Information for video surveillance in accordance with EU Regulation 679/2016
This document is provided in accordance with the General Regulation EU 2016/679 on Protection of Personal Data (hereinafter, GDPR) and in compliance with the General Provisions on video surveillance issued by the Data Protection Authority on 8 April 2010.
This document provides additional information to the simplified disclosure information provided through the signs available next to the cameras.
Data Controller – Identity and Contact
The Data controller of Politecnico di Milano is the General Director upon authorization of the pro-tempore Rector – contact: dirgen(at)polimi.it
Data Protection Officer – Identity and Contact
Dr. Vincenzo Del Core - privacy(at)polmi.it tel.: 02.2399.9378
Purposes of data processing
The data collected by video surveillance systems are processed within the institutional purposes of the University, to fulfil the following specific purposes:
It should be noted that, pursuant to Article 4, Law 300/1970 (Statute of Workers), the systems used are not used, in any case, as a tool for remote control of the work of professors, technical-administrative staff and all those who work, for different purposes, in the University.
Obligation or no obligation to transmission of data
The provision of data is compulsory and is strictly required to access the University's areas under video surveillance. Failure to provide data implies that the interested party will not allowed to access these areas.
Categories of data recipients and possible data transfer
For the objectives pursued, the data, obtained through video surveillance systems, are available to employees and collaborators of Politecnico di Milano expressly authorized that, working under the direct authority of the Data Controller or the Data Processor, carry out data processing activities, each one of them related to their tasks, through the authentication credentials provided.
The data may be disclosed to external parties authorized upon request, such as judicial or public security authorities.
Data Transfer to Extra EU Country
The Data Controller will not transfer the data obtained from video surveillance systems outside the European Economic Area.
Video surveillance (fixed system) is carried out through digital cameras, connected to the University's telematic network, which allow images to be viewed in real time in the control rooms (Control Room and Campus porter's lodge) as well as the recording of images in "Motion Detection" mode, 24 hours a day, 365 days a year.
Video surveillance is carried out primarily in the external areas of the University (for example: perimeter access to the campuses and buildings, areas for parking and loading/unloading of goods, waste storage areas); no cameras are installed inside classrooms, laboratories or offices.
The images are usually taken in long shot, with enlargements if required by demonstrable needs.
The processing operations are carried out mainly with the aid of IT and telematic tools, according to the needs strictly related to the purposes indicated above and, in any case, in compliance with the principles of lawfulness, fairness and transparency provided by the Privacy Law. Therefore, it must be noted that:
- The recordings are stored on electronic media and storage servers located at the headquarters of the Data Controller and can be processed only by personnel authorized by the Data Controller;
- The video recordings and personal data contained can be made available only to the Judicial Authority or Police Authority (upon clear request) for the identification of the responsible persons of illegal activities to the detriment of the Data Controller and other subjects;
- Security measures are used, in compliance with the mentioned Article 32 of the GDPR to prevent the loss of data, illicit or incorrect use and unauthorized access, in compliance with the AgID Circular 2/2017 "Minimum ICT security measures for public administrations";
- The video surveillance system is not connected to security companies or police.
Right of the interested party
The interested party (identifiable subject recorded) will be able to exercise, against the University, the rights provided by the GDPR and in particular:
- Right of access to personal data and information pursuant to Article 15 of the GDPR;
- Right to object to personal data processing, without prejudice to what is required in relation to the need for mandatory data processing in order to take advantage of the services offered;
- Right to limitation of data processing, pursuant to Article 18 of the GDPR;
- Right to cancel (right to be forgotten) your data, except for those already included in documents that must be kept by Politecnico di Milano and unless there is a legitimate reason in order to proceed with data processing.
The interested party acknowledges that, given the specific nature of the processed data (images collected in real time), the right to obtain completion or update, as well as the right to correct as referred in Article 16 of the GDPR, cannot be exercised. Furthermore, the right to data portability, pursuant to Article 20 of the GDPR, cannot be exercised as well, because the images acquired with the video surveillance system cannot be transferred to other subjects (except for the cases mentioned in "CATEGORIES OF DATA RECIPIENTS AND POSSIBLE DATA TRANSFER" section of this document).
The identifiable interested party may request access to recordings in which his/her images are recorded (by attaching the appropriate identity document to the request). The answer to a request for access cannot, however, include any data referring to third parties with respect to the part requested (for this purpose, it is not possible to request breakdown or selective masking effects on frames).
To exercise only the rights to access the video recordings, as well as for any information, the interested party can contact the Politecnico di Milano Contact Centre (contact: contactcenter(at)polimi.it - Phone 0223999300). In case of exercising the aforementioned rights of limitation, cancellation, and to object on the processing of personal data, the interested party may contact the DPO of Politecnico di Milano. The interested party to data processing can also make a complaint to the supervisory authority, or the Data Protection Authority (www.garanteprivacy.it).
Last update: December 11, 2018