Informative to the senses of the law n. 196/03 on the protection of personal data
The processing of personal data is carried out pursuant to Legislative Decree 196/03 "Code regarding the protection of personal data" of which are set Articles: Section 7. Right of access to personal data and other rights 1. You have the right to obtain confirmation of the existence or not of personal data concerning him, even if not yet recorded, and their communication in intelligible form.
2. You have the right to obtain the indication: a) the origin of personal data; b) the purposes and methods of treatment; c) the logic applied in case of treatment with the aid of electronic instruments; d) the identity of the owner, manager and the representative appointed under article 5, paragraph 2; e) the subjects or categories of subjects to whom the personal data may be communicated or who can learn about them as appointed representative in the State, managers or agents.
3. You have the right to obtain: a) updating, rectification or, when interested, integration of data; b) cancellation, transformation into anonymous form or blocking of data processed unlawfully, including data which need not be kept for the purposes for which the data were collected or subsequently processed; c) certification that the operations in letters a) and b) have been notified, as also related to their contents, to those to whom the data were communicated or disseminated, unless this requirement proves impossible or involves the use of means manifestly disproportionate to the protected right.
4. The interested party has the right to object, in whole or in part: a) for legitimate reasons the processing of personal data concerning him, even though pertinent to the collection purpose; b) the processing of personal data concerning him for the purpose of sending advertising materials or direct selling or for carrying out market research or commercial communication.
Article 8. Exercise of rights 1. The rights referred to in Article 7 may be exercised by making a request to the owner or manager, including by means of an agent, which shall be acknowledged without delay.
2. The rights referred to in Article 7 may not be exercised with a request to the owner or manager or an action under Article 145, if the processing of personal data are processed: a) in accordance with the provisions of the Decree-Law of 3 May 1991, n. 143, converted with amendments by Law July 1991, n. 197, as amended, concerning money laundering; b) in accordance with the provisions of the decree-law of 31 December 1991, n. 419, converted, with amendments, by Law of 18 February 1992, n. 172, as amended, concerning support for victims of extortion; c) by parliamentary Inquiry Committees set up under Article 82 of the Constitution; d) by a public entity other than the government-owned businesses, according to an express provision of law, exclusively for purposes related to monetary policy, payment systems, control of brokers and credit and financial markets, as well as the protection of their stability; e) pursuant to Article 24, paragraph 1, letter f), limited to the period during which could result in a real and concrete prejudice to the conduct of investigations by defense counsel or the exercise of the right in court; f) by providers of electronic communications services accessible to the public about incoming telephone communications, unless this may be an effective and concrete prejudice to the conduct of investigations by defense counsel as per Law of 7 December 2000, n. 397; g) for reasons of justice by judicial authorities at all levels or the Supreme Judicial Council or other organs of self-government or the Ministry of Justice; h) pursuant to Article 53, except as required by law April 1, 1981, no. 121.
3. The Guarantor, including a report, in the cases referred to in paragraph 2, letters a), b), d), e) and f) shall in the manner referred to in Articles 157, 158 and 159 and, in the cases referred in letters c), g) and h) of that subsection, shall in the manner referred to in Article 160.
4. The exercise of the rights referred to in Article 7 does not apply when objective data, it can take place unless it concern rectification of or additions to personal evaluation data relating to judgments, opinions or other assessments are subjective, as well as the specification of policies to be implemented or decisions currently being made by the holder of the treatment.
Article 9. How to exercise 1. The request to the owner or manager may also be sent by letter, fax or email. The Guarantor may specify other suitable arrangements with regard to new technological solutions. When the exercise of the rights referred to in Article 7, paragraphs 1 and 2, the request may be made orally and in this case it is briefly noted by the person in charge.
2. In exercising the rights provided for in Article 7, the subject may grant, in writing, by delegation or proxy to physical persons, entities, associations or organizations. The data subject may also be assisted by a person of trust.
3. The rights referred to in Article 7 relating to personal data concerning deceased persons may be exercised by those who have an interest, or acts to protect or for reasons of family protection.
4. The identity shall be verified on the basis of suitable elements of assessment and through the available records or documents or by producing or attaching a copy of an identity document. The person who acts on behalf of exhibits or attach a copy of the proxy, or signed in the presence of an agent or signed and submitted with a non-authenticated photocopy of an identity document of the person concerned. If the person concerned is a legal person, entity or association, the request is filed by a person entitled in accordance with the respective statutes or regulations.
5. The request referred to in Article 7, paragraphs 1 and 2, is made freely and without compulsion, and may be renewed, unless there are justified reasons, after not less than ninety days.
Article 10. Response to 1. To ensure the effective exercise of the rights referred to in Article 7, the data controller is obliged to take appropriate measures, in particular: a) to facilitate access to personal data is transmitted, through the use of special computer programs allowing accurate retrieval of data concerning individual identified or identifiable; b) simplify the procedures and reduce the time for feedback to the applicant, even within departments or offices relations with the public.
2. The data is extracted by the person or persons in charge and can be communicated to the applicant even verbally, or in displayed by electronic means, provided that in such cases the understanding of the data is easy, given the quality and quantity of information. If there is demand, it provides for the transposition of the data on paper or electronic media, or transmitted electronically.
3. Unless the request refers to a particular treatment or specific personal data or categories of personal data, the response shall include all the personal data concerning him or her are processed by the owner. If the request is directed to an operator or a health profession to a health organization you look at the provision of Article 84, paragraph 1.
4. When data extraction is particularly difficult, the response to the request may also consist in producing or delivering copy of records and documents containing the personal data requested.
5. The right to obtain communication in an intelligible form of the data does not apply to personal data relating to third parties, unless breaking down the processed data or eliminating certain elements renders incomprehensible the personal data of the person concerned.
6. The data communication is carried out in an intelligible form through the use of legible handwriting. In case of communication codes or abbreviations are available also by the charge, the parameters for the understanding of its meaning.
7. When, as a result of the request referred to in Article 7 commi1 and 2, letters a), b) and c) is not confirmed the existence of data concerning him or her, may be charged a fee not exceeding the costs actually incurred for research conducted in this case.
8. The fee referred to in paragraph 7 may not exceed the amount determined by the Guarantor with provision of a general nature, which may also refer lump sum in the case where the data are processed by electronic means and the answer is provided verbally. By the same measure, the Authority may provide that the fee may be charged if the personal data contained on special media whose reproduction is specifically requested, or when, at one or more owners, it results in a significant use of resources in relation to complexity or amount of the requests and confirmed the existence of data concerning him or her.
9. The fee referred to in paragraphs 7 and 8 may also be paid by postal or bank, or by debit or credit card, if possible upon receipt of the response and not later than fifteen days after the feedback.
Article 11. Methods of data processing and data requirements 1. Personal data undergoing processing shall be: a) processed lawfully and fairly; b) collected and recorded for specific, explicit and legitimate purposes and used in other processing operations are compatible with those purposes; c) accurate and, where necessary, updated; d) adequate, relevant and not excessive in relation to the purposes for which they were collected or subsequently processed; e) kept in a form which permits identification of data for a period of time no longer than necessary for the purposes for which they were collected or subsequently processed.
2. The personal data processed in violation of the regulations governing the processing of personal data can not be used.