Privacy Protection Regulations Law No. 675/96 (excerpt)

Article 10

Information Provided at the Time of Data Collection

1. The data subject or the person from whom personal data is collected must be previously informed in writing regarding:
   a) the purposes and methods of processing for which the data are intended;
   b) the mandatory or optional nature of providing the data;
   c) the consequences of any refusal to provide the data;
   d) the subjects or categories of subjects to whom the data may be communicated and the scope of dissemination of the data;
   e) the rights referred to in Article 13;
   f) the name, company name or business name, and the domicile, residence, or headquarters of the data controller and, if appointed, the data processor.

2. The information referred to in paragraph 1 may exclude elements already known to the person providing the data or the knowledge of which may hinder the performance of public inspection or control functions carried out for the purposes referred to in Article 4, paragraph 1, letter e), and Article 14, paragraph 1, letter d).

3. When personal data are not collected from the data subject, the information referred to in paragraph 1 shall be provided to the data subject at the time of recording the data or, if their communication is envisaged, no later than the time of the first communication.

4. The provision referred to in paragraph 3 shall not apply when providing information to the data subject requires means that the Supervisory Authority declares manifestly disproportionate to the right being protected, or is considered impossible by the Supervisory Authority, or in cases where the data are processed based on an obligation established by law, regulation, or European Community legislation. The same provision also does not apply when the data are processed for the purpose of carrying out the investigations referred to in Article 38 of the implementing, coordinating, and transitional provisions of the Code of Criminal Procedure, approved by Legislative Decree No. 271 of 28 July 1989, and subsequent amendments, or, in any case, to establish or defend a legal claim, provided that the data are processed exclusively for such purposes and for the period strictly necessary to pursue them.

Article 13

Rights of the Data Subject

1. In relation to the processing of personal data, the data subject has the right:

a) to know, by free access to the register referred to in Article 31, paragraph 1, letter a), the existence of data processing operations that may concern him/her;

b) to be informed of the matters indicated in Article 7, paragraph 4, letters a), b), and h);

c) to obtain from the data controller or processor, without delay:

1. confirmation of the existence or otherwise of personal data concerning him/her, even if not yet recorded, and communication of such data in intelligible form, along with their origin, as well as the logic and purposes upon which the processing is based; the request may be renewed, subject to the existence of justified reasons, at intervals of not less than ninety days;

2. the erasure, anonymization, or blocking of data processed in violation of the law, including data whose retention is unnecessary in relation to the purposes for which they were collected or subsequently processed;

3. the updating, rectification, or, if interested, integration of the data;

4. certification that the operations referred to in points 2) and 3) have been brought to the attention, including as regards their content, of those to whom the data were communicated or disseminated, except where this requirement proves impossible or involves a manifestly disproportionate effort compared to the right being protected;

d) to object, in whole or in part, on legitimate grounds, to the processing of personal data concerning him/her, even if pertinent to the purpose of the collection;

e) to object, in whole or in part, to the processing of personal data concerning him/her for the purpose of commercial information or the sending of advertising material or direct sales, or for carrying out market research or interactive commercial communication, and to be informed by the data controller, no later than the moment the data are communicated or disseminated, of the possibility of exercising this right free of charge.

1. For each request referred to in paragraph 1, letter c), point 1), the data subject may be asked, where the existence of data concerning him/her is not confirmed, to contribute to the costs, not exceeding the actual expenses incurred, in the manner and within the limits established by the regulation referred to in Article 33, paragraph 3.

2. The rights referred to in paragraph 1 relating to personal data concerning deceased persons may be exercised by anyone who has an interest.

3. In exercising the rights referred to in paragraph 1, the data subject may delegate or grant power of attorney in writing to individuals or associations.

4. The provisions on professional secrecy of journalists remain unaffected, limited to the source of the information.