Information in accordance with Act no. 196/03 on the protection of personal data
The processing of personal data is carried out in accordance with Legislative Decree 196/03 “Code concerning the protection of personal data”, of which the articles are reported:
§ 7. Right to access personal information and other rights
The interested party has the right to have the existence or non-existence of personal data concerning him or her confirmed, even if they have not yet been registered, and their communication in an intelligible form.
2. The interested party has the right to receive the indication:
(a) the origin of the personal data;
(b) the purposes and methods of treatment;
c) of the logic used in the case of processing performed by means of electronic instruments;
(d) the identity of the owner, manager and representative designated in accordance with Article 5 (2);
(e) of the subjects or categories of subjects to which the personal data may be disclosed or which may learn about them as a designated State representative, managers or agents.
The interested party has the right to receive:
(a) updating, correcting or, if interested, integrating data;
b) cancellation, conversion into anonymous form or blocking of data processed in violation of the law, including data that is not to be stored for the purposes for which the data were collected or subsequently processed;
(c) attestation that the operations referred to in points (a) and (b) have been made known, also as regards their content, by those to whom the data have been transmitted or disseminated, except where this fulfillment is demonstrated; impossible or involves the use of funds that are manifestly out of proportion to the protected right.
4. The interested party has the right to object in whole or in part to:
a) for legitimate reasons for the processing of personal data about him, even if it is relevant to the purpose of the collection;
(b) for the processing of personal data concerning him for the purpose of sending advertising or direct sales material or for carrying out market research or commercial communications.
§ 8. Exercise of rights
The rights mentioned in § 7 are exercised with a request that is addressed without formalities to the owner or manager, also through a responsible person, to whom appropriate feedback is given immediately.
The rights referred to in Article 7 may not be exercised by a request to the owner or the manager or by a complaint under Article 145 if the processing of personal data is carried out:
a) based on the provisions of Decree-Law of 3 May 1991, n. 143, converted, with amendments, by Act July 1991, n. 197 and subsequent amendments concerning money laundering;
b) based on the provisions of Decree-Law of 31 December 1991, n. 419, converted, with amendments, by Act of 18 February 1992, n. 172 and subsequent amendments concerning support for victims of extortion requests;
(c) by parliamentary committees of inquiry set up under Article 82 of the Constitution;
(d) by a public entity, other than public economic entities, on the basis of an express provision of law, solely for the purposes of monetary and exchange rate policy, the payment system, the control of intermediaries and credit and financial markets, and the protection of their stability;
(e) in accordance with Article 24 (2). 1 (f), limited to the period during which an effective and concrete prejudice may arise for the conduct of defensive investigations or for the exercise of the right in court;
f) by providers of publicly available electronic communications services in relation to incoming telephone communications, unless a real and concrete prejudice may arise for the conduct of defensive investigations under Act No. 397;
g) for reasons of justice in judicial offices at all levels or in the higher council of the judiciary or other self-governing bodies or the Ministry of Justice;
h) in accordance with section 53, without prejudice to the provisions of Act no. 121.
The guarantor shall also act upon notification by the interested party in the cases mentioned in subsection (1). (A), (b), (d), (e) and (f), in the manner referred to in Articles 157, 158 and 159 and, in the cases referred to in points (c), (g) and (f), (h) in the same paragraph, shall continue in the manner referred to in Article 160.
The exercise of the rights referred to in Article 7 may, where it does not concern data of an objective nature, take place, except in the case of the rectification or integration of personal data of an evaluation type relating to judgments, opinions or other assessments. subjective, as well as an indication of behavior to be kept or decisions made by the data controller.
§ 9. Training methods
The request to the owner or manager can also be sent by registered letter, fax or e-mail. The guarantor can identify another suitable system with reference to new technological solutions. In the case of the exercise of the rights mentioned in § 7, para. 1 and 2, the request may also be formulated orally and in this case it shall be noted briefly by the person in charge or manager.
2. In exercising the rights referred to in Article 7, the interested party may grant a power of attorney or power of attorney in writing to individuals, entities, associations or organizations. The stakeholder can also be assisted by a trusted person.
The rights of personal data referred to in Article 7 concerning deceased persons may be exercised by persons having their own interests or acting in order to protect the interested party or for reasons worthy of family protection.
4. The identity of the interested party shall be verified on the basis of appropriate assessment elements, including by means of available deeds or documents or by presenting or enclosing a copy of an identification document. The person acting on behalf of the interested party presents or encloses a copy of the power of attorney or of the power of attorney signed in the presence of a designated or signed and presented together with an unauthorized photocopy of an identification document of the interested party. If the interested party is a legal person, an organization or an association, the request is made by the natural person who is legitimized on the basis of the respective statutes or rules.
5. The request referred to in Article 7 (1) 1 and 2, are formulated freely and without restrictions and may be renewed, unless there are justifiable reasons, after at least 90 days.
§ 10. Feedback to the interested party
1. In order to ensure the effective exercise of the rights referred to in Article 7, the data controller shall be obliged to take appropriate measures aimed at, in particular:
(a) to facilitate the access to personal data of the interested party, including through the use of specific computer programs aimed at an accurate selection of data relating to identified or identifiable individual interested parties;
(b) to simplify procedures and reduce the time required to respond to the applicant, including in the case of offices or services responsible for public relations.
2. The information shall be extracted from the person or persons responsible and may also be communicated to the applicant orally or offered for review by electronic means, provided that in such cases the data is easy to understand, including the quality taken into account. and the amount of data, information. If there is a request, the data is transferred on paper or computer support, or their transfer electronically.
Unless the request refers to a specific processing or to specific personal data or categories of personal data, the response of the interested party includes all personal data concerning the interested party, regardless of how they are processed by the owner. If the request is addressed to a healthcare professional or a healthcare organization, the provision in section 84 (1) is complied with.
4. Where extraction of data is particularly difficult, the response of the request from the interested party may also be made by presenting or handing over copies of deeds and documents containing the personal data requested.
5. The right to have the data disseminated in an intelligible form does not concern personal data relating to third parties, unless the division of the data processed or the removal of certain elements make the personal data relating to the interested party incomprehensible.
The communication of data is carried out in an understandable form also using understandable handwriting. In the case of communication of codes or abbreviations, the parameters for understanding their meaning are stated, also through those responsible.
Where, at the request referred to in Article 7 (1), 1 and 2 (a), (b) and (c), the presence of data concerning the interested party is not confirmed, a fee not exceeding the actual costs of research carried out in the specific case.
8. The in para. The contribution referred to in paragraph 7 may in no case exceed the amount determined by the Guarantor by a general provision which may identify it on a firm basis in relation to the case where the information is processed electronically and the answer is given orally. With the same provision, the guarantor may decide that the contribution may be requested when the personal data appear from a special support for which reproduction is specifically desired, or when one or more owners have determined significant use of funds in relation to the complexity or scope of the requests and the existence of Data concerning the interested party are confirmed.
9. The in para. The contributions referred to in paragraphs 7 and 8 shall also be paid by postal or bank transfer or by payment or credit card, where possible on receipt of the reply and in any case within fifteen days of such reply.
§ 11. Processing methods and data requirements
1. The personal data processed are:
(a) treated lawfully and fairly;
(b) collected and recorded for specific, explicit and legitimate purposes and used in other processing operations under conditions compatible with those purposes;
c) accurate and, if necessary, updated;
(d) relevant, complete and not excessive in relation to the purposes for which they are collected or subsequently processed;
(e) kept in a form enabling the interested party to be identified for a period not exceeding that necessary for the purposes for which they were collected or subsequently processed.
Personal data processed in violation of the relevant rules regarding the processing of personal data may not be used.