Information on the processing of personal data pursuant to Article 13 of the General Data Protection Regulation (EU Regulation 2016/679)
The EU Regulation 2016/679 “General Data Protection Regulation” (hereinafter also “GDPR”) has the purpose of guaranteeing that the processing of your data takes place in compliance with the rights, fundamental freedoms and dignity of persons, with particular reference to confidentiality and personal identity.
Subjects and categories of recipients for the communication and dissemination of personal data
Your data may be communicated to parties external to the Organization possibly indicated as Data Controllers in relation to the need for the specific processing.
The data may also be communicated to:
- other public entities who request them and are expressly authorized to process them (more specifically, are authorized by law or regulation or in any case need them for institutional purposes) and/or
- further subjects, including private ones, who are entitled to know them in accordance with specific laws or regulations (for example, pursuant to law no. 241/1990 on the right of access to administrative documents or pursuant to legislative decree no. 33/2013 on the right of civic access or other sector regulations that regulate the right of access to data and information held by public administrations) but are not identifiable at the current state of the processing.
The Manager of the relevant Office may become aware of your data as well as the other persons in charge of processing who, again for institutional purposes, must subsequently know them for tasks inherent to their office.
The dissemination of your personal data (understood as knowledge by undetermined subjects) will take place only when provided for by a law or regulation (for example, pursuant to Legislative Decree no. 33 of 2013 “Reorganization of the regulations concerning the right of civic access and the obligations of publicity, transparency and dissemination of information by public administrations”).
The dissemination of any sensitive data capable of revealing your state of health as well as judicial data provided by you is not permitted.
Method and period of data retention
The processing of your personal data may be carried out either with electronic tools or without their aid, on paper or electronic media (depending on the case) and this may take place for the time strictly necessary to achieve the purposes for which the personal information is have been collected in relation to the conservation obligation established by law for documents held by the Public Administration, with methods designed to guarantee the security and confidentiality of the data themselves and any other rights to which you are entitled.
To this end, specific technical and organizational security measures are observed to prevent data loss, illicit or incorrect use and unauthorized access.
Possible existence of automated decision-making processes (e.g. profiling)
It is specified that the processing of your personal data does not involve any decision based solely on automated processing, including profiling.
Optional or mandatory nature of providing data and consequences in the event of any refusal
The provision of your data is necessary. Any refusal determines the impossibility of preparing the case and proceeding. In relation to the tasks that the Public Administration assigns to the Province of Pavia, the provision of data may be mandatory.
Possible transfer of data to a third country
Please note that no transfer of your personal data to a third country is envisaged.
Rights of the interested party
In your capacity as an interested party, you can exercise the rights referred to in articles 15 to 22 of the “General Data Protection Regulation” which, under the conditions and with the limitations provided therein, establish:
- the right of access of the interested party (Article 15 GDPR) “The interested party has the right to obtain from the data controller confirmation as to whether or not personal data concerning him or her are being processed and, in this case, to obtain access to personal data and the following information […]”;
- the right to rectification (Article 16 GDPR) “The interested party has the right to obtain from the data controller the rectification of inaccurate personal data concerning him or her without unjustified delay. Taking into account the purposes of the processing, the interested party has the right to obtain the integration of incomplete personal data, also by providing a supplementary declaration”;
- the right to cancellation (right to be forgotten) (Article 17 GDPR) “The interested party has the right to obtain from the data controller the deletion of personal data concerning him or her without unjustified delay and the data controller has the obligation to delete without unjustified delay personal data, if one of the following reasons exists […]”. The right to cancellation may be exercised subject to limitations in the event that the data is of public interest or necessary for the performance of a public power vested in the Province of Pavia (Art. 17.3 letter “b” GDPR);
- the right to limit processing (Article 18 GDPR) “The interested party has the right to obtain from the data controller the limitation of processing when one of the following hypotheses occurs […]”;
- the right to data portability (Article 20 GDPR) “The interested party has the right to receive the personal data concerning him or her provided to a data controller in a structured, commonly used and machine-readable format and has the right to transmit such data to another data controller without impediments on the part of the data controller to whom he provided them if […]”;
- the right to object (Article 21 GDPR) “The interested party has the right to object at any time, for reasons related to his particular situation, to the processing of personal data concerning him pursuant to Article 6, paragraph 1, letters and ) of) GDPR, including profiling on the basis of these provisions. The data controller shall refrain from further processing the personal data unless he demonstrates the existence of compelling legitimate reasons to proceed with the processing which prevail over the interests, rights and freedoms of the interested party or for the assessment, exercise or the defense of a right in court […].
There may be legislative limitations to the rights specified in relation to the tasks of the Public Administration of the Province of Pavia, specifically in relation to public safety, the prevention, detection and prosecution of crimes or other overriding public interests (Art. 23.1 GDPR).
The exercise by you of the mentioned rights may take place in the manner provided, in general, by articles 11 and 12 of the General Data Protection Regulation. In detail, you may address the relevant request to the Data Controller or Data Processor to the addresses indicated above, also through one of the Data Controllers or by registered letter, fax or e-mail or other suitable means identified by the “Guarantor for the protection of personal data”.
The above, without prejudice to the right of the interested party to lodge a complaint with the Guarantor authority for the protection of personal data (http://www.garanteprivacy.it/).
For anything not mentioned in this information, express reference is made to the provisions in force on the matter, with particular reference to the General Data Protection Regulation (EU Regulation 2016/679).
Pavia, 05/25/201
