Sapienza University of Rome Privacy Policy pursuant to the Regulation (EU) 2016/679 and current national regulations.

Data Controller is Sapienza University of Rome in the person of its legal representative, the Magnificent Rector:

Data Processor is Dottor Andrea Bonomolo:

Lawfulness of Data Processing

The GDPR confirms that each treatment must be based on an appropriate legal basis; the bases of lawfulness of the treatment are indicated in art. 6 of the regulation: consent, fulfillment of contractual obligations, vital interests of the person concerned or of third parties, legal obligations to which the owner is subject, public interest or exercise of public powers, prevailing legitimate interest of the owner or third parties to whom the data are communicated.

For "sensitive" information (art. 9 regulation) consent must be "explicit"; the same applies to consent to decisions based on automated processing (including profiling - art.22). In all cases, it must be free, specific, informed and unequivocal and tacit or presumed consent is not allowed.

Information to be provided where personal data are collected from the data subject

Information to be provided are listed exhaustively in Articles 13 (1) and 14 (1) of the regulation. In particular, the following must always be specified: the contact details of the DPO (Data Protection Officer), the legal basis of the processing, the legitimate interest where the latter constitutes the legal basis of the processing if personal data are transferred to third countries and, if so, through which tools.

Right of access by the data subject

The data subject can request, under specific conditions, access to personal data pursuant to art. 15 of the Regulation, rectification pursuant to art. 16, erasure ('right to be forgotten') pursuant to art. 17 or the restriction of processing  pursuant to art. 18,  or can object to their treatment pursuant to art. 21, in addition to being able to exercise the right to data portability pursuant to art. 20. In case of violation of the provisions of the Regulation, the data subject can lodge a complaint with the Italian Data Protection Authority;

The measures for implementing the main obligations envisaged by the aforementioned legislation are referred to in the following internal circulars (in Italian):

  • Circular prot. n. 18772 - 2.03.2018;
  • Circular prot. n. 44407 - 25.05.2018

© Sapienza Università di Roma - Piazzale Aldo Moro 5, 00185 Roma - (+39) 06 49911 - CF 80209930587 PI 02133771002