27.10.2023
Information pursuant to and for the purposes of the New European Regulation - GDPR 2016/679 - (protection of personal data)
Dear Sir/Madam
In some of the places where the companies of the Caronte & Tourist group carry out their activities they have installed video cameras that can take images of people - including users and employees of the companies - passing through or stopping within their range. The collection, recording, storage and use of images taken by means of video surveillance equipment constitutes “processing of personal data” within the meaning of the General Data Protection Regulation - Regulation (EU) 2016/679 (GDPR).
Data controllers and Data processor
The data controllers are, respectively Caronte & Tourist S.p.A., Caronte & Tourist Isole Minori S.p.A, Cantieri Navali dello Stretto S.r.l., Cartour S.r.l.;
Caronte & Tourist S.p.A. is also Data processor on behalf of the other companies in the group.
The Data controllers and the Data processor can be contacted by sending at:
mail address: privacy.gruppo@carontetourist.it or by calling telephone number: 090/9038201.
The group has appointed a Data Protection Officer, in accordance with Article 39 of Regulation (EU) 2016/679, which can be contacted at the data controllers’ head office or by e-mail at dpo@carontetourist.it.
Type of data collected
The data processed consists of images taken by video surveillance equipment. Cameras do not film places reserved exclusively for employees, such as changing rooms or toilets.
The images can be viewed live by persons specifically designated by the Company; in addition, the images are broadcast live on mega-screens positioned near the boarding areas: it should be noted that from viewing the mega-screens it is not possible to trace the identity of the persons or the registration numbers of the vehicles passing through the video surveillance areas.
The image recordings may only be accessed by specially authorised persons and only in cases of request by the data subject or public authorities or in the event that harms or may harm the safety of individuals or the protection of company assets. In the event of prejudicial events concerning employees, access to the records is carried out in the presence of the employee safety representative, the data subject (accompanied by the trade union representative in the cases provided for) and the Information Technologies manager; access will take place in accordance with the procedures defined by specifically trade union agreements. Processing is carried out with the use of electronic tools.
Information signs indicating the presence of the cameras have been placed in the video surveillance areas before entry to the camera range.
In general, the processing is carried out in accordance with the principles of the GDPR, national legislation (Privacy Code), of the guidelines on video surveillance issued by the Data Protection Authority, Article 4 of italian Law no. 300/1970 and, finally, of the trade union agreements stipulated between companies and trade unions.
Purpose and legal basis of processing
Your data are processed for the following purposes:
|
|
Purpose |
Legal basis for processing |
|
a) |
To protect the safety of company employees and users |
Processing necessary to fulfil a legal obligation to which the data controller is subject (Art. 6(1)(c) GDPR) |
|
b) |
To protect corporate assets |
Processing is necessary for the pursuit of a legitimate interest, insofar as the interests or fundamental rights and freedoms of the data subject do not override it (Art. 6(1)(f) GDPR) |
|
c) |
To acquire evidence of responsibility for any accidents |
Processing is necessary for the pursuit of a legitimate interest, insofar as the interests or fundamental rights and freedoms of the data subject do not override it (Art. 6(1)(f) GDPR) |
|
d) |
To enable traffic control by persons passing through boarding areas and facilitate traffic management by the authorities in charge. |
The processing is necessary for the pursuit of a legitimate interest of the Data Controller (Art. 6(1)(f) GDPR), as well as to comply with provisions of the Prefectural Authority (Art. 6(1)(c) GDPR) |
|
e) |
With regard to images taken on board ships, to observe the legal provisions relating to shipping safety. |
Processing necessary to fulfil a legal obligation to which the data controller is subject (Art. 6(1)(c) GDPR) |
|
f) |
Limited to some of the images taken at the Messina - Rada San Francesco square, to enable, through direct connection with the State Police, the performance of activities related to the protection of public order and safety, as well as for prevention and/or judicial police activities. |
Processing necessary to fulfil a legal obligation to which the data controller is subject (Art. 6(1)(c) GDPR) |
Necessity or Optional Nature of Processing
The processing of personal data for the above-mentioned purposes is necessary to monitor the traffic of vehicles and people passing through the relevant areas. The data subject may avoid processing by refraining from passing through the aforementioned areas. It is reiterated that signs indicating the presence of the cameras are displayed in the vicinity of video surveillance sites.
Recipients of personal data
Personal data collected will not be disclosed to third parties.
They may be communicated to the judicial authorities and/or the police, following a specific request by them.
Some images taken at the Messina - Rada San Francesco square are also shared through direct connection with the State Police, in order to enable activities related to the protection of public order and safety, as well as for prevention and/or judicial police activities.
Processing methods
Personal data are collected during transit through the video surveillance areas. The processing is carried out using IT tools in compliance with the provisions on the protection of personal data and, in particular, with the appropriate technical and organisational measures referred to in Article 32.1 of the Regulation, and with the observance of all precautionary measures to ensure the integrity, confidentiality and availability of the data.
Personal data stored on computer databases are only accessible to identified persons (the person in charge and his/her appointees), by means of personal access keys.
Data retention period
With regard to cameras placed on boarding areas and company premises, the retention period of images is limited to ninety-six hours after recording.
With regard to cameras placed inside ticket offices, the retention period of images is seven days after recording.
Finally, with regard to cameras placed on board ships, the retention period for images is seven days after recording.
After these periods, the images self-delete due to the overwriting of new images.
Rights of the data subject under Articles 15-22 of the EU Regulation - GDPR 2016/679
Data subjects may contact the Company or any external data controllers to exercise the rights provided for in Articles 15 to 22 of the GDPR: in particular, they have the right to access their data, to request its deletion, to object to its processing (only in cases of processing based on a legitimate interest of the Data Controller) and to request its restriction. In addition, data subjects may request to receive their personal data in a structured, standardised format. In accordance with Article 3.5 of the aforementioned provision of the Italian Data Protection Authority, with regard to the recorded images, the right of rectification cannot be exercised in practice, in view of the intrinsic nature of the data collected, since these are images collected in real time concerning an objective fact.
Finally, data subjects have the right to lodge a complaint with the competent authority.
For any request concerning the exercise of rights, data subjects may contact the data controller.
Methods of the data subject’s request
The data subject may exercise the above rights at any time by sending an email to privacy.gruppo@carontetourist.it.
The data subject is entitled to lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority) on the basis of the indications given at https://www.garanteprivacy.it/garante/doc.jsp?ID=4535524 or to any other supervisory authority.