VIDEOSORVEGLIANZA

Privacy notice pursuant to Art. 13 of Regulation (EU) 2016/679 and the Order of the Italian Data Protection Authority regarding video surveillance of 8 April 2010

Eurac Research, as the Data Controller (hereinafter the “Data Controller”) hereby informs you as a data subject (hereinafter the “Data Subject”) concerning the methods and purposes of the processing of personal data related to images acquired by means of the video surveillance systems installed on Eurac Research premises for the protection, safety and security of people and/or property.

Areas under video-surveillance are indicated with special signs that are clearly visible and state their intended purpose (information is simplified). These signs are located at the perimeter of the range of the cameras or in their immediate vicinity. This notice supplements the information on the simplified notice.

1. Purpose and legal basis of personal data processing

Any personal data of the Data Subject that may be acquired by the Data Controller or acquired at a later date are required solely for the purposes of the protection, safety and security of persons or property and, in particular, for the protection of the personnel and property of the establishment.

The legal basis for the processing of the personal data of the Data Subject is the legitimate interest of the Data Controller (Art. 6 (1)(f) of Regulation (EU) 2016/679). Images are recorded by the Data Controller with the aim of pursuing its legitimate interest through the collection of evidence for the purpose of protecting people and property, including in respect of any possible aggressive behaviour, theft, robbery, damage, vandalism, or for the purposes of fire prevention or safety at work.

The data thus acquired and processed are multimedia/video data taken from the installed cameras.

Pursuant to Article 4 of Law no. 300 of 1970 (the “Workers’ Statute”), under no circumstances will the system be used to monitor or control members of staff in the performance of their work activities. The images may not be used for disciplinary purposes or to evaluate the work activities of employees, with the exception of facts or events of a criminal and/or felonious nature.

2. Retention period
Images recorded by video surveillance systems will be retained for a maximum of 72 hours, after which they will be deleted (Order of the Italian Data Protection Authority regarding video surveillance of 8 April 2010, as amended). The images acquired may however be retained beyond this period for reasons relating to holidays or the closure of offices and departments, or in the event of a duly substantiated investigative request by the court or police authorities, or in the event of specific technical requirements.

3. Methods of personal data processing
Pursuant to Art. 29 of Regulation (EU) 2016/679, processing will be carried out solely by persons authorised to carry out such activities. Personal data will be processed for these purposes solely by specifically authorised and appropriately trained persons (Eurac Research employees with specific authorisation). If necessary for technical reasons, the video surveillance system may be accessed by third parties duly appointed as data processors by Eurac Research pursuant to Art. 28 Regulation (EU) 2016/679 who have signed a specific contract that explicitly regulates their processing tasks and the obligations regarding data protection. Full viewing of live and recorded images will be permitted only to persons expressly authorised by Eurac Research.
The updated list of data recipients can be obtained by contacting the following e-mail address: privacy@eurac.edu

The images will not be published.

4. Data transfer
The Data Controller will not transfer the personal data collected via the video surveillance system to any third country or international organisation outside the European Economic Area (EEA).

5. Automated decision-making processes
The cameras are equipped with a motion tracking or intelligent video system that makes it possible, without the need for any identification, to take and record images and, if necessary, to automatically detect abnormal behaviour or events, to report and to record them. The process of collecting, managing and controlling the images will be under human control. For this purpose, the Data Controller has carried out a preliminary and exhaustive assessment of the processing in question as established by the Italian Data Protection Authority (see Order of the Italian Data Protection Authority regarding video surveillance of 8 April 2010).

6. Data Controller

Eurac Research
Viale Druso 1
39100 Bolzano
T. +39 0471 055 055
E. privacy@eurac.edu

The Data Controller has appointed a Data Protection Officer (DPO) who can be contacted at the following e-mail address: privacy@eurac.edu

7. Rights of the data subject
You may contact the Data Controller (no particular formalities are required) in order to request information or clarification, as well as to assert your rights under the General Data Protection Regulation (GDPR) provided that you meet the requirements of the legislation (including, in particular, access to data). If no reply is received within 30 days of submitting such request, the data subject may lodge a complaint with the Data Protection Authority or appeal to the courts, unless a reasoned extension of up to 60 days has been granted owing to the complexity or the large number of requests.

Rights may be exercised by sending an e-mail to: privacy@eurac.edu