Rights of the person concerned

Art. 7 (Right of access to personal data and other rights)

1. The subject has the right to obtain confirmation of the existence or otherwise of personal data concerning him, even if not yet registered, and their communication in intelligible form.

2. The subject has the right to know:
a) the origin of personal data;
b) the purposes and methods of treatment;
c) the logic applied in case of treatment with the help of electronic means;
d) the identity of the holder and the representative appointed under article 5, paragraph 2;
e) the subjects or categories of persons to whom the data may be communicated or who can learn about them as appointed representative in the State, managers or agents.

3. The subject has the right to:
a) the updating, correction or, if interested, the integration of data;
b) the cancellation, transformation in anonymous form or block of data processed unlawfully, including those whose retention is unnecessary for the purposes for which the data were collected or subsequently processed;
c) the certification that the operations in letters a) and b) have been notified, including with regard to content, to those to whom the data were communicated or disseminated, unless this requirement proves impossible or involves a manifestly disproportionate to the protected right.

4. The subject has the right to object, in whole or in part:
a) for legitimate reasons, the processing of personal data concerning him, even though they are relevant to the purpose of collection;
b) the processing of personal data for the purpose of sending advertising materials or direct selling or for carrying out market research or commercial communication.

Art. 8 (Exercise of rights)

1. The rights set out in Article 7 shall be exercised informally asked the owner or manager, including via a designated person, which is given adequate response without delay.

2. The rights set out in Article 7 may not be exercised with a request to the holder or a person or an action under Article 145, if the processing of personal data is made:
a) in accordance with the provisions of Decree-Law of 3 May 1991, n. 143, converted with amendments by Law of 5 July 1991, n. 197, as amended, recycling;
b) in accordance with the provisions of the decree-law 31 December 1991, n. 419, converted with amendments by Law 18 in February 1992, n. 172, as amended, concerning support for victims of requests estorsive;
c) Parliamentary committees of inquiry set up under Article 82 of the Constitution;
d) by a public body, other than public economic entities, according to an express provision of law for the exclusive purpose related to monetary policy, the payment system, supervision of brokers and banks and financial markets, as well as the protection their stability;
e) under Article 24, paragraph 1, letter f), limited to the period during which the injury could result in a real and concrete for the conduct of investigations for the defense or exercise of rights in court;
f) by providers of electronic communications services accessible to the public in respect of incoming phone calls, except that it can result in a concrete and actual prejudice to the conduct of defensive investigations in the Law of 7 December 2000, n. 397;
g) for reasons of justice at the courts of every level or the Council of the Judiciary and other organs of self or the Ministry of Justice;
h) under Article 53, subject to the provisions of the Act 1 April 1981, n. 121.

3. The Ombudsman also concerned about the report, in the cases referred to in paragraph 2, letters a), b) d) e) and f), shall in accordance with the provisions of Articles 157, 158 and 159 and, in cases of which in c), g) and h) of that paragraph, shall in the manner provided for in Article 160.

4. The exercise of the rights set out in Article 7, if not about the objective data, can take place unless it relates to the correction or the integration of personal data such evaluation, for reviews, opinions, or other type of subjective assessments, and the indication of pipeline to be held and decisions in the process of recruitment by the data.

Art. 9 (mode of operation)
1. The request to the owner or manager may also be sent by letter, fax or e-mail. The Ombudsman may identify other suitable system in relation to new technological solutions. As regards the exercise of the rights set out in Article 7, paragraphs 1 and 2, the request may be made orally and in that case was briefly noted by the responsible or liable.

2. In the exercise of the rights set out in Article 7 may give him, in writing, delegate or attorney to individuals, institutions, associations or bodies. It may also be assisted by a person of trust.

3. The rights set out in Article 7 relating to personal data concerning deceased persons may be exercised by those who have an interest, or acting in the interests of the person concerned or for family reasons deserving of protection.

4. The identity of the person concerned is verified on the basis of suitable assessment criteria, including documents or records available or display or allegation of a copy of a document. The person who acts on behalf of the concerned exhibits or attach a copy of the proxy, or the delegation signed in the presence of a charge or signed and submitted with a non-authenticated photocopy of a document for approval of the concerned. If the person concerned is a legal person, an institution or association, the request is made by the person entitled in accordance with their respective statutes or ordinances.

5. The request referred to Article 7, paragraphs 1 and 2, is made freely and without compulsion, and can be renewed, unless the existence of legitimate reasons, with no less than ninety days.