Institutional portal - Municipality of Milan

Privacy information for the Street Hive survey procedures in the Municipality of Milan from 27 March 2023 to 7 April 2023.

Pursuant to art. 13 of EU Regulation no. 2016/679 (General Regulation on the Protection of Personal Data), the following information is provided:
Joint Data Controller

• The joint data controller is the Municipality of Milan with headquarters in Piazza della Scala, n. 2 – 20121 Milan. 

The specific references are: 

• Technological and Digital Innovation Directorate (ited@comune.milano.it)
• The joint data controller is Cyclomedia Technology BV, with headquarters in Van Voordenpark 1b, 5301 KP Zaltbommel - NL

The aforementioned subjects have signed a joint ownership agreement, the extract of which is available at the offices of the joint controllers, with the aim of defining, pursuant to art. 26 of Regulation (EU) 2016/679 (hereinafter, “GDPR”), the purposes and means of the processing.
Data Protection Officer (DPO) 
The Municipality of Milan has appointed its own Personal Data Protection Officer who can be contacted at the e-mail address: dpo@comune.milano.it.

Purpose and legal basis
The data processing is aimed at carrying out the survey of the municipal territory using photographic instruments and laser scanners in order to incorporate the technical information necessary for the possible acquisition of this equipment in the Administration's assets.
Any personal data collected during the survey of the territory are processed in compliance with the conditions established by EU Regulation 2016/679 and in particular: 

• from art.6-par.1 letter. e) of EU Regulation 2016/679, by art. 2 ter of Legislative Decree 196/2003 “Personal data protection code” and by the following rules:
• CAD – Digital Administration Code: brings together and organizes the rules regarding the computerization of the Public Administration in relations with citizens and businesses in the national territory. (Established: Legislative Decree 7 March 2005, n. 82; modified and updated in Legislative Decree 13 December 2017, n. 217)

        ◦ Budget Law 2020 and Legislative Decree no. 162 of 2019
        ◦ Cura Italia Decree (DL no. 18/2020), then Law no. 27/2020
        ◦ Legislative Decree no. 76/2020
        ◦ Legislative Decree no. 77/2021
        ◦ Legislative Decree no. 34/2020 (so-called relaunch decree)
        ◦ Legislative Decree 1 March 2021, n. 22

Type of data processed

Interested
The personal data concerns the following categories of interested parties:
• Natural persons visible from the public road
• Residents or owners of real estate
• Owners of registered vehicles

Categories of personal data
Street-level imagery can include:
• Recognizable faces 
• Biometric data
• Vehicle license plates
• House numbers

Methods of data processing
The processing takes place in compliance with fundamental rights and freedoms and is based on the principles of correctness, lawfulness, transparency and protection of confidentiality. It is also carried out with the aid of electronic instruments consistently with the operations indicated in the art. 4, point 2, of EU Regulation 2016/679.

Nature of treatment
Data collection takes place automatically in accordance with art.6-par.1 letter. e) of EU Regulation 2016/679, by art. 2 ter of Legislative Decree 196/2003, “Code regarding the protection of personal data”. The collection takes place in automatic mode with the recording of the urban environment through the use of particular cameras capable of generating spherical photographs, furthermore a Laser Scanner instrument better identified as a LiDAR sensor capable of generating the point cloud with density of approximately 1.000 points/mXNUMX. The result of the survey will be wired and automatically sent to a data center in the EU territory according to the logic of Cloud Computing and will be processed in order to make faces, license plates and any other element of personal identification characteristics unidentifiable. This anonymization will be carried out with the blurring technique.
Communication and dissemination of personal data.
The data collected is appropriately anonymized with automatic procedures for obscuring faces, license plates and any other personal reference. The raw survey data is stored by the Cyclomedia Joint Controller at its data centers which comply with the dictates of the GDPR as declared in the joint ownership document described above. The anonymized data will only be accessible to the technicians of the Municipality of Milan and the technicians of Cyclomedia BV and will not be disclosed to third parties.

Categories of data recipients
The processing is carried out by authorized persons committed to confidentiality and responsible for the related activities in relation to the purposes pursued. The data processing is also carried out by AMAT SRL VAT number 12908910156 who assume the function of Data Controllers pursuant to art. 28 of EU Regulation 2016/679.

Data retention
The raw data will be stored by the Joint Controller Cyclomedia BV according to the methods declared in the relevant Privacy agreement for the time necessary to achieve the purposes for which they were collected and in any case for the period envisaged by the provisions regarding the conservation of technical administrative documents and documents. The anonymized data will be available for 180 days following the end of the field experimentation in order to prepare the necessary technical checks; beyond this period the data will be destroyed.

Data transfer to third countries
The data processed for the aforementioned purposes are not transferred to third countries outside the European Union or the European Economic Area (EEA) or to international organisations.

Organization of the activity
The car used for the aforementioned survey will be prepared with the use of appropriately visible signs placed on the side windows, on the visible dashboard and on the rear panel. The sampling will be carried out during daylight hours and will concern some areas of the municipal territory with particular reference to the areas subject to large construction sites, to the perimeter and internal area of ​​the construction site called MIND (Former EXPO Area), near the disused railway yards.

Rights of interested parties
Interested parties can exercise the rights provided for by the art. 15 and following of EU Regulation 2016/679 and in particular the right to access one's personal data, to request rectification or limitation, updating if incomplete or incorrect and cancellation if the conditions exist as well as to oppose the processing by contacting the request to:
Municipality of Milan as Co-Owner, Via Gian Battista Vico 18:

• Technological and Digital Innovation Directorate (ited@comune.milano.it)

or

• to the Personal Data Protection Officer of the Municipality of Milan (Data Protection Officer - “DPO”) dpo@Comune.Milano.it

Right of complaint
Finally, we inform you that interested parties, if they believe that the processing of personal data relating to them occurs in violation of the provisions of EU Regulation 2016/679 (art. 77) have the right to lodge a complaint with the Guarantor, (garanteprivacy.it) or to take action in the appropriate judicial offices (art. 79 of the Regulation).