Excerpt of Leg. Decree no. 196 of 30th June 2003
Rights of data subject.
With respect to the processing of his/her personal data, the data subject is entitled:
[a] to have free access to the Registry as under article 31(1) lett. a) and to know whether data concerning him/her are being processed;
[b] to be informed of the issues listed in article 7(4), lett.s a),b) and h);
[c] to ask the data controller or the person accountable for data processing, without delay:
1) to confirm or not the existence of data concerning him/her, even if not yet recorded, and to obtain communication in an intelligible way of said data and of their origin, and of the logic and purpose of processing; said request may be renewed only every ninety days, unless there are justified reasons allowing for exceptions;
2) to cancel, make anonymous or block processed data where their processing is against the law; this also applies to data whose storage is not necessary for the purpose for which they were collected or subsequently processed;
3) to update, rectify or, when interested therein, complete processed data;
4) to confirm that actions as under numbers 2) and 3), also with respect to their content, have been notified to third parties to whom the data have been communicated or disclosed, unless this proves impossible or involves a disproportionate effort with respect to the data subject's rights;
[d] to object, in toto or in part, and on legitimate grounds, to processing of his/her data, even though pertaining to the purpose of collection;
[e] to object, in toto or in part, to processing of his/her personal data for the purpose of commercial information or for mailing of promotional or direct sale materials, or for market research or interactive commercial communications, and to be informed by the data controller, no later than communication or disclosure of his/her personal data, of his/her power to exert said rights.
With respect to any request under para. 1, letter [c], number 1), the data subject may be asked, where the existence of personal data regarding him/her is not confirmed, to contribute to the expenses borne for all corresponding checks; said contribution shall not be above the costs actually borne, and in accordance with the limits and modes of art. 33(3) of the Regulation. The rights as under para. 1), when referred to personal data of deceased subjects, may be exerted by anyone interested therein. In exercising the rights of para.1), the data subject may confer written mandates or proxies upon physical beings or associations. The above, with respect to the source of the news, is without prejudice to the provisions regulating the professional secret of journalists.
The complete text of the Law is available at the Website of the Privacy Controller or of the Italian Parliament.