Our commitment to privacy
Privacy is at the core of our activities, and we are committed to handling data transparently, securely, and in accordance with current regulations.
The protection of personal data and the security of information represent regulatory obligations to which the ENAV Group must respond in relation to institutional activities, activities on the unregulated market and in line with strategic guidelines. The Group guarantees a correct management of data and of all the company's information assets, maintaining an active “privacy culture” and providing for the application of the Group's policies on the subject to all ENAV operations, including those with suppliers.
It is ENAV Group's will and precise commitment to identify and implement appropriate security measures for the protection of personal data in order to ensure an adequate level of security and to define roles and responsibilities in compliance with the relevant provisions of EU Reg. 2016/679 (GDPR), even where personal data are processed by third parties.
Personal data protection is part of the ENAV Group's broader information security management system, which is annually audited internally and externally, including for the purpose of maintaining ISO 27001 certification. In addition, the management of personal data is one of the issues covered in the Enterprise Risk Management process.
In order to ensure proper data management, specific roles and responsibilities have been assigned within the ENAV Group:
• The Privacy Management Organizational Structure is responsible for the management of the data protection-related requirements of EU Reg. 2016/679 and the relevant national legislation; it also facilitates risk assessment activities with respect to the privacy domain.
• The Data Protection Officer (DPO) of the ENAV Group provides the necessary support to the Data Controller with regard to personal data protection obligations as required by the GDPR (art. 39). In accordance with the provisions of the GDPR, the DPO acts with autonomy and independence and is endowed with a specific budget; in addition, for the conduct of the annual risk-based audit plan, the DPO uses appropriate synergies with the Internal Audit Structure.
For more information, see the Guidelines for Internal Control and Risk Management System (ICRMS).