Autonomous Province of Trento

Chat PaT

BETA

INFORMATION NOTICE

PURSUANT TO EU REGULATION NO. 679 OF 2016

European Regulation EU/2016/679 (hereinafter the “Regulation”) establishes rules relating to the protection of natural persons with regard to the processing of personal data. Articles 13 and 14 of the Regulation provide that the subject whose personal data is processed (the so-called data subject) must be duly informed about the processing itself.

This information notice concerns the functioning of the ChatPAT advanced interaction system and the methods for managing conversation data, with particular reference to the anonymization of any personal data communicated by users.

ChatPAT is a chatbot, a software that simulates a conversation, and is designed to simplify users' access to services offered by the Autonomous Province of Trento and the use of related information. Through the exchange of messages in natural language, the system identifies and proposes to the user the services that best meet their expressed needs.

The system generates responses using generative artificial intelligence (AI) technologies (Large Language Models) and information retrieval systems (RAG) based on vectorial embeddings.

The textual content proposed by the system is artificially generated by a machine, not by a human operator.

ChatPAT is limited to providing suggestions and referrals to the provincial catalog of services, and does not make any decision regarding a user's ability to use the service or not.

The user can at any time proceed to manual consultation of the provincial service catalog, by accessing it through the provincial web portal, at the link https://www.provincia.tn.it/Servizi.

It should be noted that ChatPAT does not request or require any personal data to guide the user within the service catalog. Any insertion of personal data into the chat by the user is to be considered totally spontaneous and not requested by the Data Controller. If the user still decides to enter personal data into the chat, these will be processed in compliance with current privacy legislation, in the manner described in this information notice. In particular, the Data Controller undertakes to minimize the processing of such data, in order to ensure full compliance with the principles set out in art. 5 of the Regulation, with particular reference to data minimization, purpose limitation and storage limitation.

The measure adopted consists of the instantaneous anonymization of personal data at the time of collection and the immediate discarding of original data, in compliance with the privacy by design and by default principle, and in coherence with the provisions of the relevant Guidelines 4/2019 on Article 25 of the European Data Protection Board. This process aims to make the data anonymous immediately after reception, ensuring that the processed information is no longer attributable to an identified or identifiable natural person. Only the anonymized data is transmitted to the artificial intelligence system that generates the responses, and then archived. Natural Language Processing (NLP) artificial intelligence technologies are used for data anonymization to automatically recognize and remove personal information. Before processing the request, the system automatically analyzes the text entered by the user to identify any personal data (such as names, surnames, tax codes, addresses, phone numbers, emails, etc.). Such information, if detected, is automatically removed or replaced with anonymous placeholders before the text is transmitted to the generative artificial intelligence systems for response production.

The original message containing personal data is immediately deleted after the anonymization process and is not stored in any system.

The Data Controller of personal data is the Autonomous Province of Trento (hereinafter, the "Controller"), in the person of its legal representative (President of the Province in office), with registered office in Piazza Dante n. 15, 38122 – Trento, contactable at the following addresses:

The Data Processor is the General Manager pro tempore of the Strategic Mission Unit for Digitization and Networks, with registered office in via Vannetti, 15 - 38122 Trento, contactable at the following addresses:

The Processor is also the person designated for feedback to the Data Subject in case of exercise of rights ex articles 15 – 22 of the Regulation.

The contact details of the Data Protection Officer (DPO), as the person identified by the controller to carry out control and consultancy functions, are: Piazza Dante n. 15 - 38122 Trento,

  • tel. 0461.494671
  • e-mail idprivacy@provincia.tn.it (indicate, in the subject: “Request for DPO intervention ex art. 38 EU Reg.”).

The processing of your personal data will be based on compliance with personal data protection legislation and, in particular, on the principles of fairness, lawfulness and transparency, storage limitation, according to which data must be kept in a form that allows the identification of Data Subjects for a period not exceeding the achievement of the purposes, except in exceptional cases, as well as minimization, according to which only personal data relevant and not excessive for the specific purposes of the processing may be collected and processed, in accordance with articles 5 and 25 of the Regulation.

1. SOURCE OF PERSONAL DATA

The ChatPAT advanced interaction service does not request or require any personal data to guide you through the catalog of digital services offered by the Autonomous Province of Trento. Your data is collected from the Data Subject (yourself) exclusively if you yourself, freely and spontaneously, communicate such data through the user interface.

2. PURPOSE OF PROCESSING AND LEGAL BASIS

We specifically indicate the purpose of processing and the legal basis that allows the processing of your data:

for the performance of a task carried out in the public interest / connected to the exercise of public powers vested in the Controller (art. 6.1, letter e), of the Regulation) and, in particular, to offer you the ChatPAT advanced interaction service, in order to:

  • guarantee your right to use simple and integrated digital public services,
  • ensure the completeness of information and the simplicity of consultation of the information contained in the Services section of the provincial web portal,
  • create a user-oriented public service offering free of obstacles that prevent equal access,
  • increase the quality and quantity of services provided to citizens, also through the use of artificial intelligence technologies,

pursuant to and for the purposes of:

  • Legislative Decree no. 82/2005, Digital Administration Code, articles 7, 53 and 64-bis;
  • Provincial Law no. 16/2012, Provisions for the promotion of the information society and digital administration and for the dissemination of free software and open data formats, articles 2 and 22-bis.

It is reiterated in any case that, for the purpose of providing the above services, the ChatPAT tool does not require personal data.

3. METHODS OF PROCESSING

Processing will be carried out with automated tools (IT/electronic) with logic designed to guarantee the confidentiality, integrity and availability of the data itself. Immediately after any insertion of personal data into the chat, the same will be anonymized. The system that anonymizes the data immediately discards any personal data. Only the anonymized message will be archived and transmitted to the system that generates the responses.

The processing of any personal data communicated by you is carried out exclusively through the automated tool responsible for anonymization. It should be noted that no operator or person in charge of processing by the Controller accesses, views or processes such data before or during the anonymization process and subsequent deletion.

Always for the indicated purposes, any personal data communicated by you will be processed by subjects who carry out instrumental activities for the Controller (IT service providers), who provide adequate guarantees regarding the protection of personal data and are appointed Data Processors ex art. 28 of the Regulation. The updated list of Processors can be consulted at our offices located in via Vannetti, 15 - 38122 Trento.

The data processor who processes your data is Trentino.AI S.c.a.r.l., with registered office in Trento Via Kufstein, 5, contactable at the following addresses:

4. AUTOMATED DECISION-MAKING PROCESSES AND PROFILING

The existence of a decision-making process based on automated processing, including profiling, is excluded.

5. COMMUNICATION AND DISSEMINATION OF DATA (CATEGORIES OF RECIPIENTS)

Data will not be communicated to any recipient, either before or after anonymization.

Data will not be disseminated, either before or after anonymization.

6. TRANSFER OUTSIDE THE EU

Data will not be transferred outside the European Union, either before or after anonymization.

7. DATA RETENTION PERIOD

We inform you that the retention period of your personal data following collection is almost instantaneous. In fact, data is anonymized immediately after collection. Only anonymized data is archived while the original message, containing any personal data, is immediately discarded.

8. DATA SUBJECT RIGHTS

You may exercise, against the Controller, through the aforementioned appointee, the rights provided for by the Regulation. It should be noted that, since the system archives exclusively anonymized data, the Controller holds your personal data exclusively during the instant necessary for anonymization. It is very likely that, at the time of exercising your right, the Controller will no longer be in possession of your personal data. For this reason, it may not be possible to satisfy your request. In any case, the Controller will proceed by providing all useful clarifications regarding privacy and system functioning.

For maximum transparency, your rights are listed below:

  • request access to your personal data and obtain a copy thereof (art. 15 Regulation);
  • if you consider them inaccurate or incomplete, request their rectification or integration, respectively (art. 16 Regulation);
  • if the regulatory conditions are met, request their erasure (art. 17 Regulation), or exercise the right to restriction (art. 18 Regulation);
  • if the regulatory conditions are met, object to the processing of your data (including any profiling) at any time, for reasons related to your particular situation (art. 21 Regulation).

Furthermore, at any time, you have the right to lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority).

9. COOKIES

ChatPAT does not use cookies, either its own or third-party ones. No technical, analytical, or profiling cookies are installed.