Skip to content High contrast mode


Under Italian Legislative Decree no. 196 of 30 June 2003, (the "Data Protection Law", or "Law"), personal data must be used in accordance with fundamental human rights and freedoms, and with the personal dignity of the data subject, with particular reference to confidentiality, the protection of personal identity and the right to the protection of personal data.
Art. 4 (1) (a) of the Law defines the use of data as any operation or complex of operations, performed even without the use of electronic aids, concerning the collection, recording, organisation, conservation, consultation, processing, modification, sorting, extraction, comparison, utilisation, interconnection, blocking, notification, disclosure, deletion and destruction of data, even if not entered in a database.
Università Vita-Salute San Raffaele of Milan (hereinafter "the University”), in its capacity as Data Controller pursuant to art. 4 (1) (f) of the Law, provides data subjects with the following disclaimer with regard to the use of their personal data.
1. Personal data acquired for the performance of the University's institutional activities are used for purposes related solely to the performance of the said activities, and specifically for all the procedures necessary for the full achievement of the University's functions under the law and its charter, including possible disclosure through publication on the University's Internet site, in accordance with the provisions of the Law, the regulations and the principles of legality, ethics, relevance and non excessiveness in relation to the institutional purposes for which they are used, for educational and administrative activities, and for the pursuance of the University's institutional and security aims in more general terms, and with regard to sensitive and judicial data, for the purposes of public interest referred to in articles 64 (“Nationality, immigration and status of foreigners”), 65 (“Political rights and advertising of the activities of authorities”); 68 (“Economic benefits and authorisations”), 86 (“Other purposes of considerable public interest - assistance, social integration and rights of the handicapped people (...)”) and 95 (“Sensitive and judicial data”).
Data may also be used for historic, statistical or scientific purposes, in compliance with the relevant legislation and codes of ethics.
2. With regard to the use of personal data, suitable security measures are adopted to guarantee the confidentiality and security of the data used, in order to minimise the risk of destruction or loss of the data, unauthorised access, prohibited use or use not in compliance with the purpose for which the data were acquired.
Data may be stored and processed on paper or on digital media.
Data may also be used with the aid of electronic or other automated equipment capable of guaranteeing their security, and use may involve any operation or complex of operations detailed in art. 4 c. (1) (a) of the Law.
With regard to the data classified by the Law as sensitive (i.e. personal data which may reveal racial and ethnic origin, religious, philosophical or other beliefs, political opinions, membership of parties, trades unions, associations or organisations of a religious, philosophical, political or trades union nature, and personal data which reveal the individual's state of health or sex life) and judicial data (i.e. personal data which may reveal measures as defined by article 3 (1) (a-o, r-u) of Italian Presidential Decree no. 313 of 14 November, 2002, relating to criminal record, list of administrative penalties deriving from offences committed and the relative crimes recorded, or the status of accused or suspected party under articles 60 and 61 of the Italian Criminal Procedural Code) during the pursuance of its institutional aims, the University might acquire the following data:
a) data relating to diversely able students and/or family members or income data for the purpose of possible verification of self-certification relating to the payment of university fees and any exemption from the payment of university fees and/or access to any reductions granted by law, and data relating to the management of extraordinary grants for students' projects;
b) data relating to refugee status for access to exemptions and scholarships;
c) data relating to pregnancy, for the implementation of all necessary precautions to protect pregnant women, both for educational purposes, such as attendance at laboratory classes, and for access to any grants or benefits available by law;
d) data which may reveal political opinions or membership of parties, associations or organisations of a religious, philosophical, political or trades union nature, for requirements relating to the functioning of the University's internal electoral procedures;
e) sensitive and judicial data of relevance to disciplinary proceedings against students;
f) data relating to disabled status for interpreting, tutoring, transport and similar services for all handicapped students;
g) health data, necessary for assessment of the student's fitness, also by means of medical examinations by professionals appointed for the purpose by the University, and for safety purposes.
The aforesaid sensitive and judicial data relating to teaching activities and the management of students' enrolments and careers (including, if relevant, access to and residence in the university's student accommodation), acquired both from the data subjects and from third parties, are used by the competent Departments and/or Organisations, both on paper and on digital media.
3. The following are the main items of legislation under which the University is permitted to use sensitive and judicial data: Italian Royal Decree 1592/1933 and subsequent amendments and additions (Consolidation Law on Higher Education); Italian Royal Decree 1269/1938 and subsequent amendments and additions (Approval of regulations regarding students); Italian Presidential Decree 382/1980 (Reorganisation of university teaching, relative educational categories and trial of new methods of organisation and teaching); Italian Law 168/1989 (Creation of the Ministry Of Universities And Scientific And Technological Research); Italian Law 398/1989 (Regulations governing university scholarships); Italian Law 341/1990 (Reform of the university system); Italian Law 390/1991 (Legislation on the right to university education); Italian Law 104/1992 (Framework law for the assistance, social integration and rights of handicapped people); Italian Ministerial Decree 224/1999 (Regulations governing research doctorates); Italian Legislative Decree 445/2000 (Consolidation Law incorporating legislation and regulations on administrative documentation); Italian Law 148/2002 (Ratification and Implementation of the Lisbon Convention of 11 April 1997); Italian Ministerial Decree 270/2004 (Changes to the Regulations governing the teaching independence of Universities, approved by Ministry Of Universities And Scientific And Technological Research Decree no. 509 of 3 November 1999); Italian Presidential Decree 334/2004 (Regulations for the implementation of the consolidation law on immigration and the status of foreigners); Italian Ministerial Decree no. 142 of 25/3/1998 and Law no. 196 of 24 June 1997 (Regulations governing internships); Italian Prime Ministerial Decree 9 April 2001; Law no. 40 of 14 February 2003 (“Biagi Law", reforming the labour market); Current Socrates/Erasmus Institutional Contract; University Charter, University Teaching Regulations, Student Regulations and other current University Regulations; current Regional Laws on the right to university education.
4. The provision of personal data is compulsory and those refusing to provide them will be unable to establish and continue any relationship with the University.
5. Subject to the ban on the disclosure of health data, personal data may be communicated and disclosed to other public and private parties when this disclosure is necessary for the achievement of the University's institutional purposes and for all the activities related or instrumentation to these purposes.
The aforesaid data may also be disclosed to parties and organisations engaged in studies or activities for historic, statistical or scientific purposes, in all cases subject to the principles set out in point 2).
Sensitive and judicial data may be disclosed to the following parties: certifying departments for checking of the substitute declarations issued for the purposes of Italian Presidential Decree 445/2000, local authorities for the purposes of any grants for specific categories of students, Law Officers, the Ministry of Foreign Affairs, Police Stations, Embassies and Public Prosecutors' Offices with regard to residence permits, granting of specific statuses, Regions, other accredited or authorised public and private bodies and potential employers for the purposes of career guidance and work experience (pursuant to Italian Law 30/2003 on the reform of the labour market and subsequent implementations), insurance bodies for accident claims, Regional Management Bodies (Bodies with administrative and managerial independence, established under Italian Law 390/1991 on the right to university education) and other institutes to facilitate the international mobility of students, for financial benefit assessment and for the assignment of accommodation (Italian Law 390/1991 and the relevant regional laws)
6. Data provided will be conserved throughout the duration of the course of study and, if relevant, for the period of residence in Università Vita-Salute San Raffaele accommodation and also subsequently, if this is necessary for bureaucratic procedures related to or deriving from the law, obligations imposed by laws, regulations and EU regulations, and the instructions of the competent Authorities.
7. You may decide at any time to exercise your rights in relation to the Data Controller, in accordance with article 7 of the Data Protection Law, as listed below:

1. The data subject is entitled to obtain confirmation as to whether or not data relating to him are held, even if they have not yet been recorded, and the communication of the same in an intelligible form.
2. The data subject is entitled to obtain the following information:
a) the origin of the personal data;
b) the purposes and procedures of use of the data;
c) the logic applied in case of electronic processing of the data;
d) the identity of the data controller, the trustees and the representative designated under article 5, subsection 2;
e) the subjects or categories of subjects to which the personal data may be provided or which may become aware of the same as appointed representative, within the State, data supervisors or appointees.
3. The data subject is entitled to obtain:
a) the updating, correction and, when this is in his interest, the integration of the data;
b) the deletion, transformation into anonymous form or freezing of data used in breach of the law, including those the conservation of which is not necessary for the purposes for which the data were collected or subsequently used;
c) the certification that the amendment and deletion operations as per points a) and b) have been reported, also with regard to their contents, to those to whom the data have been communicated or distributed, unless this proves impossible or involves a disproportionate effort.
4. The data subject is entitled to oppose, completely or partially:
a) the use of the personal data relating to him, for legitimate reasons, even if such use is relevant to the purposes for which they were collected;
b) the use of personal data relating to him, in whole or in part, for the dispatch of advertising or mail order sales material, or for the performance of market research or business communications.
Università Vita-Salute San Raffaele