Data protection

Overview

The General Data Protection Regulation, 2018  gives individuals the legal right to privacy in relation to their personal data. The GDPR places obligations on organisations holding and processing such data.

 

Personal Data is any information relating to an identified or identifiable living person (data subject).  An identifiable person is one who can be identified, directly or indirectly, in particular, by reference to identifiers such as name, an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person (e.g. address, phone number, PRSI number, bank details etc.)

 

Special Categories of personal data (Sensitive data): this is a sub category of the above, requiring higher levels of protection and relates to racial, ethnic origin, mental or physical health, sexual orientation, trade union membership, religious or philosophical beliefs, criminal convictions or proceedings.

 

Data protection in Irish Lights

Irish Lights holds data on all employees, former employees, pensioners and customers/stakeholders either in manual files or electronically. This data can be personal or non-personal.

We treat all personal data as confidential and will use it only for the purposes that we obtain it. However, we may share data with other government departments or agencies when permitted by a specific legislative provision.  We may also need to share personal data with Third Party Data Processors who are processing data on behalf of Irish Lights.  All such Third Party Data Processors will be required to process the data in accordance with the GDPR.

We take our obligations very seriously and strive to ensure that we maintain the privacy of your personal data. Any employee found to be in breach of the data protection rules will be held accountable by Irish Lights.

 

How Irish Lights take care of your personal data

We fully commit to protecting your data as required under the General Data Protection Regulation, 2018. The GDPR requires that the management of personal data shall be:

• Lawful, fair, transparent: Personal data will be collected and used openly, fairly and lawfully, without causing unjustified harm or intrusion into someone’s private life.
• Specific, explicit, for a legitimate purpose: Irish Lights will clearly identify the specific purposes for collecting all personal data and will outline how Irish Lights intend to process it (e.g. how and why it is used).                                                                                    
• Data minimisation:  Data will be adequate, relevant and limited to what is necessary, ensuring that Irish Lights holds only enough information to do the job, but not anything that isn’t needed.
• Accurate and up to date:  Irish Lights will take reasonable steps to ensure that facts are correct.
• Kept no longer than necessary:  The Irish Lights Retention and Disposal Policy outlines the retention schedule.  Irish Lights will destroy any personal data that is no longer needed.  Retained information is reviewed regularly to ensure that details are up to date, relevant and not excessive.
• Processed Securely:  kept safely and securely.

Rights of Data Subjects

The GDPR gives individuals greater control over their personal information by setting out clearly defined privacy rights. All data subjects, including children, have the:

• Right to be informed: to receive certain information on the collection of personal data in the form of a Privacy Notice (see Data Protection Policy)
• Right to access personal information an organisation holds on an individual
• Right to rectify inaccurate personal data
• Right to erasure of personal data if given by consent and/or it is inaccurate or unnecessary
• Right to restrict processing of personal data if given by consent and/or it is inaccurate or unnecessary
• Right to data portability: to have data sent to the individual or another organisation
• Right to object: to any uses or disclosures of personal data that are not (i) required by law, (ii) necessary for the fulfilment of a contractual obligation, (iii) required due to vital interests, (iv) required to perform a public task or (v) the data is being processed based on consent (where applicable). Irish Lights will seek a reasonable accommodation where an objection is received. An individual may withdraw consent at any time in relation to processing of personal information if it is based on consent.
• Right to object: to direct marketing & profiling or automated decision making

 Information we process with your consent

Irish Lights limits the use of consent as a legal basis for processing data. An example of where consent is the legal basis for processing data would be us sending information about Irish Lights to customers who have consented for marketing or PR purposes.

It should be noted that sometimes you may implicitly give your consent to us to process information that may be personal information, an example would be when you send us a message by e-mail asking for us to provide information about our business or a job opportunity, i.e. you reasonably expect us to respond.  

We will always strive to maintain the privacy of your personal data. If you have any concerns that a security breach has or may have occurred in relation to your personal data, please contact our Data Protection Officer: DPO@irishlights.ie

 

Do we share personal data with others?

Irish Lights is obliged to protect the confidentiality of personal data held. We fully commit to safeguarding data given to us from use or disclosure, except as provided for by law. We may share your data with third parties when permitted by a specific legislative provision to do so.

Keeping your personal data safe

We employ high standards of physical and technical security to protect the confidentiality of your personal data. All staff are aware of the standard of data security expected of them. We restrict access to data to authorised staff. Staff access rights extend only to the data necessary to carry out their appointed duties.

Any employee found to be in breach of the data protection rules will be held accountable by Irish Lights.

We are obliged under a wide range of legislative and administrative provisions to protect the confidentiality of official data. This includes the protection of records against unauthorised access, unnecessary use, alteration, destruction or disclosure.

 

Making a request under the Data Protection Acts

You are entitled to request data held about yourself. There are exceptions to this. Please refer to Data Protection Commissioner website for more information Exceptions to the Right of Access

 

Irish Lights will provide this data within one month*. There is no charge for requesting this.  You must make a request directly to the Data Protection Officer in writing.  DPO@irishlights.ie

*If the request is complex or if there is a large number of requests at one time, the response period may be extended by a further two months.

Before personal data can be provided, we must verify your identity.  To help us deal with your request more quickly, you should include sufficient details so that we can identify you.

 

Can someone make an access request on your behalf?

In some instances, yes. If, for example, a solicitor is making a request on behalf of their client then the request can be complied with, with signed authorisation from their client. In general, an individual can only make an Access Request for their own personal data.

 

Appealing a refusal

You can appeal against a refusal for access to your data directly to the Data Protection Commissioner.

Before doing so, we recommend that you contact us to establish the circumstances and to indicate your intention to appeal to the Commissioner. If we refuse your request we will refund the fee to you.

 

Rectifying your personal data

We make every effort to ensure that your personal data is accurate and up to date.

If you think that your personal data is not accurate or relevant you can contact us either in writing or by email. You should set out clearly the personal data involved and the reasons why you consider it to be inaccurate and or irrelevant.

We will amend the data within 30 days or explain to you why we will not do so. There is no fee for this service.

You can amend your personal details by emailing our Data Protection Officer: DPO@irishlights.ie

 

Reporting suspected unauthorised access to your personal data

You can contact us by email if you have concerns that a data breach has occurred in relation to your personal data. Contact our Data Protection Officer:  DPO@irishlights.ie

We will investigate the matter fully and notify you of the outcome as soon as possible.

 Irish Lights Data Protection Policy

Irish Lights has a Data Protection Policy in place. We are committed to complying with our legal obligations under the Data Protection Acts and ensuring that individuals are aware of their rights.

 Who do I contact about data protection?

If you have any enquiries concerning Data Protection in Irish Lights, you can contact our Data Protection Officer: Rosaleen McCarthy, Head of Human Resources by email on DPO@irishlights.ie or by phone at 01 271 5425.

The Data Protection Commissioner's website explains your rights and responsibilities under the Data Protection Acts.