Privacy – rights of interested parties

Article 7
(Right of access to personal data and other rights)

1. A subject has the right to the confirmation of the existence of personal data relating to him, even if it is not yet registered, as well as the communication of it in an intelligible form.
2. The subject has the right to information about:
a) the origin of the personal data;
b) the reasons for and methods of processing;
c) the logic applied when automatic equipment is used for processing it;
d) details of the identification of the Controller, the people responsible and the representative designated in accordance with article 5, paragraph 2;
e) people or categories of people to whom personal details can be communicated or who may see the data in their roles as representatives designated by the State, or other delegated people.
3. The subject has the right to obtain:
a) the updated, amended or, when interested, integrated data;
b) the annulment, transformation into an anonymous form or a freeze on data processed in violation of the law, including that for which conservation of the data is not necessary for the reason the data was collected or later processing;
c) the affirmation that the transactions in a) and b) and information relating to the content, have been made known to anyone who the data has been passed to, excluding when such fulfilment is impossible or involves a large effort disproportionate to the rights being safeguarded.
4. The interested party has the right to totally or partly oppose:
a) for reasons legitimate to the processing of personal data which regards him, even if it is pertinent to the reasons for data collection.
b)the processing of personal data which regards him, with the scope of advertising or direct selling or to carry out market research or corporate communication.
Article 8
(Exercising ones rights)
1. The rights in article 7 should be exercised via an informal request to the Controller or data processor, also through an intermediary, to whom a suitable reply will be organised without delay.
2. The rights in article 7 can’t be exercised via a request to the Controller or processor or resorting to article 145, if the processing of personal data takes place:
a) according to the provisions of legal decree 3 May 1991, no. 143, converted with amendments to law 5 July 1991, no.197, and further amendments regarding matters on recycling;
b) according to the provisions of legal decree 31 December 1991, no. 419, converted with amendments to law 18 February 1992, no. 172, and subsequent amendments regarding matters of support for the victims of extortion;
c) by the investigations of parliamentary commissions according to article 82 of the constitution;
d) by a public body, other than economic public bodies, based on specific provisions of the law, only for purposes inherent to monetary and currency policy, the payment system, the control of financial credit markets and intermediaries, and the safeguarding of their stability;
e) under article 24, paragraph 1, letter f), within the limits of the period in which an effective and solid judgement can be derived, for the progress of the defence’s investigations or to exercise the right in a judicial environment;
f) by suppliers of electronic communication services, which are accessible to the public with regard to telephonic communication received, except when an effective and solid judgement on the defence’s investigations can be derived under law 7 December 2000, no. 397;
g) for reasons of justice at all levels and types of judicial offices or the Supreme Magistrates Council or other self-government organisations or the Ministry of Justice;
h) according to article 53, apart from when covered by law 1 April 1981, no.121.
3. The Guarantor, in the cases in paragraph 2, letters a), b), d), e) & f), will provide by the means set out in articles 157, 158 and 159 and, in the cases in letters c), g) and h) of the same paragraph, will provide by the means set out in article 160, also following indication by the subject.
4. The exercising of the rights in article 7, when not regarding objective data, can take place except when concerning the correction or integration of personal data relating to judgements, opinions or other appraisals of a subjective nature, as well as information about conduct or of the Controller’s decisions when hiring employees.
Article 9
(Means of exercising)
1. The request to the Controller or processor can also be made via recorded post, fax or email. The Guarantor can identify other suitable systems depending on new technological solutions. When regarding the exercising of the rights in article 7, paragraphs 1 and 2, the request can also be made orally, and in that case it is briefly noted by the processor or the person in charge.
2. When exercising the rights in article 7, the subject can do so in writing, by proxy or by conferment of power of attorney to a person, body, association or organisation. The subject can also get help from a trusted person.
3. The rights in article 7 which refer to personal data concerning the deceased can be exercised by whoever has a personal interest or acts on behalf of the subject or for family rights deserving protection.
4. The identity of the subject is checked on the basis of suitable elements of assessment, such as via deeds or other available documents or by producing or citing a copy of an identity document. Anyone who acts on behalf of the subject, must produce or cite a copy of the power of attorney, that is the proxy signed in the presence of the delegate or signed and presented together with an unauthenticated Photostat of the subject’s identification document. If the subject is a juridical person, a body or association, the request is put forward by the person legitimised on the basis of the relative statutes and orders.
5. The request in article 7, paragraphs 1 and 2, is formulated freely and without restrictions and can be renewed with an interval of no less than ninety days, except when there are justified reasons.
Article 10
(Reply to the subject)
In order to guarantee the effective exercising of the rights in article 7, the Data Controller is obliged to adopt suitable measures aimed specifically at;
a) facilitating the subject’s access to personal data, including through the use of dedicated programmes for processors aimed at the careful selection of data regarding individual identified or identifiable subjects;
b) simplifying the means and reducing the time of reply to the applicant, also in the field of public relations offices or services.
2. The data is extracted by the person responsible or the processors and can also be communicated orally to the person who requested it, or offered for viewing via electronic means, if in that way the data is easily comprehensible, taking the quantity and quality of the material into consideration. If requested, the data can be transposed onto paper or an electronic support, or transmitted telephonically.
3. Except when the request refers to special processing or to specific personal data or categories of personal data, the reply to the subject includes all personal data which regards the subject, however processed by the Controller. If the request is made to a retailer, health profession or health organisation, the disposition in article 84, paragraph 1 is observed.
4. When the extraction of the data is particularly difficult, the reply to the subject can take place through the display or the handover of copies of deeds and documents containing the personal data requested.
5. The right to obtain communication of the data in an intelligible form does not regard the personal data of third parties, except when the resolution of the processed data or the loss of some elements makes the subject’s personal data incomprehensible.
6. The communication of the data takes place in an intelligible form including through the use of comprehensible handwriting. In the case of the communication of codes or abbreviations, including through an elected person, the information necessary to understand their meaning is supplied.
7. When, following the requests in article 7, paragraphs 1 and 2, letters a), b) and c), no data regarding the subject is found, a small contribution, no greater than the real cost incurred for the research carried out in that specific case, can be requested.
8) The contributions in paragraph 7 mustn’t however exceed the sum established by the Guarantor, with general provisions, who can identify a one-off payment in relation to a case in which the data is processed electronically and the reply is provided orally. With the same provisions the Guarantor can expect that the contribution is requested when the personal data appears on a special support which specifically requires copying, or when, among one or more Controllers, a notable use of equipment is required, due to the complexity or the size of the request, and the existence of data regarding the subject is confirmed.
9. The contribution in paragraphs 7 and 8 is paid via postal or bank transfer, or by debit or credit card, at the moment when the reply is received whenever possible and in any case no more than 15 days after the reply.

… omissis …