Privacy Notice on the processing of personal data of persons authorised to use collaboration tools

In accordance with the provisions of European and national data protection legislation, we hereby inform you that IVASS processes the personal data (surname, first name, telephone number) provided by users of the Collaboration Tools for the purpose of exchanging information within the Colleges of Supervisors and as part of the internal model approval process .

The processing of data, carried out in accordance with Regulation (EU) 2016/679 (GDPR), national legislation on the protection of personal data and the internal regulations adopted by IVASS, is necessary to enable access to and use of the Collaboration Tools in the context of:

• cooperation among National Supervisory Authorities across the European Economic Area and EIOPA;
• group supervision on insurance groups;
• joint decisions;
• investigation, assessment, approval and monitoring of Solvency II internal models;
• the additional requirements laid down by European legislation on insurance supervision.

The processing is therefore carried out for the following purposes: the performance of a task carried out in the public interest or in the exercise of official authority; a legal obligation.
Data is processed mainly by automated and electronic means exclusively by IVASS’ authorised staff, using appropriate security measures designed to ensure data confidentiality and to prevent unauthorised access.

Personal data will be retained for as long as necessary to fulfil the purposes for which they were collected and to protect the rights of the data subjects, and in any event for no longer than ten years.

Subject to the limits established by European and national legislation, data subjects may exercise, vis-à-vis the Data Controller (IVASS, Via del Quirinale 21, 00187 Rome, Italy; e-mail: divisione.organizzazione@ivass.it), their right of access to their personal data, as well as the other rights granted by law, including the right to obtain the rectification or completion of such data, their erasure, anonymisation or restriction where they have been processed unlawfully, and the right to object, in whole or in part, on legitimate grounds, to their processing.

The Data Protection Officer can be contacted at IVASS, Via del Quirinale 21, 00187 Rome – Italy, e-mail: DPO.IVASS@ivass.it.

Where they consider that the processing of their personal data infringes applicable law and the relevant conditions are met, data subjects have the right to lodge a complaint with Garante per la protezione dei dati personali, acting as the supervisory authority, in accordance with the applicable procedures.

Data subjects shall promptly communicate any amendments to or supplementation of the data provided.

Regulatory references

• Directive 2009/138/EC (Solvency II);
• Commission Delegated Regulation (EU) 2015/35;
• Commission Implementing Regulation (EU) 2015/460;
• Commission Implementing Regulation (EU) 2015/461;
• Commission Implementing Regulation (EU) 2015/2014;
• EIOPA Guidelines on the Operational Functioning of Colleges (2015);
• EIOPA Guidelines on Exchange of Information within Colleges (2015).