Disclosure under Law No. 196/03 on the protection of personal data
The processing of personal data is carried out under the D.Lgs 196/03 “Personal Data Protection Code” of which the articles are reported:
Art. 7. Right to access personal data and other rights 1. You have the right to obtain confirmation of whether or not personal data exists, even if it has not yet been recorded, and their communication in an intelligible form.
2. You have the right to obtain an indication: (a) the source of personal data; (b) of the purpose and manner of treatment; (c) of the logic applied in the case of treatment carried out with the help of electronic instruments; (d) the identification details of the owner, the managers and the designated representative under Article 5, paragraph 2; (e) of the subjects or categories of persons to whom personal data may be disclosed or who may become aware of it as a designated representative in the territory of the State, of managers or appointees.
3. You have the right to obtain: (a) updating, rectifying or, when it is of interest to you, data integration; b) the deletion, anonymous transformation or blocking of data processed in violation of the law, including those that are not required to be retained in relation to the purposes for which the data was collected or subsequently processed; c) the claim that the operations referred to in the letters (a) and (b) those to whom the data has been disclosed or disseminated have been made aware, except in the case where such fulfilment proves impossible or involves the use of means manifestly disproportionate to the protected law.
4. You have the right to object, in whole or in part: (a) for legitimate reasons for the processing of personal data concerning it, although relevant to the purpose of the collection; (b) the processing of personal data relating to him for the purpose of sending advertising or direct sales material or for the completion of market research or commercial communication.
Art. 8. Exercise rights 1. The rights referred to in Article 7 are exercised with a request made without formality to the owner or manager, also through an appointee, to whom appropriate feedback is provided without delay.
2. The rights referred to in Article 7 cannot be exercised by request to the holder or manager or with recourse under Article 145, if the treatment of personal data is carried out: (a) under the provisions of the Decree-Law 3 May 1991, No. 143, converted, with modifications, by law July 1991, No. 197, and subsequent modifications, on recycling; (b) under the provisions of the Decree-Law 31 December 1991. 419, converted, with modifications, by law 18 February 1992. 172, and subsequent amendments, on support for victims of extortionate claims; (c) by parliamentary committees of inquiry established under Article 82 of the Constitution; (d) by a public entity, other than the public economic bodies, on the basis of express legal provision, for the purposes of monetary and currency policy, the payment system, the control of intermediaries and credit and financial markets, as well as the protection of their stability; (c) under Article 24, paragraph 1, letter (f), limited to the period during which there may be actual and concrete harm to the conduct of defensive investigations or to the exercise of law in court; (f) from providers of electronic communications services accessible to the public in relation to incoming telephone communications, unless there may be a real and concrete injury to the conduct of the defensive investigations referred to in law 7 December 2000, n. 397; (g) for reasons of justice, at judicial offices of every order and degree or the Higher Council of the Judiciary or other self-governing bodies or the Ministry of Justice; (h) under Article 53, subject to the law 1 April 1981, n. 121.
3. The Guarantor, also on the recommendation of the person concerned, in cases where in paragraph 2, letters a), b), d), (e) and (f) provides in the manner referred to in Articles 157, 158 and 159 and, in the cases referred to in the letters c), g) and (h) of the same paragraph, provides in the manner referred to in Article 160.
4. The exercise of the rights referred to in Article 7, when it does not relate to objective data, may take place unless it involves the adjustment or integration of personal data of an evaluative type, relating to judgments, opinions or other subjective appreciations, as well as the indication of conduct to be taken or decisions being taken by the controller.
Art. 9. Operating mode 1. The request to the owner or manager can also be sent by a recommended letter, fax or e-mail. The Guarantor can identify other suitable system in reference to new technological solutions. When it concerns the exercise of the rights under Article 7, Commi 1 and 2, the request can also be made orally and in that case is sumtably noted by the person or manager.
2. In the exercise of the rights under Article 7, the person may, in writing, delegate or proxy to individuals, entities, associations or bodies. You may also be assisted by a trusted person.
3. The rights under Article 7 relating to personal data relating to deceased persons may be exercised by those who have a vested interest, or act to protect the person concerned or for family reasons deserving of protection.
4. The identity of the person concerned is verified on the basis of appropriate evidence, including through available documents or documents or the display or identification of a copy of an identification document. The person acting on behalf of the person concerned exhibits or attaches a copy of the prosecutor’s office, that is, the delegation signed in the presence of an appointee or subscribed and submitted together with an unauthenticated photostatic copy of a document of recognition of the person concerned. If the person is a legal entity, entity or association, the request is made by the individual legitimized according to their respective statutes or orders.
5. The request in Article 7, commi 1 and 2, is formulated freely and without constraint and can be renewed, save the existence of justified reasons, with no less than ninety days’ interval.
Art. 10. I answer to the person concerned 1. In order to ensure that the rights under Article 7 are effectively exercised, the controller is required to take appropriate measures, in particular: (a) to facilitate the person’s access to personal data, including through the use of special computer programs aimed at carefully selecting data involving identified or identifiable individual stakeholders; (b) to simplify the arrangements and reduce the time to respond to the applicant, including in public relations offices or services.
2. The data is extracted by the manager or the appointees and can also be communicated to the applicant orally, that is, offered in vision by electronic instruments, provided that in such cases the understanding of the data is easy, given the quality and quantity of the information. If required, the data is transposed on paper or computer media, i.e. transmitting it by telematics.
3. Unless the request relates to a particular treatment or specific personal data or categories of personal data, the feedback to the person concerned includes all personal data concerning the person who is still processed by the holder. If the request is made to a health professional or health professional, the provision referred to in Article 84, paragraph 1 is noted.
4. When the extraction of data is particularly difficult, the response to the request of the person concerned can also be made through the exhibition or delivery in a copy of documents and documents containing the requested personal data.
5. The right to obtain intelligent disclosure of the data does not relate to personal data relating to third parties, unless the breakdown of the data processed or the deprivation of certain elements renders the personal data relating to the person concerned incomprehensible.
6. The communication of the data is also carried out in an intelligible form through the use of an understandable handwriting. In the case of communication of codes or acronyms, parameters are provided, also through the appointees, for understanding their meaning.
7. When, as a result of the request referred to in Article 7, commi1 and 2, letters a), b) and (c) it is not confirmed that there is data concerning the person concerned, a contribution of expenditure may be requested, not exceeding the costs actually incurred for the research carried out in this case.
8. However, the contribution referred to in paragraph 7 cannot exceed the amount determined by the Guarantor by general measure, which can identify it lump sum in relation to the case where the data is processed with electronic instruments and the answer is provided orally. With the same measure, the Guarantor may provide that the contribution may be requested when personal data appears on a special support of which reproduction is specifically required, or when, with one or more owners, considerable use of means is determined in relation to the complexity or extent of the requests and the existence of data concerning the person concerned is confirmed.
9. The contribution referred to in Commission 7 and 8 is also paid by postal or bank payment, i.e. by payment or credit card, where possible at the time of receipt of the feedback and in any case no more than a fortnight from that feedback.
Art. 11. Methods of processing and data requirements 1. The personal data being processed are: (a) treated lawfully and fairly; (b) collected and registered for certain, explicit and legitimate purposes, and used in other intermini treatment operations compatible with these purposes; (c) exact and, if necessary, updated; (d) relevant, complete and not exceeding the purposes for which they are collected or subsequently treated; (e) stored in a form that allows the identification of the person concerned for no longer than the purpose for which they were collected or subsequently treated.
2. Personal data processed in violation of the relevant rules regarding the processing of personal data cannot be used.