Information on the processing of personal data in the context of INPS services rendered in a proactive manner

Introduction

In accordance with (EU) Regulation 2016/679 (hereinafter "EU Regulation"), INPS provides a description of the processing of personal data of the users concerned (hereinafter "data subjects") and how this is carried out to provide certain services, which the Institute can render, in a proactive manner, i.e. based on the terms better specified below.

The Institute intends to progressively promote the proactive offer of its services, in executing its institutional tasks, carried out in the public interest or in connection with the exercise of public powers conferred on it, in order to increase the visibility and accessibility of services to all users.

To this end, the Board of Directors, with Resolution no. 92 of 8 June 2022, has prepared some Guidelines that direct the exercise of proactive activities, to be understood as institutional purposes for INPS, identified in compliance with current legislation on the processing of personal data.

With this information, INPS, as controller, with registered office in Rome, via Ciro il Grande, 21, informs the data subjects that their personal data, provided directly by them or acquired from third parties in accordance with the law, are processed – for the purposes highlighted above for providing services - in compliance with the conditions and limits established by the EU Regulation and Legislative Decree no. 196 of 30 June 2003, as amended and supplemented, containing the "Code for the protection of personal data".

In this context, in particular, the personal data of the data subjects, including those belonging to the categories referred to in Articles 9 and 10 of the EU Regulation, are processed by INPS – as for the generality of processing in compliance with the legitimate legal bases and always in line with the purposes pursued in performing institutional functions in the field of social security, insurance, welfare, certification and verification, taxation, statistics and administration on a health basis - also having regard to the activity carried out by the Institute, as specifically aimed at identifying the users potentially beneficiaries of the assistance benefits and social security benefits provided by the same.

Participation in proactive services by the data subjects

The proactive provision of services by INPS must be authorised in advance by the user concerned.

For this purpose, the user who intends to use these services must express their participation in the service, exclusively by using the recognised authentication credentials such as SPID, CIE, CNS and, in the residual cases provided, online PIN (for residents abroad only), present in the section of the INPS portal: www.inps.it > MyINPS > Gestione consensi (Consent management).

Proactive services are functional to presenting the possibility of proposing a service request to the user.

In any case, in fact, the provision of benefits for INPS is always subject to the specific submission of the application by the data subject, according to the usual methods and through the channels dedicated to this, as a necessary step for initiating the relevant administrative procedure.

How to exercise the proactive function

Once the authorisation has been obtained by the user, the Institute exercises the proactive function in the following ways:

1. upon the occurrence of a certain event recorded in the available archives, which gives rise to the right to a social security or welfare benefit, it may notify or inform the user of the possibility of exercising the right or making the relevant claim;
2. in view of the perceived performance and of the requests for services or information made by the user, it may report or propose services or benefits:
   • that are additional;
   • that are accessed with requirements that coincide in whole or in part;
   • that perform the same function or address to the same type of needs
3. following the expression of a need by the user, it can report or propose services or benefits to meet the same.

Data types

For the purposes and activities related to the proactive offer of services, data in the Institute's possession may be processed, which have been acquired for the performance of institutional activities, even if they belong to the particular categories referred to in Articles 9 and 10 of the EU Regulation.

Description and method of processing

Since the individual proactive services are based on the collection and processing of user data, they determine a processing of personal data pursuant to Article 4, par. 1, of the EU Regulation.

The development of the service implies the progressive registration of the events that give rise to a right and the establishment of rules to identify data controllers with certainty or high probability.

Once the registered event has occurred, the available data referring to the users who have joined the service will be processed in order to verify the ownership of the right.

The user who is the potential owner of the right may be informed with a message (text message, notice on the IO App) or with a message in the MyINPS reserved area of the website. The information results from verifying, with feedback on the relevant and available databases, that the user with certainty or with a high probability is entitled to the benefit.

In any case, the provision of the benefit always follows the submission of an express application by the user, and INPS is in no way bound to proactively propose a service or to report the possibility of submitting an application for benefit, even if the conditions are met.

To this end, the Institute progressively creates a map of services, associating them on the basis of the following criteria:

1. relationship of complementarity between benefits;
2. sharing most of the requirements underlying the right (first of all the social security scheme);
3. statistical link (services that the user statistically uses together);
4. identity of the target audience.

Retention times for the results of the processing

The Institute retains the results of the processing (results from the activity of interconnection between the Institute's databases) for a maximum time of two years.

Profiling

The personal data used for the purposes referred to in this information are not subject to forms of processing that may result in the profiling of the data subjects pursuant to Article 4, no. 4 of the EU Regulation.

For any further information regarding the contents of this document, please refer to the document containing "Information on the processing of personal data of INPS users, pursuant to Articles 13 and 14 of (EU) Regulation 2016/679" directly available in this Privacy section.