Privacy Policy

(Privacy Policy pursuant to Articles 13 and 14 of the (EU) Regulation No. 679/2016 - from now on GDPR)


Definitions

Service Name

INRiM Identity Provider (IdP)

Service Description

The federated authentication service that allows the Users of INRiM to access federated Resources using their institutional credentials.
The Resources can be provided through the Italian Identity Federation of Universities and Research Institutions (IDEM), or directly.
The federated Authentication Service is responsible for authenticating the User, issuing an authentication token and, if required, releasing a minimum set of personal data to access the Resource.

Controller
  • Name: Istituto Nazionale di Ricerca Metrologica - INRiM
  • Email: dpo@inrim.it
  • Address: Strada delle Cacce, 91 - 10135 Torino, IT

INRiM is the Controller of the personal data managed through the Service.

Data Protection Officer (GDPR Section 4) Dott.sa Anna Galletti - dpo@inrim.it

Jurisdiction and supervisory authority

IT-IT

Italian Data Protection Authority
https://www.garanteprivacy.it/home_en

Categories of direct and indirect personal data processed and legal basis for processing
  1. one or more unique identifiers;
  2. identification credential;
  3. first and last name;
  4. e-mail address;
  5. role in the organisation;
  6. work group affiliation;
  7. specific rights to resources;
  8. name of the affiliated organisation;
  9. IdP service log records: User identifier, date and time of use, requested Resource, submitted attributes;
  10. Log records of the services necessary for the operation of the IdP service.

Any collected personal data is stored in Italy, in accordance with the GDPR. The data processing purpose is the provisioning of the authentication service. The legal basis for data processing is the fulfillment of contractual obligations (through the provisioning of the authentication service) and the legitimate interest of the Controller.

Purposes of personal data processing

To provide the federated authentication service in order to access the Resources requested by the User. To verify and monitor the proper functioning of the service and ensure its security (legitimate interest). To fulfil any legal obligations or requests from the judicial authorities.

Third parties to whom the data are commiunicated

The Controller, in order to provide the service correctly, communicates to the Resources providers to which the User intends to access proof of authentication and only the personal data (attributes) requested, in full compliance with the principle of minimization. Personal data is transmitted only when the subject requests access to the Resource of the third party. For purposes related to the legitimate interest of the Controller or the fulfilment of legal obligations, some log data may be processed by third parties (e.g. CERT, CSIRT, Judicial Authority).

Esercise of Subjects' rights

To request access to your personal data and their correction or deletion or to object to their processing, or to exercise the right to data portability (Articles 15 to 22 of the GDPR), contact the Controller at the above mentioned contact details.
Revocation of the consent of the interested party The only data collected with the consent of the subject are preferences about the visualization of the attribute transmitted to the Resources. The preferences are collected at the time of the first access to the Resource and may be changed afterwards by starting over again the access procedure.

Data portability

The Interested Party may request the portability of their data concerning the federated authentication service, including preferences regarding the visualization of the attributes transmitted to the Resources, which will be provided in open format and in accordance with Art. 20 of the GDPR. The data portability service is free of charge.
Duration of Data Storage All personal data collected to provide the federated authentication service will be stored for the entire time it will be necessary to provide the service itself. After 6 months after deactivation, all personal data collected or generated by the use of the service will be deleted.

General informations about the IDEM service can be found on the: Information Page.