Information on the processing of personal data and expression of consent
Pursuant to EU Regulation 2016/679 General Data Protection Regulation (GDPR) on the protection of natural persons with regard to the processing of personal data, as well as on the free circulation of such data, the University Hospital (AOU) Città della Salute e della Scienza di Torino and the University of Turin, as joint Data Controllers, inform you that your data will be processed in the manner set out below.
Data controllers
Joint data controllers, i.e. the entities that define the purposes and tools of the processing pursuant to the European privacy regulation, are the AOU Città della Salute e della Scienza di Torino and the University of Turin.
The joint data controllers can be contacted at the following addresses:
AOU Città della Salute e della Scienza di Torino
Corso Bramante, 88/90
10126 Torino
Centralino +39 011 6331633
Certified e-mail address (PEC): protocollo@pec.cittadellasalute.to.it
Legal representative: the General Manager.
Università degli Studi di Torino
Via Verdi, 8
10124 Torino
Centralino +39 011 6706111
Certified e-mail address (PEC): ateneo@pec.unito.it
Legal representative: the Rector.
Data Protection Officers
The Data Protection Officers (DPO) of the AOU Città della Salute e della Scienza di Torino and the University of Turin, co-Data Controllers, are:
AOU Città della Salute e della Scienza di Torino
Email address: dpo@cittadellasalute.to.it
Università degli Studi di Torino
Email address: rpd@unito.it
Purpose of data processing
This processing, concerning personal data (any information relating to a natural person, including a personal identification number) and those relating to your state of health, will be carried out for the purposes of scientific research in the medical, biomedical and epidemiological fields and statistical research aimed at protecting the health of the community.
The AOU Città della Salute e della Scienza di Torino and the University of Turin, each for the areas of their competence and in accordance with the responsibilities established by the rules of good clinical practice (DL 211/2003), will process your personal data (name, surname, place and date of birth, tax code, home address, residential address, email, telephone numbers), your data on lifestyle habits and socioeconomic status, environmental exposures and health, as well as any biological samples provided by you, only to the extent that they are essential in relation to the objective of the study, pursuant to the Provision of the Guarantor for the protection of personal data no. 146 of 5 June 2019, containing the provisions relating to the processing of special categories of data, pursuant to art. 21, paragraph 1 of Legislative Decree 10 August 2018, no. 101, pursuant to the GDPR and Legislative Decree 101/2018 adapting national legislation to the provisions of the GDPR.
The project has received General Authorization from the Guarantor and Approval from the Territorial Ethics Committee "Interaziendale AOU Città della Salute e della Scienza di Torino" (ref. Practice no. 45).
Legal basis for processing personal data
Participation in the experiment is voluntary, free and aware.
Your participation in the project is important because it offers help for the advancement of scientific research and, by increasing the amount of available knowledge, for the progress of society.
Your explicit consent may be freely revoked at any time; any revocation will only be valid for the future, with the processing carried out up to that point remaining valid.
Nature of the data processed
Some of your "common" personal data (such as name and surname, telephone number, e-mail address) and data relating to your health will be processed; based on the purposes of the research and the characteristics of the study, data relating to your medical history, socioeconomic situation and lifestyle will be collected.
Treatment modalities
All information collected as part of the NINFEA project will be processed in compliance with the provisions of the GDPR and Italian legislation regarding the management and protection of personal data.
Your personal data will be treated with the utmost confidentiality, in compliance with the security regulations for computer and paper archives set out in the legislation, and will be used only by authorised personnel exclusively for scientific research purposes.
We also inform you that data processing takes place using tools suitable for guaranteeing security and confidentiality and may also be carried out using automated tools designed to store and manage the data itself, with encryption techniques or the use of identification codes that allow identification only in case of necessity.
The data are pseudonymized because, after collection, they are stored separately from the identifying data (name, surname, etc.), since a code is assigned to the participants that does not allow direct identification. The data are encrypted in compliance with the security measures for the protection of privacy and confidentiality of the data, provided for by the above-mentioned legislation.
Those authorized to process data (doctors, statisticians and other professionals working at the facilities belonging to the co-owners) have access to the data in pseudonymized form whenever unique identification is necessary and in anonymous form in all other instances, always solely for research purposes. Access to personal data only occurs for follow-up needs.
The NINFEA project data are hosted by a cloud computing and backup service (Nivola), provided by CSI Piemonte pursuant to resolution no. 2133 of 27/09/2022 of the AOU Città della Salute e della Scienza di Torino and subsequent amendments, without authorization to access or administer the data by the same, which has only conservation tasks. Access to the virtual machines and software administration of the machines is permitted exclusively to competent personnel belonging to the AOU Città della Salute e della Scienza di Torino.
The information collected is strictly confidential and will be used in an aggregate and anonymous manner for the preparation of scientific reports, in which you will not be identifiable in any way. The results may be disclosed in a strictly anonymous and aggregate manner.
Categories of subjects to whom the data may be communicated
The data will be processed within the co-Controller Bodies by subjects authorised to process under the responsibility of the same co-Controller Bodies for the purposes indicated above in compliance with the rules of ethics and the code of ethics. We also inform you that the data collected will be used in pseudonymised form for statistical and epidemiological analyses and may be communicated to research partner subjects.
All processing operations, carried out only by personnel duly trained and authorised by the joint Data Controllers, will take place in compliance with professional secrecy, official secrecy and the principles of correctness, lawfulness and transparency, as set out in current legislation.
Dissemination and transfer of personal data
The AOU Città della Salute e della Scienza di Torino and the University of Turin, within the scope of collaborative projects with purposes consistent with those of the NINFEA project and following approval by the competent Ethics Committee and the signing of an agreement, may transfer socio-demographic, epidemiological, clinical and molecular data, or any biological samples, in anonymous or pseudonymised form (with the use of fake IDs) to research institutions and bodies, public or private partnerships in the field of scientific research, public bodies, scientific foundations, non-profit associations with research purposes located in countries of the European Union.
With regard to any transfer of data to Third Countries, the joint Controllers hereby declare that the transfer will take place in compliance with Articles 44 et seq. of the GDPR (Transfer on the basis of an adequacy decision, transfer subject to adequate guarantees) with the exclusion of Article 49 concerning "Exceptions in specific situations". Further information is available from the joint Controllers or from the DPOs, by writing to the addresses indicated above.
The study partners formally undertake not to process the data and samples for purposes other than those indicated in the shared project, not to communicate or further transfer them to third parties, not to use them for profit or commercial purposes.
A new specific identification code will be created for each new project. The connection between the new code and the NINFEA project code will be maintained at the AOU Città della Salute e della Scienza di Torino and the University of Turin and will not be accessible externally.
Period of retention of personal data
The data will be stored for a period of 50 years from the end of enrollment (which occurred in 2016). After this period, the data will be irreversibly anonymized and archived. The period indicated is necessary for the purposes of the project, through which we intend to evaluate the long-term effects of early exposures.
Rights of the interested party
In relation to the processing of personal data concerning you, Chapter III of the GDPR recognises specific rights and, in particular, the right, if applicable, to:
- access your personal data and information relating to them;
- request the updating, the correction of inaccurate data and the integration of incomplete data;
- request the deletion of personal data concerning you when one of the conditions indicated in art. 17, paragraph 1 of the GDPR occurs and in compliance with the exceptions provided for in paragraph 3 of the same article and provided that there are no data retention obligations required by law;
- request the limitation of the processing of your data in the event of one of the hypotheses provided for by art. 18 of the GDPR;
- request the transmission of your data to another Data Controller in a format readable with the most common computer applications (so-called "right to portability"), where technically possible;
- to object at any time to the processing of your personal data in the event of particular situations concerning you;
- revoke consent at any time, limited to cases in which the processing is based on your consent for one or more specific purposes and concerns common personal data or particular categories of data. The processing based on consent, and carried out prior to its revocation, retains, in any case, its lawfulness;
- submit a complaint to the Personal Data Protection Authority (whose contact details can be found on the website www.garanteprivacy.it) in the event of unlawful processing or delay in the Data Controller's response to a request relating to your rights;
- interrupt your participation in the study at any time and without providing any justification: in this case, the biological samples related to you will be destroyed. Furthermore, no further data concerning you will be collected, without prejudice to the use of any data already collected to determine, without altering them, the results of the research.
How to exercise your rights
The request for the exercise of the above rights must be submitted by contacting the promoter directly through the Public Relations Offices (URP) of the AOU Città della Salute e della Scienza di Torino:
Presidio Molinette
Corso Bramante, 88 – Torino
Tel. 011-633.5444
e-mail: urpmolinette@cittadellasalute.to.it
Profiling
The joint Controllers do not use automated processes aimed at profiling.
Name and contact details of the principal investigator
Prof. Lorenzo Richiardi, Unità di Epidemiologia, Dipartimento di Scienze Mediche
lorenzo.richiardi@unito.it
Tel. +39 011 633.6744
Consent
Your consent to participate in the study is freely given and can be revoked at any time, without the need to provide any justification and without this resulting in any disadvantage or prejudice to you.
In the event that you withdraw your consent, you have the right to request that all data and/or biological samples previously collected be deleted, unless the data and biological samples, originally or following processing, no longer allow you to be identified. No further new data concerning you will be collected, without prejudice to the use of any data already collected to determine, without altering them, the results of the research.