Information for professors, researchers, professional staff and collaborators

Processing for the purposes of managing employment relationships

Specific processing purposes and methods

Personal data, including special categories of data (such as data regarding any health condition, membership of trade unions or similar organisations, political opinions or religious beliefs, conscientious objections, opinions on animal experiments, criminal convictions) are processed for the purposes of performing work and institutional tasks and duties as of the date of appointment up to the date of termination of the work relationship with the personnel (teachers, researchers, professional staff, research fellows, language assistants and collaborators, including those working under special work agreements).

In particular, data will be processed in the following areas:

• management of career events, progression, appraisals, appointments, qualifications and honorary titles, internal and external mobility, non-institutional appointments, pensions and post-employment benefits;
• management of activities strictly related to the performance of individual duties (for example: participation in thematic groups, projects/events, processing data within the scope of agreements for which the individual is the point of contact, performing activities on behalf of third parties, annual planning of objectives and projects, management of part of the budget, recording audio/video materials for institutional lessons or events, sending communications in order to promote awareness of institutional information, etc.);
• remuneration (payment of salaries, management of luncheon vouchers, provisions for grants and benefits) and management accounting for procedures concerning the data subject (including pay, grants, missions, business trips, reimbursement of expenses for the publication of scientific articles or for customs clearance operations);
• recording and management of attendance and the related information (including working hours and clocking in/out data, transport between university sites, missions, time off and leave for maternity and other reasons, participation in strikes and trade union meetings);
• counselling and inclusion services; 

• staff appraisals, including in relation to, for example, the quality of teaching, research and other academic activities (assessing the quality of the work performed by professional staff, managing the learning catalogue, etc.);
• management of insurance and social security administrative tasks;
• healthcare; 
• accident reports and related administrative tasks;
• setting objectives and planning projects, for the purposes of staff assessment, financial planning and preparation of the budget.

Legal basis of the processing and nature of the provision of data

The legal basis for the data processing is found in:

• article 6, paragraph 1, letters b) (processing necessary for the performance of a contract), c) (processing in order to comply with a legal obligation) and e) (processing carried out in the public interest) and article 9, paragraph 2, letters b) (processing required by law) and g) (processing for reasons of substantial public interest) of Regulation (EU) 2016/679;
• the following sources of law: Presidential Decree (D.P.R.) 445/2000 “Consolidating act on the legislative and regulatory provisions governing administrative documentation”; Law 335/1995 “Reform of the mandatory and supplementary pension system”; Law 152/1968 “New provisions on social security for staff employed in local bodies”; D.P.R. 461/2001 “Regulation simplifying the procedure with regard to the recognition of work-related illnesses for the purposes of awarding standard injury benefits and compensation, and with regard to the functioning and composition of the standard injury benefits committee”; D.P.R. 1124/1965 “Consolidated provisions on mandatory insurance against occupational accidents and diseases”; D.P.R. 334/2004 “Regulation amending D.P.R. 394 of 31 August 1999 concerning immigration”; art. 21 of the national collective bargaining agreement (CCNL) of 06 July 1995, the sector-specific CCNL with regard to the data processed in relation to medical visits at the home of the sick or injured employee (visite fiscali); Law 68/1999 “Provisions on the right to work of disabled persons”; Law 300/1970 “Provisions on the protection of the freedom and dignity of workers, the freedom of association and of union activity in the workplace, and provisions on job placement”; Ministerial Decree 164/1999 “Regulation on tax assistance provided by Tax Advice Centres for companies and employees, and by withholding agents and professionals, in accordance with article 40 of Legislative Decree 241 of 9 July 1997”; D.P.R. 600/1973 “Common provisions on income tax assessments”; D.P.R. 180/50 “Approval of the consolidated act on the attachment, seizure and assignment of stipends, salaries and benefits of public sector employees”; D.P.R. 895/50 “Approval of the new regulations for the implementation of the new consolidated act on the attachment, seizure and assignment of stipends, salaries and benefits of public sector employees”; Decree of the Ministry of Labour dated 12 July 2007 “Application of the provisions set out in articles 17 and 22 of Legislative Decree 151 of 26 March 2001 on the protection and support of maternity and paternity in relation to workers registered for the separate management of social security contributions as referred to in article 2, paragraph 26 of Law 335 dated 8 August 1995”; Legislative Decree 165/2001 “General provisions on the employment of public sector workers”; CCNL for the 2016-2018 period, signed on 19.04.2018, representing the National Collective Bargaining Contract for Education and Research Personnel. Any matter not covered by the aforementioned contract shall be subject to the provisions contained in previous CCNLs for the University sector (CCNL for the 2006-2007 period signed on 16 October 2008 and CCNL for the 2008-2009 period signed on 12 March 2009) regulating employment contracts; Law 191/1998 “Amendments to Law no. 59 of 15 March 1997 and no. 127 of 15 May 1997, as well as the provisions on the training of public sector employees and remote workers. Provisions on school buildings”; D.P.R. 70/1999 “Regulation laying down provisions on remote working in the public sector, in accordance with article 4, paragraph 3 of Law no. 191 of 16 June 1998”; Law 53/2000 “Provisions on maternity and paternity, the right to healthcare and training, and the coordination of urban time plans and policies”; Framework Agreement dated 23/03/2000 on remote working in the public sector; art. 23 of the CCNL of 16/10/2008 for the university sector; art. 28 of the CCIL 2016; directive of the Department of Public Administration no. 3 of 2017 concerning the processing of data in cases where the work is performed by professional staff remotely; D.P.R. 382/1980 with regard to the careers of teaching staff; Law 230/2005 New provisions on university professors and researchers and delegation of powers to the Government to reform the recruitment of university professors; Law 240 of 30 December 2010 “Provisions on the organisation of universities, academic staff and recruitment, and delegation of powers to the Government to incentivise quality and efficiency in the university system”; art. 67, paragraph 1, letter a) of the CCNL for Education and Research of 19 April 2018 regulating the management and disbursement of economic benefits to professional staff and language assistants employed on permanent and temporary contracts at the Alma Mater Studiorum - University of Bologna; Rector’s Decree 21/2014 of 10 January 2014 “Regulation concerning missions, travel and the relative reimbursement of expenses”.

The provision of personal data is compulsory. Refusal to provide the data would make it impossible to establish a professional relationship with the University and/or to fulfil the institutional tasks and duties related to the role covered.

Recipients

In addition to the recipients mentioned in the general privacy policy, the data may also be sent to:

• INPS (for the disbursement and payment of pensions and for the purposes of managing the separate social security scheme applicable in Italy for self-employed and temporary contract workers; Law 335/1995; Law 152/1968); 
• the Ministry of Economy and Finance, with specific regard to the Committee for verification of work-related illnesses and the competent local medical committee (with regard to the procedure for recognition of work-related illnesses and award of fair compensation, in accordance with D.P.R. 461/2001);
• INAIL, law enforcement authorities, the Immigration Office (D.P.R. 334/2004) and/or other authorities provided for by law (to report accidents, D.P.R. 1124/1965), Italian Inland Revenue Agency;
• the competent health authorities (for medical visits, art. 21 CCNL of 06 July 1995, CCNL for the sector and/or with regard to the procedures concerning staff working under special agreements); 

• public and private parties who, in accordance with regional/provincial laws, have been engaged to provide staff training services;
• Local Labour Office (with regard to leave);
• Job centre or competent local body for employment in accordance with Law 68/1999; 
• provincial authorities and regional job centre with regard to information on job appointments and terminations as well as changes to the employment contract, drafted in accordance with Law 68/1999; 
• trade union organisations in order to fulfil the requirements related to the payment of membership fees and managing leave for union business; 

• the Ministry of Finance, in relation to the University’s role as a Tax Assistance Centre (CAF) and to employee income tax returns;
• public and private bodies in relation to the procedures concerning salary-backed loans (cessione del quinto) and small loans in accordance with D.P.R. 180/50 and 895/50, as amended;
• other public administrations in cases of secondment or appointment of an employee to the same or to the University of Bologna;
• police stations with regard to the issue of permits of stay;
• banks in order to pay salaries and/or reimbursement of expenses;
• the Department of Public Administration for the purposes of fulfilling the requirements related to the database of public sector employees and consultants (Legislative Decree 165/2001);
• the Court of Auditors in relation to the expenditure records referred to in art. 1, paragraph 173 of Law no. 266 of 23 December 2005;
• MIUR, in order to fulfil the requirements related to the management of careers and of the workforce rating of teachers and researchers for benchmark purposes (punti organico);
• public and/or private third parties who receive the data, after obtaining the express consent of the data subject or as a consequence of the data subject registering for a specific initiative organised in collaboration with said third parties, to support the start and/or participation in activities of significant public interest;
• third parties appointed as Data Processors pursuant to art. 28 of Regulation (EU) 2016/679 to assist the University in managing its information systems and services;
• third parties appointed as Data Processors pursuant to art. 28 of Regulation (EU) 2016/679 to provide the University with specific support in managing its institutional activities.

Transfer of data outside of the EU and the conditions applicable to the transfer

In addition to the cases provided for in the general privacy policy, the personal data collected may be transferred to a country outside of the European Economic Area (EEA, namely the EU + Norway, Liechtenstein and Iceland) in cases:

• of periods of training or worked carried out abroad by staff or delivered by foreign third parties, within the scope of activities strictly related to the performance of their duties;
• where a VISA or other documents are required for the purposes of missions undertaken outside of Europe (registration for conferences, booking accommodation, etc.). 

Data retention period

All documents containing the personal data of teachers, researchers, research fellows, professional staff and collaborators that are necessary in order to have a record of important legal, organisational and economic events concerning anyone who works or has worked for the University are retained indefinitely. The retention period for the remaining data depends on the administrative documents in which they are contained and/or on the relative legal requirements (for example, ten years in order to comply with statutory tax and accounting requirements).

Personal data processing necessary for the design and management of research, internationalisation and development cooperation projects

Specific processing purposes and methods

Personal data is processed, in particular, for the following purposes:

 

• to facilitate communication and promote collaboration in the science and technology field, both internally and with third parties who collaborate on research, internationalisation and development cooperation projects at the national, European and international levels; - to manage the funding activities related to research, internationalisation and development cooperation from the project/proposal definition stage through to launch and conclusion of the project;
• to ensure scientific education within the scope of projects that provide for training for new researchers;
• to sign agreements, memorandums of understanding, conventions and related protocols in order to govern confidentiality and/or to allow, among other things: the submission of applications in order to verify that the funding competition requirements are met; the negotiation and signing of agreements with project promoters (if external); the issue of invoices/accounting notes and collection of the relative payments; the payment of University staff salaries; the participation of third parties in working groups or expert panels (for example, advisor board) envisaged in the project.

• for reporting and, where applicable, auditing purposes;
• to fulfil the requirements of the laws in force governing the initiation and performance of research, internationalisation and development cooperation projects (for example, with regard to drafting a research project for submission to the competent local Ethics Committee and drafting a project document in accordance with the provisions on personal data protection).

Legal basis of the processing and nature of the provision of data

The legal basis for the above data processing is found in:

• art. 6, paragraph 1, letter c) (processing necessary for compliance with a legal obligation) of Regulation (EU) 2016/679;
• art. 6, paragraph 1, letter e) (processing necessary for the performance of a task carried out in the public interest) of Regulation (EU) 2016/679;
• art. 9, paragraph 2, letter g) (processing necessary for reasons of substantial public interest) of Regulation (EU) 2016/679;
• the sources of law that govern the university research sector (Law no. 210/1998, as updated by Law no. 240 of 30 December 2010 "Provisions on the recruitment of permanent university researchers and professors"; articles 4 and 7 of Law no. 398/1989 "Provisions governing university grants"); professional ethics rules governing processing for statistical or scientific research purposes published on 19 December 2018 in accordance with art. 20, paragraph 4 of Legislative Decree no. 101 dated 10 August 2018; provisions governing the processing of special categories of data, in accordance with art. 21, paragraph 1 of Legislative Decree no. 101 of 10 August 2018; Legislative Decree 196/03, as amended.

Recipients

In addition to the recipients mentioned in the general privacy policy, the data may also be sent to:

• the Executive Agency or another public/private funding body (MIUR, Regions, EU, etc.) that announces a call for applications;
• entities involved in the promotion of European programmes;
• public or private parties with whom collaboration regarding research, internationalisation and development cooperation has been initiated;
• bodies/associations/external auditors that may be involved in evaluating the competitive procedure;
• auditing firms that have been engaged to perform an audit;
• ANVUR (in relation to data analysis and evaluation of the quality of research and teaching);
• Competent local Ethics Committee or other Ethics Committees of trial centres in cases where the University is the promoter;
• authorising body (Istituto Superiore di Sanità (Higher Institute of Health), Italian Pharmacy Agency, Ministry of Health, etc.);
• with regard to research and reporting activities, to funding bodies/executive agencies or companies engaged by the funding body;
• third parties appointed as Data Processors pursuant to art. 28 of Regulation (EU) 2016/679 to assist the University in managing its information systems and services or in statutory audit activities in the case of funded projects.

Transfer of data outside of the EU and the conditions applicable to the transfer

In addition to the cases provided for in the general privacy policy, the personal data collected may be transferred to a country outside of the European Economic Area (EEA, namely the EU + Norway, Liechtenstein and Iceland) in cases in which the partner companies or organisations are resident outside of the EU. This transfer is provided for, in the absence of an adequacy decision pursuant to article 45, paragraph 3, or of adequate guarantees pursuant to article 46, when it is necessary for reasons of substantial public interest (art. 49, paragraph 1, letter d) of Regulation (EU) 2016/679) and/or in application of art. 100 of Legislative Decree 196/2003, as amended.

Data retention period

All documents containing the personal data of teachers, researchers, research fellows, professional staff and collaborators that are necessary in order to have a record of important legal, organisational and economic events concerning anyone who works or has worked for the University are retained indefinitely. The retention period for the remaining data depends on the administrative documents in which they are contained and/or on the relative legal requirements (for example, ten years in order to comply with statutory tax and accounting requirements).

Processing to ensure the analysis, monitoring and evaluation of research, third mission activities and organisational performance of the University

Specific processing purposes and methods

Personal data, including special categories of data (data related to a person's health in the event of exemption or reduction of the output evaluated in the period concerned or to political engagements in cases of leave) are processed for the purposes of:

• analysis, monitoring and guiding the research cycle, third mission and organisational performance of the University;
• validation/attestation and processing of the data related to scientific research (regarding for example: output, resources, career) and third mission activities, also in order to make them available, in accordance with international standards, to third parties (ministerial structures, international technological platforms, etc.), as well as to persons within the University who process the data to evaluate the research cycle, third mission activities and organisational performance of the University;
• evaluation of the individual researchers or structures (VRA - performed by the University for monitoring purposes and in order to allocate research funding and human resources);

establishing a sole point for the collection and validation of research and third mission data, in accordance with international standards, which can then be distributed in aggregate form or otherwise to various applications, both ministerial and internal to the University (teaching website LoginMiur, MIUR evaluation procedures, departmental pages, other public websites).

Legal basis of the processing and nature of the provision of data

The legal basis for the data processing is found in:

• articles 6, paragraph 1, letters e) (processing carried out in the public interest) and 9, paragraph 2, letter g) (processing for reasons of substantial public interest) of Regulation (EU) 2016/679;
• the following sources of law: art. 1-ter of Law no. 43 of 31 March 2005 "Conversion into law, with amendments, of Decree Law no. 7 of 31 January 2005, setting out urgent provisions on university and research, cultural assets and activities, the completion of strategic works and the mobility of public sector employees, as well as on simplifying the requirements relating to stamp duty and government concession tax. Rectification of the effects of article 4, paragraph 1 of Decree Law no. 280 of 29 November 2004"; articles 1, 5, 24 and 29 of Law 240/2010 "Provisions governing the organisation of universities, academic staff and recruitment, as well as the Government mandate to incentivise the quality and efficiency of the university system"; art. 2 paragraph 138 of Law 286/2006 "Conversion into law, with amendments, of Decree Law no. 262 of 3 October 2006, setting out urgent tax and finance provisions"; Ministerial Decree 344/2011 "Criteria according to which universities shall evaluate fixed-term assistant professors in possession of the national qualification, for the purposes of being called to fill the role of associate professor"; art. 3, letters i) and i-bis) of D.P.R. (Presidential Decree) no. 76 of 1 February 2010 "Regulations concerning the structure and operation of the National Agency for the Evaluation of Universities and Research Institutes (ANVUR)"; Rector's Decree 1021/2013 "Regulation of the University Research Evaluation Committee"; Rector's Decree 666/2018 "Regulation of the University's Third Mission Observatory".

Recipients

In addition to the recipients mentioned in the general privacy policy, the data may also be sent to:

• ANVUR;
• third parties appointed as Data Processors pursuant to art. 28 of Regulation (EU) 2016/679 to assist the University in managing its information systems and services (including: CINECA).

Transfer of data outside of the EU and the conditions applicable to the transfer

The personal data collected are not transferred to a country outside of the European Economic Area (EEA, namely the EU + Norway, Liechtenstein and Iceland) except in cases where the data are subject to disclosure due to legal requirements or the request of the data subject.