questions of the project description; F4 adds to them. Medium and target audience are recorded through the source, the kind of occasion, the kind of use and the age group of the audience. The statistics pages are accessible from the public launch of the statistics.
3. Method
3.1 Approach
The study is empirical and quantitative: quotations from published sources are collected, the Bible passages coded, the uses categorised by context (e.g. medium, target audience) and their frequency analysed statistically. Qualitative observations on how quotations are applied may be added; they do not enter the public figures.
3.2 Sources, inclusion and exclusion
Inclusion: published sources that use Bible passages and whose use is legally permitted (licence or terms of use checked; blocks and access rules of websites are respected). Every mention is backed by source, document and exact location (e.g. page, date or row of a file).
Exclusion:
- Entries without a Bible reference.
- Intra-biblical quotations (one biblical book quoting another).
- Texts of sermons: only references and details of the source are stored. Copyrighted Bible texts are not published.
- External tallies (e.g. sermon counts per verse from other websites) and the prescriptions of reading cycles are measured in their own units and never added to the total of uses.
State of collection:
| Area | Collected today (examples) | Not yet collected |
|---|---|---|
| Sermons and devotions | historical sermons and devotions (Open Christian Data), Catholic daily meditations, Moravian daily texts (Losungen), watchwords of the year and month | Protestant sermons and talks of living persons (intake stopped, stored data removed, T-Q472); further sermon archives |
| Children's and youth work | no source of its own | children's church, youth groups |
| Christian literature | works of the Church Fathers (Open Christian Data), devotional books | theological scholarship, parish newsletters, guides to faith |
| Social media | no content; as an approximation, verses of the day of Bible apps | social media content |
| Merchandise | no source | postcards, calendars, T-shirts |
| Outside the project description | reading cycles of several churches and the Jewish Torah reading, measured as prescriptions | speeches in the German Bundestag (in preparation) |
Living persons in the collections: In the counts on the server on 30 and 31 October 2026, no collection held a living person or a person whose status is unclear. Every new collection is checked in this way before intake (section 3.4).
The current list of all sources with their size, selection method and known biases is at /sources.
3.3 Selection and coverage
- The project does not draw a random sample from "the" Christian communication; that population cannot be delimited. It collects available published collections, each as a rule in full (all entries of a file or archive).
- For each collection the project records how its entries were selected (e.g. census, editorial selection, convenience selection, automated collection from a website, computed reading cycle), which population it describes and which biases are known. These details accompany every result that includes the collection.
- A zero is a "true zero" only where a source declares that it covers a verse completely. Otherwise a verse without mentions has the status "coverage undeclared" (the usual case) or "unsurveyed".
- The results therefore describe the collected material, not all Christian communication. Sources are comparable only in view of their selection method.
- Samples are drawn in the quality check (section 3.4).
3.4 Collection rules and approval before counting
- Formats: files are loaded in fixed import formats (Citation CSV v3.1, formats for reading cycles and for tallies). Before loading, every file is compared with its recorded checksum (SHA-256) and row count; a file that differs is not loaded.
- Classification of the source class: for every source with details of living persons the source class is classified: did the person consciously make the information public themselves (own website, own channel, own public speech; Art. 9(2)(e) GDPR)? "Manifestly made public" means: the person consciously shared this information publicly themselves. Or did an archive, a church account or a third party publish it, or is it in an official register? In the second case the route is Art. 9(2)(j) GDPR in conjunction with § 27 BDSG: the processing must be necessary for the research, the research interest must prevail, and the safeguards of section 3.12 apply. The owner of the project has decided the legal basis per group of persons (section 5.1). Every collection is assessed before intake: number of living persons and of persons whose status is unclear, date, person who assessed it and legal basis; a collection that has not been assessed takes in nothing (T-Q547).
- Raw values: the value from the source is always kept. Corrections are logged with a reason. Unclear values stay unresolved instead of being guessed: "Luther" stays the Luther family and does not become a particular edition.
- Sampled review: every import batch is checked before it is counted. 500 rows are drawn; smaller batches are checked in full. The database draws the seed itself and stores it, so the sample can be recomputed; there is exactly one sample per batch. The reading cycle of 1570 to 1969 is stratified by period. Every row is compared with the original; a single error rejects the batch.
- Four-eyes principle: whoever uploaded a batch may not review it. Sources collected from websites additionally need the sign-off of an authorised person. Reviewing and signing off are possible only with two-factor sign-in.
- Individual contributions through the website go through moderation.
- Only approved data are counted: every public figure uses the official inclusion profile, that is reviewed and approved entries with an evidence rank of at least 3. Submitted, waiting and machine-detected entries never count. Records of living persons without consent or release count in no public figure (section 3.12).
3.5 Coding of the Bible passages
- References are split into book, chapter and verse and assigned to neutral verse units. Bible editions number verses differently (versification); the mappings between the numbering systems are kept in versioned mapping releases, and every result names the release used.
- Uncertain mappings are marked and shown as a share; the counting rule CR-CERTAIN-MAPPING counts only certain ones.
- References that cannot be resolved (e.g. an unknown book or a verse that does not exist) are not counted but are shown with each result.
- Under the baseline rule CR-BASE a chapter reference counts for each of its verses; the Top 100 count only explicit verse references (CR-EXPLICIT-VERSE). The share of chapter references is shown.
- Verses, not chapters, also for donations: donated readings (section 3.12) keep the passage as a verse and are not coarsened to chapters. The counting unit of the whole website is the verse: references are assigned to neutral verse units, and the Top 100 count only explicit verse references. Donations with chapters only would not be comparable with the other data (T-Q565, T-Q570). A donated entry counts one passage, not one session (T-Q565).
- Context is categorised by source, kind of occasion, kind of use, denomination of the source, language, place, date, age group of the audience and role of the passage. Unknown values stay "unknown" and are counted as not evaluable in filters, never as false.
3.6 Duplicates
- Within one mention each verse counts at most once, also when references overlap.
- How repetitions count is set by the counting rule (e.g. CR-ONCE-PER-PASSAGE, CR-ONCE-PER-OCCURRENCE).
- Suspected duplicates (e.g. the same use in two collections) are marked and confirmed by reviewers; confirmed duplicates count once.
- Persons, places and other objects created twice are merged reversibly; old identifiers stay valid.
- A verse that an edition prints in two places receives no figures at the second place.
- Measurement families (free use, prescription of a reading cycle, external tally) are never added. A reading that follows a prescription counts only as use, the prescription only as prescription.
3.7 Assignment of persons
- The name from the source is kept as a raw value. It is assigned to a person only individually and with evidence, never in bulk; "unknown" never becomes a person.
- Four identities are never mixed: the quoting person (e.g. a preacher), the contributing person, the evidence source and the user account. Contributors are kept under a pseudonym in the research data.
- If it is unknown whether a person is alive, the person is treated as living.
- Names and attributes of living persons are not public by default. Results about living persons are published only after a release under section 5.1; gate B.5 remains. A collection that names living persons is taken in only after its assessment (section 3.4); the names are not public, and its records count in no public figure (section 3.12).
- Details of deceased persons are public (the GDPR does not apply to them); the limit of interpretation applies here too.
- Religious affiliation is a special category of personal data (Art. 9 GDPR). The project never assigns it to a person from their citations, never derives it from them and labels no one by it. For living persons it is recorded only when the person stated it explicitly in a source themselves or entered it themselves with explicit consent; it is not public by default. The religion field of the master data of the German Bundestag is neither read nor stored.
- Analyses by denomination use the denomination of the source or organisation (e.g. a church and its reading cycle), never an inferred personal faith.
- Personal attributes (e.g. gender, nationality) are not a public dimension of analysis. If such an analysis is introduced, then only for signed-in accounts with their own permission, only with a documented legal basis and without cells of fewer than 5 persons (decision Q-R11).
3.8 Quality assurance
- Sampled review and four-eyes principle (section 3.4).
- Evidence rank of each entry from the kind of evidence and the level of checking: an unchecked entry from a dataset has rank 3, a sermon transcript checked against its source rank 9.
- Every field has a status (documented, conflicting, proposed and unchecked, investigated and unknown); conflicting details are kept as disputed, not decided without evidence.
- Every change is logged with old and new value, reason and origin.
- Integrity rules in the database and automated tests (database tests on PostgreSQL 17 and 18, application tests) run with every change. An automatic check prevents copyrighted Bible texts from entering the project files.
- Every import reports, per file, the references it could not resolve and its warnings; open values are decided one by one.
3.9 Error margins
How errors are measured today:
- Sampled review: errors are recorded per batch by kind (reference; date or occasion; person, source or translation; lost or duplicated; other). A batch is approved only if every sampled row is correct. If 500 rows are free of errors, the error rate of the batch is below 0.6 % with about 95 % confidence (rule of three: 3 divided by 500); smaller batches are checked in full.
- Unresolved references: counted per import and per result.
- Uncertain verse mappings, lower bounds (e.g. an unknown number of repetitions) and chapter references: shown as a share of the total in every result (box "How this was computed").
- Entries not evaluable in filters (unknown values) and mentions outside the selected canon: shown separately.
- Coverage: the verse status distinguishes a true zero, undeclared coverage and unsurveyed verses.
Results of the sampled review (all batches since 1 November 2026, as of 4 November 2026): 11 batches were committed since 1 November 2026. For 8 of them a review plan with 500 sampled rows each was drawn. 4 plans were checked in full (2000 rows): 3 batches passed without an error (1500 rows), 1 batch was rejected with 13 errors in 500 rows and retracted (6 in date or occasion, 6 in person, source or translation, 1 in the reference). The other 4 plans were not finished because their batches had been rolled back and replaced before. On 4 November 2026, of the 11 batches 4 were committed (1 of them without a review plan yet), 1 was retracted and 6 were rolled back. Batches with an error in the sample were corrected, loaded again and checked again (section 3.10); for example, batch 42 held a wrong language value (T-Q618) and was replaced by batch 43, which passed the review.
3.10 Handling of errors
- A rejected batch stays unpublished; the source or the conversion is corrected, loaded again and checked again.
- An approved batch can be retracted: its entries are withdrawn and archived, not deleted. Individual errors are corrected through moderation and logged with a reason. The statistics take changes over at the next computation.
- Frozen data releases are not silently recomputed; deletions after an objection are shown as an adjustment. This does not concern donations: no release holds a donated reading (T-Q569, section 3.12).
- The owner of the project receives reports of errors through the contact details in the legal notice.
3.11 Versions and reproducibility
- Epochs: the figures are recomputed every 15 minutes; they are provisional until a data release is frozen.
- Data releases: a frozen state with the exact list of the entry versions it contains, the database version, the program version, the mapping release and a checksum; unchangeable afterwards (/releases).
- Citable results: stored results with query definition, release and all versions (/snapshots).
- Donations: data releases and published snapshots hold no donated reading, neither from tier F nor from tier Ö (T-Q567, T-Q569). A snapshot of a public query is computed without donations, so its figure may differ from the live figure. There is therefore no citable result about donations. A publication with fixed figures from tier Ö would first need a new decision and a new data protection assessment (section 5.2).
- Definitions: counting rules, metrics and inclusion profiles carry a version number; a changed definition is a new version, and the old one stays for cited results (/methodology).
- Source files: checksum, row count, retrieval date and licence are recorded for each version of a collection.
- Every chart ends with the box "How this was computed". This protocol is versioned (section 8).
3.12 Personal data
- Data minimisation: the project records details from published sources, no more than the research questions need. Sermon texts are not stored, only references and details of the source.
- Legal bases (decided by the owner of the project, T-Q523; laid down in the legal-basis matrix, whose version 1.0 the owner of the project signed on 1 November 2026, T-Q554; the data protection officer checked version 1.1 together with the other versions 1.1 and gave GO on 3 November 2026): Art. 6(1)(f) GDPR; for special categories Art. 9(2)(e) GDPR or Art. 9(2)(j) GDPR in conjunction with § 27 BDSG, depending on the group of persons and the source (sections 3.4 and 5.1).
- Pseudonymisation and separation (§ 27(3) BDSG): contributors are kept under a pseudonym. For persons who are not deemed deceased (living or with unclear status), the identifying features are separated from the research data: name and forms of the name, description, notes, dates of death, external identifiers, the date of birth except the year, and the literal name in occurrences and import rows. They are kept in an area of their own, encrypted with a key of their own per person, whose destruction makes them unreadable; the research data hold a random pseudonym. Separation runs at the end of every import, daily and before the gates for personal data open (T-Q610, T-Q612); the first run on the server on 3 November 2026 separated one person. The features are joined again only for requests of data subjects and for releases under section 5.1, and every join is logged.
- Published results are aggregates. Records of living persons and of persons whose status is unclear count in no public figure unless the person has consented or is named in a release under section 5.1: not in totals, filtered figures, comparisons, trends, lists or exports (T-Q553). So the difference of two published figures cannot reveal such a person either. Living persons and persons whose status is unclear who have neither consented nor been released appear in no public output, neither by name nor by pseudonym (T-Q612). Results about living persons appear only after a release under section 5.1.
- Research data donation (reading diary; consent, Art. 9(2)(a) GDPR): a donated reading holds only the passage and the calendar week (T-Q558). The reading diary requires a second sign-in factor and the confirmation of being at least 18; every consent for it, including donating and sharing, is given with a code of the second factor (T-Q607). It stores no time of day and no notes. Donating and sharing each have a gate of their own; donations reach the research area once a week, only for weeks that have ended. There are two tiers:
- Tier F (research only, the default): the donations stay pseudonymised in the research area. Only named members of the core team query them; every query is logged (T-Q559). Purpose of tier F: checking the method and the counting rules, and preparing research questions (T-Q570). Without this purpose the collection would not be necessary (Art. 5(1)(b) and (c) GDPR). Tier F appears in no publication, not even as a total (T-Q567).
- Tier Ö (sharing): only with a consent of its own and from the age of 18 (T-Q556, T-Q571). Shared donations appear as public individual entries under "Donated data", only on the continuously updated public pages, never in a data release or a published snapshot (T-Q569).
- There is therefore no citable result about donations (section 3.11). Whoever stops sharing has their entries moved back to tier F at once. A withdrawal of the donation deletes it in both tiers under the rule in "Rights", without exception.
- Rights: anyone who appears in the data can object, or ask for access, correction or deletion, through the contact details of the privacy statement. If a living person objects or withdraws a consent, the project deletes their details without delay, at the latest within one month; they are gone from the backups about 35 days later. The privacy statement gives the details of legal bases and storage periods.
- Data protection impact assessment for the research database: version 1.0 of 31 October 2026, signed by the owner of the project on 1 November 2026; advice of the data protection officer under Art. 35(2) GDPR on version 1.0 on 2 November 2026. On version 1.1 (research data donation) the data protection officer advised signing on 3 November 2026 and gave GO for the versions 1.1; the owner of the project signed version 1.1 on 2 November 2026. Version 1.2 (reading diary, donation, separation under § 27(3) BDSG) is in draft and goes to the data protection officer next.
4. Limit of interpretation
- In particular, a Bible citation must not be interpreted as evidence of a person's religious affiliation or individual religiosity. People quote the Bible for many reasons: as a professional duty, following a reading cycle, as literature, critically, as a figure of speech or for education.
- The project computes no religiosity or piety scores for persons and derives neither religion nor denomination from citations.
- Denominations in the data describe sources and occasions (e.g. the reading cycle of a church), not the convictions of individual people.
- Frequencies describe the collected material (section 3.3). A rarely quoted verse is not rejected, a frequently quoted one not more important. "Blind spots" are relative to this material and to the chosen counting rule.
- Statements about theological or pastoral priorities (F3) interpret the use of texts; they are not statements about individual persons or congregations.
- Even inferring a person's religion from their use of the Bible would be processing of special categories under Art. 9 GDPR, because data that reveal religion only indirectly fall under it too (CJEU, judgment C-446/21). The project therefore does not draw this inference. Quoting a verse, for example in a parliamentary debate, is no evidence of personal religiosity.
5. Governance
5.1 Release of results about persons
- Research results relating to living persons or to persons whose status is unclear are not published merely because the underlying source is public or the person holds public office. A publication by name is made only on the basis of valid consent or after a documented individual decision that identifying the person is indispensable for presenting a specific research result about a specific event of contemporary history. The decision documents the legal bases under Art. 6 GDPR and – where special categories of personal data are concerned – Art. 9 GDPR, the less intrusive alternatives that were examined and the opinion of the data protection officer. A release always covers exactly one named publication (a specific research result about a specific event); for every person named in it, the reason why naming them is indispensable is given separately. There is no release for a whole source class, and being a member of a parliament opens nothing on its own (T-Q549). Every release is recorded with an identifier of its own; at present there is none.
- Gate B.5 remains (decisions A-B5.1 to A-B5.7): public registration, the reading tracker, data donations and real personal data of living persons go live only when an external data protection officer has been appointed in writing and registered with the supervisory authority (met on 30 October 2026), the data protection impact assessment, the record of processing activities, the privacy statement and the consent texts are written and approved, and the data processing agreements are signed.
- Classification of the source classes (section 3.4), as of 3 November 2026:
| Source class | Who published? | Legal route | Decision |
|---|---|---|---|
| historical sources (deceased persons only) | publishers, archives | GDPR not applicable | decided: GDPR not applicable; only persons proven deceased are visible (T-Q469, T-Q481) |
| sermon archives of churches and organisations | archive or church account | Art. 6(1)(f) and Art. 9(2)(j) GDPR with § 27 BDSG; (e) only with the person's own evidence (E1) (T-Q520, T-Q523) | paused; the stored data of the paused sources are removed (T-Q472) |
| platforms for talks and devotions | platform or the person themselves | Art. 6(1)(f) and Art. 9(2)(j) GDPR with § 27 BDSG; (e) only with E1 (T-Q523) | decided (T-Q523); collections counted on 30 and 31 October 2026, no living person and no person whose status is unclear; new collections only after assessment (T-Q547) |
| speeches in the German Bundestag | own public speech, published in the official record | Art. 6(1)(f), as a precaution Art. 9(2)(j) GDPR; public as totals, per member only in an individually released publication under § 27(4) BDSG (T-Q523, T-Q525, T-Q549); Art. 14 assessment before import (T-Q546) | decided; not imported |
| contributions and data donations through the website | the person themselves | consent, Art. 9(2)(a) GDPR (only after gate B.5); for the donation one consent each for tier F and for sharing (tier Ö) | decided: explicit consents (T-Q441, T-Q442); tier F for research only and in no publication (T-Q567, T-Q570); tier Ö with a consent of its own from the age of 18, only on the live pages, never in releases and published snapshots (T-Q556, T-Q569, T-Q571) (section 3.12); closed until gate B.5, the donation also until the final approval of the data protection officer (T-Q570); donating and sharing each with a gate of their own, built and closed (annex R11) |
- Also after a release, results are described as use of text, never as religiosity (section 4).
- Statistics about verses and sources without reference to persons are not affected by this rule.
5.2 Changes to the research concept
- Every change to the research questions, source classes, inclusion and exclusion criteria, the principles of counting or the release rules produces a new version of this protocol with an entry in the change log (section 8).
- If a change affects personal data (e.g. a new source class with living persons, new personal attributes or a new publication), the data protection officer is consulted beforehand.
- Technical definitions (counting rules, metrics, inclusion profiles, mapping releases) are versioned on /methodology. Decisions of the owner of the project are recorded with date and wording in the decision register, which is only added to, never overwritten.
6. Independence and public benefit
Independence:
- The project is at present a fully private, non-commercial project of the owner of the project and is funded by the owner alone. There is no funder, no client and no affiliation with a church, an employer or a university.
- With the official launch the owner of the project intends to look for outside support. Every future funder, sponsor and institutional affiliation will be named publicly in a new version of this protocol (change log). Funders gain no influence on research questions, methods, the selection of data or the publication of results.
- The project is to become part of the academic career of the owner of the project: it is intended as the main basis of the owner's bachelor's thesis and later master's thesis. This use of the data and results is intended. This protocol, the versioned data releases and the public data make the results verifiable for that purpose.
Public benefit:
- The project aims to create awareness of the selective reception of biblical texts and to open perspectives for a broader, more balanced use of the Bible in church, educational and theological contexts.
- The results may prompt reflection on canonised meaning, under-represented texts and theological practice in congregations and in training. Didactic materials on neglected Bible passages are conceivable.
- The data and the analysis tools needed are made easily, publicly and freely accessible to everyone on the website, without sign-in. Licences and data protection set the limits: entries from sources without permission to pass them on and personal details of living persons (section 5) stay non-public.
7. Criteria of the DSK
| Criterion | How the project meets it | Section, page |
|---|---|---|
| methodical and systematic | fixed collection rules and import formats, inclusion and exclusion criteria, documented selection methods, versioned counting rules | 3.2 to 3.6; /methodology, /sources |
| aimed at gaining knowledge | four research questions on frequency, differences, gaps and topics; results as new knowledge about the reception of the Bible | 1, 2 |
| verifiable | evidence per entry, recomputable samples, disclosure of the computation with each result, frozen data releases, citable results, public data | 3.4, 3.9, 3.11; /releases, /snapshots |
| independent and autonomous | private and self-funded, without a client; future funders are disclosed and gain no influence | 6 |
| public benefit | open data and analysis tools for everyone; awareness of selective reception; didactic materials | 6 |
8. Change log
| Version | Date | Change |
|---|---|---|
| 1 | 28 October 2026 | First version (draft, to be reviewed by the data protection officer) |
| 2 | 30 October 2026 | Version 2: release of results about persons per publication instead of per source class, in the wording of the data protection officer on § 27(4) BDSG (T-Q549); every collection assessed before intake (T-Q547); decisions taken entered (draft, to be reviewed by the data protection officer) |
| 3 | 1 November 2026 | Version 3 after the first reading by the data protection officer (1 November 2026): state of collection corrected, the Protestant sermons and talks of living persons are removed since T-Q472, and in the counts of 30 and 31 October 2026 no collection held a living person or a person whose status is unclear (section 3.2); records of living persons without release count in no public figure (T-Q553, sections 3.4, 3.7 and 3.12); state of the data protection impact assessment (draft, to be reviewed by the data protection officer) |
| 4 | 2 November 2026 | Version 4, round 1.1 after the statement of the data protection officer on annex R11 of the data protection impact assessment (2 November 2026): research data donation in two tiers with the purpose of tier F, checking the method and the counting rules and preparing research questions (T-Q570); tier F in no publication (T-Q567); shared donations (tier Ö) only on the live pages, never in releases and published snapshots (T-Q569), so no citable result about donations (sections 3.10, 3.11 and 3.12); verses, not chapters, also for donations (T-Q565, section 3.5); section 3.12 stays without exception; classification of data donations (section 5.1) (draft, to be reviewed by the data protection officer) |
| 5 | 3 November 2026 | Version 5 after the GO of the data protection officer for the versions 1.1 (3 November 2026): state of the review of the legal bases and of the data protection impact assessment instead of "review pending" (section 3.12); results of the sampled review instead of the announcement (section 3.9); separation of identifying features under § 27(3) BDSG (T-Q610, T-Q612) and no public naming without consent or release, not even by pseudonym (section 3.12); reading diary with a second factor and a gate of its own each for donating and sharing (T-Q607, sections 3.12 and 5.1) (draft, to be reviewed by the data protection officer) |