Green Pass Privacy Policy

Information on the processing of personal data relating to the verification of Covid 19 green certification

Pursuant to Articles 13 and 14 of EU Regulation 679/2016

EU Regulation 679/2016 (hereinafter the "Regulation") lays down rules on the protection of natural persons with regard to the processing of personal data.

In compliance with the principle of transparency provided for by Articles 5 and 12 of the Regulation, with this information notice the Autonomous Province of Trento provides you with the information required by Article 13 of the Regulation (data collection from the Data Subject) regarding the processing of the data of employees and all other persons who carry out, in any capacity, their work, professional or voluntary activities at the offices of the provincial administration, including on the basis of external contracts or supply contracts.

The data controller is the Autonomous Province of Trento (hereinafter, the "Data Controller"), in the person of its legal representative (President of the Provincial Council in office), piazza Dante n. 15, 38122 - Trento, tel. 0461.494697, fax 0461.494603, e-mail direzionegenerale@provincia.tn.itpec segret.generale@pec.provincia.tn.it.

TheData Processors and the persons designated to answer the Data Subject's questions are the pro tempore General Manager of the Organisation, Personnel and General Affairs Department (Via Grazioli n. 1, 38122 - Trento, tel. 0461.496269, fax 0461.496224, e-mail dip.org.pers@provincia.tn.it, pec dip.org.pers@pec.provincia.tn.it) and the pro tempore Manager of the Security and Joint Management Service (Via Dogana n. 8, 38122 - Trento, tel. 0461.496400, fax 0461.496407, e-mail serv.sicurezzagestionicomuni@provincia.tn.it, pec serv.sicurezzagestionicomuni@pec.provincia.tn.it).

The contact details of the Data Protection Officer (DPO) are: via Mantova n. 67, 38122 - Trento, fax 0461.499277, e-mail idprivacy@provincia.tn.it (please indicate in the subject line:"DPO intervention request ex art. 38 EU Reg.").

The list of system administrators, whose activity also indirectly concerns services or systems that process or allow the processing of workers' personal information, may be consulted at the specific structure to which the employee is assigned. The list of such system administrators, appointed by Trentino Digitale S.p.A. as Data Processors, can be consulted on the provincial intranet .

The processing of your personal data will be carried out in compliance with the legislation on the protection of personal data and, in particular, with the principles of correctness, lawfulness and transparency, storage limitation and data minimisation in accordance with Articles 5 and 25 of the Regulation.

1. SOURCE OF PERSONAL DATA

Your data have been collected from the Data Subject (you yourself) and from the National Social Security Institute.

2. CATEGORY OF PERSONAL DATA

The processing in question exclusively concerns the validity or invalidity of the COVID 19 green certification and the personal data of the data subject such as name and surname, date of birth, identification data, as well as the date on which the swab was taken (i.e. the date on which the certificate expires) and the outcome only in the case of the submission of documents issued by public or private health facilities. The actual position of each person concerned in relation to vaccination obligations will not be recorded, but only the possible outcome of the check being invalid.

3. PURPOSE OF PROCESSING

In compliance with Article 13 of the Regulations, your data will be processed to fulfil the specific duty of the Data Controller to carry out the operations to verify the validity of the COVID 19 green certification in the possession of the Data Subject provided for under Article 1 of Decree-Law No. 127 of 21 September 2021 and Decree-Law No. 139 of 8 October 2021 (legal basis for processing) for access to work premises in order to ensure the greater effectiveness of measures to contain the SARS-CoV-2 virus and the safety of workers in the workplace.

The provision of your data is mandatory and consent is not required for their processing. In the event that the Data Subject is not in possession of a certificate of exemption from vaccination pursuant to Ministry of Health circulars prot. no. 35309/2021 and 35444/2021 and is therefore required to possess the COVID 19 green certificate, if he/she refuses to produce it or produces an invalid, suspiciously false or non-integral certificate, he/she will not be allowed access to the Province's work premises.

4. METHOD OF PROCESSING

Processing will be carried out using totem-type devices provided by the administration on the basis of the orders of the President of the Province or, alternatively, exclusively using the "VerificaC19" app and through interconnection with the Greenpass50+ application managed by the National Social Security Institute.

Your data shall be processed exclusively for the aforesaid purposes by the employees specifically delegated to control and specifically authorised to process the data, as well as duly instructed by the Data Processors (Managers) or their delegates.

5. AUTOMATED DECISION-MAKING PROCESSES AND PROFILING

The existence of an automated decision-making process, including profiling, is excluded.

6. COMMUNICATION AND DISSEMINATION OF DATA (CATEGORIES OF RECIPIENTS)

Your personal data will be communicated to employers or competent authorities for the possible initiation of liability proceedings in the cases provided for. Your data will not be disseminated.

7. TRANSFER OUTSIDE THE EU

Your personal data will not be transferred outside the European Union.

8. PERIOOD OF DATA RETENTION

In compliance with the principle of retention limitation, your data will not be retained in any form whatsoever, except for those strictly necessary for the application of the measures provided for in Articles 9-ter, paragraphs 2 and 5, 9- quinquies, paragraphs 6 et seq. and 9 septies, paragraphs 6 et seq. of Decree-Law No. 52 of 22 April 2021, as amended. In observance of the principle of indispensability, relevance and non-excessiveness, the COVID 19 green certificate checker will not ask for any type of information relating to the certificate submitted such as the circumstance from which it is generated (vaccination, swab or recovery) or other data related to it.

9. DRIGHTS OF THE INTERESTED PARTY

With regard to the Data Controller and at any time, you may exercise your rights under the Regulation.

According to the regulation you may:

1. requestaccess to your personal data and obtain a copy thereof(Art. 15);
2. if you consider them to be inaccurate or incomplete, request their correctionor supplementation respectively(Art. 16);
3. if the legal requirements are met, request their deletion(Art. 17), or exercise the right to limitation(Art. 18);
4. object to the processing of your data at any time on grounds relating to your particular situation, unless the processing is necessary for the performance of a task carried out in the public interest(Art. 21).

Pursuant toArt. 19, to the extent that this proves impossible or involves a proportionate effort, the Controller shall inform each of the possible recipients to whom the personal data have been transmitted of any rectification or erasure or restriction of processing carried out; if you so request, the Controller shall inform you of these recipients.

Furthermore, you have the right to lodge a complaint with the Data Protection Authority at any time.