GDPR

Kildare Education Support Centre

DATA PROTECTION POLICY

1 Purpose and Scope. 2

2 Processing Principles. 2

3 Lawful Basis for Processing Personal Data. 3

4 Processing Activities Undertaken by the Centre. 4

5 Recipients. 5

6 Personal Data Breaches. 6

7 Data Subject Rights. 6

Appendix 1. Glossary. 9

Appendix 2. Personal Data and related Processing Purposes. 10

Appendix 3. Categories of Recipients. 14

Appendix 4. Implementing the Data Processing Principles. 16

Appendix 5. Managing Rights Requests. 22

Appendix 6. Reference sites. 24

Purpose and Scope

• The purpose of this Data Protection Policy is to support the Centre in meeting its responsibilities with regard to the processing of personal data. These responsibilities arise as statutory obligations under the relevant data protection legislation. They also stem from our desire to process all personal data in an ethical manner which respects and protects the fundamental rights and freedoms of natural persons.
• This policy aims to help transparency by identifying how the Centre expects personal data to be treated (or “processed”). It helps to clarify what data is collected, why it is collected, for how long it will be stored and with whom it will be shared.
• The Irish Data Protection Act (2018) and the European General Data Protection Regulation (2016) are the primary legislative sources.[1] As such they impose statutory responsibilities on the Centre as well as providing a number of fundamental rights (for course participants, tutors and staff and others) in relation to personal data.
• The Centre recognises the seriousness of its data processing obligations and has implemented a set of practices to safeguard personal data. Relevant policies and procedures apply to all Centre staff, Management Committee members, tutors, facilitators. Course participants, National programme personnel (applicants for staff positions within the Centre).
• Any amendments to this Data Protection Policy will be communicated through the Centre website and other appropriate channels, including direct communication with data subjects where this is appropriate. We will endeavour to notify you if at any time we propose to use Personal Data in a manner that is significantly different to that stated in our Policy, or, was otherwise communicated to you at the time that it was collected.
• The Centre is a data controller of personal data relating to its past, present and future staff, tutors, workshop and course participants, participants at PDST and other National Programme in-service, and other members of the Centre community. Formally, the statutory responsibility of Controller is assigned to the Management Committee of Kildare Education Support Centre. The Director is assigned the role of co-ordinating the implementation of this Policy and for ensuring that all staff who handle or have access to Personal Data are familiar with their responsibilities.

Name Responsibility

Management Committee Data Controller

Director Data Champion / Data Compliance and Implementation of Policy

All Staff Adherence to the Data Processing Principles

Entire ESC Community Awareness and Respect for all Personal Data

1 Processing Principles

• • Processing is the term used to describe any task that is carried out with personal data e.g. collection, recording, structuring, alteration, retrieval, consultation, erasure as well as disclosure by transmission, dissemination or otherwise making available. Processing can include any activity that might relate to personal data under the control of the Centre, including the storage of personal data, regardless of whether the records are processed by automated or manual means.
  • There are a number of fundamental principles, set out in the data protection legislation, that legally govern our treatment of personal data. As an integral part of its day to day operations, the Centre will ensure that all data processing is carried out in accordance with these processing principles.
  • These principles, set out under GDPR, establish a statutory requirement that personal data must be:
    • processed lawfully, fairly and in a transparent manner (lawfulness, fairness and transparency);
    • collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes (purpose limitation);
    • adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (data minimisation);
    • accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (accuracy);
    • kept for no longer than is necessary for the purposes for which the personal data are processed[2]; (storage limitation);
    • processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (integrity and confidentiality).
  • GDPR also establishes Accountability as a core data processing principle. This places a statutory responsibility on the Centre, as Data Controller, to be able to demonstrate compliance with the other principles i.e. the 6 data processing principles set out in the previous paragraph (2.3 above).

2 Lawful Basis for Processing Personal Data

• • Whenever the Centre is processing personal data, all of the principles listed in the previous section(s), must be obeyed. In addition, at least one of the following bases (GDPR Article 6) must apply if the processing is to be lawful,
    • compliance with a legal obligation
    • necessity in the public interest
    • legitimate interests of the controller
    • contract
    • consent
    • vital interests of the data subject.
  • When processing special category personal data, the Centre will ensure that it has additionally identified an appropriate lawful basis under GDPR Article 9.[3] Special categories of personal data are those revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

3 Processing Activities Undertaken by the Centre

• • Record of Processing Activities This policy sets out the purposes for which the Centre collects and uses personal data for each of the various categories of data held Centre Employees , Course participants etc).
  • Centre Employees: As well as records for existing members of staff (and former members of staff), records may also relate to applicants applying for positions within the Centre, local Initiaives and for DE Support Service programmes. The purposes for which staff personal data is processed include the following:
• the management and administration of Centre business (now and in the future);
• to facilitate the payment of staff, and calculate other benefits/ entitlements (including reckonable service for the purpose of calculation of pension payments, entitlements and/or redundancy payments where relevant);
• to facilitate pension payments in the future;
• human resources management;
• recording promotions made (documentation relating to promotions applied for) and changes in responsibilities etc.;
• to enable the Centre to comply with its obligations as an employer including the preservation of a safe, efficient working environment (including complying with its responsibilities under the Employment Act 2018 and Safety, Health and Welfare at Work Act. 2005);
• to enable the Centre to comply with requirements set down by the Department of Education, the Revenue Commissioners and any other governmental, statutory and/or regulatory departments and/or agencies;
• for compliance with legislation relevant to the Centre.
  • Local Course Participants / PDST and other National Programme Participants : The purposes for processing participant personal data include the following:
• to provide information necessary to register for CPD ;
• to deliver CPD appropriate to the needs of the participant ;
• to log and record attendance at CPD events
• to alert members of the Education community to upcoming Relevant CPD
• to communicate information about, and record participation in, Centre events;
• to comply with legislative or administrative requirements e.g. Audit , Health and Safety etc.

• Management Committee of Kildare Education Support Centre: Personal data of Management Members is processed to ensure that Management Committee records are kept in accordance with the Education Act 1998 and other applicable legislation - Declaration of Interest, Insurance Indemnity, contact details, Minutes of Management Committee meetings record attendance, items discussed and decisions taken. Management Committee of Kildare Education Support Centre business is considered confidential to the members of the Board.
• Course Tutors The purposes for processing participant personal data include the following:

• to provide information necessary to contract tutors to deliver CPD
• to verify identity and suitability of tutor to deliver CPD in and for the Centre
• to facilitate the payment of tutors
• to enable the Centre to comply with requirements set down by the Department of Education, the Revenue Commissioners and any other governmental, statutory and/or regulatory departments and/or agencies
  • Financial Records This information is required for routine management and administration of the Centre’s financial affairs, including the payment of fees, invoices, the compiling of annual financial accounts and complying with audits and investigations by the Revenue Commissioners.

4 Recipients

• • Recipients These are defined as organisations and individuals to whom the Centre transfers or discloses personal data. Recipients may be data controllers, joint controllers or processors. A list of the categories of recipients used by the Centre is provided in the appendices (Appendix 3). This list may be subject to change from time to time.
  • Data Sharing Guidelines
• From time to time the Centre may disclose Personal Data to third parties, or allow third parties to access specific Personal data under its control. An example could arise should Gardai submit a valid request under Section 41(b) of the Irish Data Protection Act which allows for processing necessary and proportionate for the purposes of preventing, detecting, investigating or prosecuting criminal offences.
• In all circumstances where personal data is shared with others, the Centre will ensure that there is an appropriate lawful basis in place (GDPR Articles 6, 9 as appropriate). We will not share information with anyone without consent unless another lawful basis allows us to do so.
• Most data transfer to other bodies arises as a consequence of legal obligations that are on the Centre, and the majority of the data recipients are Controllers in their own right, for example, the Department of Education. As such their actions will be governed by national and European data protection legislation as well their own organisational policies.[4]
• Some of the Centre’s operations require support from specialist service providers. For example, the Centre may use remote IT back-up and restore services to maintain data security and integrity. In cases such as these, where we use specialist data processors, we will ensure that the appropriate security guarantees have been provided and that there is a signed processing agreement in place.

5 Personal Data Breaches

• • Definition of a Personal Data Breach A personal data breach is defined as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.
  • Consequences of a Data Breach
    • A breach can have a significant adverse effect on individuals, which can result in physical, material or non-material damage. This can include discrimination, identity theft or fraud, financial loss, damage to reputation, loss of confidentiality etc.
    • In addition to any detrimental impact on individual data subjects, a data breach can also cause serious damage to the Centre. This can include reputational damage as well as exposing the Centre to other serious consequences including civil litigation.
    • It should be noted the consequences of a data breach could include disciplinary action, criminal prosecution and financial penalties or damages for the Centre and participating individuals.[5]
  • Responding to a Data Breach
    • The Centre will always act to prioritise and protect the rights of those individuals whose personal data is affected.
    • As soon as the Centre becomes aware that an incident has occurred, measures will be taken to assess and address the breach appropriately, including actions to mitigate any possible adverse effects.
    • Where the Centre believes that there is a risk to the affected individuals, the Centre will (within 72 hours of becoming aware of the incident) submit a report to the Data Protection Commission.
    • Where a breach is likely to result in a high risk to the affected individuals, the Centre will inform those individuals without undue delay.

6 Data Subject Rights

• • Your Rights Personal Data will be processed by the Centre in a manner that is respectful of the rights of data subjects. Under GDPR these include[6]
• the right to information
• the right of access
• the right to rectification
• the right to erasure (“right to be forgotten”)
• the right to restrict processing
• the right to data portability
• the right to object
• the right not to be subject to automated decision making
• the right to withdraw consent
• the right to complain.
  • Right to be Informed You are entitled to information about how your personal data will be processed. We address this right primarily through the publication of this Data Protection Policy. We also publish additional privacy notices/statements which we provide at specific data collection times, for example, our Website Data Privacy Statement is available to all users of our website. Should you seek further clarification, or information that is not explicit in our Policy or Privacy Statements, then you are requested to forward your query to the Centre.
  • Right of Access You are entitled to see any information we hold about you. The Centre will, on receipt of a request from a data subject, confirm whether or not their personal data is being processed. In addition, a data subject can request a copy of their personal data. The Centre in responding to a right of access must ensure that it does not adversely affect the rights of others.
  • Right to rectification If you believe that the Centre holds inaccurate information about you, you can request that we correct that information. The personal record may be supplemented with additional material where it is adjudged to be incomplete.
  • Right to be forgotten Data subjects can ask the Centre to erase their personal data. The Centre will act on such a request providing that there is no compelling purpose or legal basis necessitating retention of the personal data concerned.
  • Right to restrict processing Data subjects have the right to seek a restriction on the processing of their data. This restriction (in effect requiring the controller to place a “hold” on processing) gives an individual an alternative to seeking erasure of their data. It may also be applicable in other circumstances such as where, for example, the accuracy of data is being contested.
  • Right to data portability This right facilitates the transfer of personal data directly from one controller to another. It can only be invoked in specific circumstances, for example, when processing is automated and based on consent or contract.
  • Right to object Data subjects have the right to object when processing is based on the Centre’s legitimate interests or relates to a task carried out in the public The Centre must demonstrate compelling legitimate grounds if such processing is to continue.
  • Right not to be subject to automated decision making This right applies in specific circumstances (as set out in GDPR Article 22).
  • Right to withdraw consent In cases where the Centre is relying on consent to process your data, you have the right to withdraw this at any time, and if you exercise this right, we will stop the relevant processing.
  • Limitations on Rights While the Centre will always facilitate the exercise of your rights, it is recognised that they are not unconditional: the Centre may need to give consideration to other obligations.[7]
  • Right to Complain
    • If you are concerned about how your personal data is being processed, then please address these concerns in the first instance to the Director who is responsible for operational oversight of this policy.
    • A matter that is still unresolved may then be referred to the Centre’s Data Controller (i.e., the Management Committee of Kildare Education Support Centre) by writing to the Chairperson c/o Centre.
    • Should you feel dissatisfied with how we have addressed a complaint or concern that you have raised, you have the right, as data subject, to bring the matter to the attention of the Irish Data Protection Commission.

Telephone +353 57 8684800

+353 (0)761 104 800

Lo Call Number 1890 252 231

Fax +353 57 868 4757

E-mail This email address is being protected from spambots. You need JavaScript enabled to view it.

Post Data Protection Commission

Canal House, Station Road

Portarlington, Co. Laois

R32 AP23

Website www.dataprotection.ie

• Glossary

Child - a person under the age of 18 years. Children are deemed as vulnerable under GDPR and merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal data.

Controller or Data Controller - an entity or person who, alone or jointly with others, determines the purposes and means of the processing of personal data. In this policy, the data controller is the Centre.

Consent - any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Data Protection Commission - the national supervisory authority responsible for monitoring the enforcing the data protection legislation within Ireland. The DPC is the organisation to which Centres as data controllers must notify data breaches where there is risk involved.

Data Protection Legislation – this includes (i) the General Data Protection Regulation (GDPR) - Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and (ii) the Irish Data Protection Act (2018). GDPR is set out in 99 separate Articles, each of which provides a statement of the actual law. The regulation also includes 171 Recitals to provide explanatory commentary.

Data Subject - a living individual who is the subject of the Personal Data, i.e. to whom the data relates either directly or indirectly.

Data concerning health - personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status. This is an example of special category data (as is data concerning special education needs).

Personal data - any information relating to an identified or identifiable natural person (a “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Personal data breach - a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

Processing - any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Processor or Data Processor - a person or entity who processes Personal Data on behalf of a Data Controller on the basis of a formal, written contract (but does not include an employee of a controller who processes such data in the course of his or her employment).

Profiling - any form of automated processing of personal data intended to evaluate, analyse, or predict data subject behaviour.

(Relevant) Filing System - any set of information that is structured, either by reference to individuals, or by reference to criteria relating to individuals, in such a manner that specific information relating to an individual is readily retrievable.

Special categories of data - personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.

• Personal Data and related Processing Purposes

• Categories of Recipients

Department of Education(DE) The Centre is required to provide data to the Department of Education (DE).

Legal requirements where appropriate, particularly in relation to Child Protection and safeguarding issues, the Centre may be obliged to seek advice and/or make referrals to Túsla.[8] The Centre may share personal data with An Garda Síochána where concerns arise in relation to child protection. The Centre will also report matters of alleged criminal acts, criminal behaviour, criminal damage, etc., to allow prevention, detection and investigation of offences. Where there is a lawful basis for doing so, personal data may also be shared with the Revenue Commissioners and the Workplace Relations Commission.

Insurance data may be shared with the Centre’s insurers where this is appropriate and proportionate. The Centre may also be obliged to share personal data with the Health and Safety Authority, for example, where this is required as part of an accident investigation.

Professional Advisors some data may be shared with legal advisors (solicitors, etc.), HR advisors, financial advisors (accountants, etc.) and others such as Centre management advisors; this processing will only take place where it is considered appropriate, necessary and lawful.

Other Centres the Centre may be asked to supply certain information about a participant, such as attendance record, etc.

Work Placement some data may be shared, on request, with work placement providers and employers where this is appropriate and necessary to support students engaged in work experience or similar programmes.

Service Providers in some circumstances the Centre has appointed third parties to undertake processing activities on its behalf. These Data Processors have provided guarantees that their processing satisfies the requirements of the General Data Protection Regulation. The Centre has implemented written contractual agreements with these entities to ensure that the rights of data subjects receive an appropriate level of protection. Third party service providers include the following categories:

• Centre Management Information Systems
• Productivity Applications (e.g. Google Apps for Education, Microsoft 365)
• Online Storage & File Sharing (e.g. Dropbox, Google Drive, iCloud, OneDrive)
• IT Systems Support (local ICT Support Company)
• Accounting & Payroll software
• Cashless Payment Systems
• HR and H&S Consultants

• Implementing the Data Processing Principles

1. Accountability

• Accountability means that compliance with the data protection legislation is recognised as an important Management Committee of Kildare Education Support Centre responsibility as well as one shared by each Centre employee and member of the wider Centre community.
• Demonstrating Compliance Accountability imposes a requirement on the controller to demonstrate compliance with the other data processing principles (see Section 2 earlier: Processing Principles). This means that the Centre retains evidence to demonstrate the actions it has taken to comply with GDPR.
• Centre Policies An important way for the Centre to demonstrate accountability is through the agreement and implementation of appropriate policies. In addition to publishing a Data Protection Policy this may include developing other policies to address some or all of the following areas (i) CCTV (ii) Data Breaches (iii) Data Access Requests (iv) Record Storage and Retention (v) Data Processing Agreements.
• Record of Processing Activities As a data controller the Centre is required to prepare a record of any processing activities (ROPA) that it undertakes. Kildare Education Support Centre has a Data Log . This record should include the following information (GDPR Article 30):
  • the purposes of the processing;
  • a description of the categories of data subjects and personal data;
  • the categories of recipients to whom the personal data will be disclosed;
  • any transfers to a third country or international organisation, including suitable safeguards;
  • where possible, the envisaged time limits for erasure of the different categories of data;
  • where possible, a general description of the technical and organisational security measures.
• Risk Assessment The Centre as data controller is required to consider any risks that may arise as a consequence of its processing activities. This assessment should consider both the likelihood and the severity of these risks and their potential impact on data subjects.
• Data Protection Impact Assessment (DPIA) A DPIA is a type of risk assessment that is mandatory in specific circumstances (GDPR Article 35). The Centre will ensure that a DPIA is undertaken where this is appropriate, typically, where a new processing activity has the potential to have a high impact on individual privacy or rights. (The installation of an extensive CCTV system in a Centre is an example of a processing activity that might trigger the need for a Data Protection Impact Assessment.) The purpose of undertaking a DPIA is to ensure that any risks associated with the new processing activity are identified and mitigated in an appropriate manner.
• Security of Processing As a consequence of having assessed the risks associated with its processing activities, the Centre will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. For example, these measures might include training of staff, establishment of password policies, protocols around device encryption, procedures governing access to special category data etc.
• Data Protection by Design The Centre aims to apply the highest standards in terms of its approach to data protection. For example, Centre staff will utilise a Privacy by Design approach when any activity that requires the processing of personal data is being planned or reviewed. This may mean implementing technical measures (e.g. security) and organisational measures (e.g. protocols and training).
• Data Protection by Default A Privacy by Default approach means that minimal processing of personal data is the Centre’s default position. In practice this means that only essential data will be collected from data subjects, and that within the Centre, access to this data will be carefully controlled and only provided to employees where this is appropriate and necessary.
• Data Processing Agreements: the Centre will put written contracts in place with organisations that process data on its behalf (as required under GDPR Article 28).
• Data Breach Records: the Centre will retain records that document its handling of any personal data breaches. These records will clearly set out the facts relating to any personal data breach, its effects and the remedial action taken.
• Staff Awareness and Training All who are granted access to personal data that is under the control of the Centre have a duty to observe the data processing principles. The Centre will provide appropriate information, training and support so that staff may gain a clear understanding of these requirements.

2. Lawful Processing

As part of its decision to collect, use or share personal data, the Centre as Controller will identify which of the lawful bases is applicable to each processing operation. In the absence of a lawful basis the personal data cannot be processed.

• Many of Centre’s data processing activities rely on legal obligations. These tasks are undertaken because the Centre must comply with Irish (or European) law. For example, there is a legislative basis underpinning the sharing of specific data with the Department of Education and other public bodies such as Revenue.
• Another set of data processing activities are undertaken in the public intereste. so that the Centre can operate safely and effectively.
• In some situations, the Centre may rely on its legitimate interests to justify processing. In such cases the specific legitimate interests (e.g. health and safety, protection of Centre property etc.) must be identified and notified to the data subjects.
• Contract will provide a lawful basis for some processing of data by the Centre. For example, the processing of employee/ tutor data may rely on this lawful basis.
• There is also the possibility that processing can be justified in some circumstances to protect the Vital Interests of a data subject, or another person. For example, sharing some data subject data with emergency services might rely on this lawful basis.
• Finally there is the option of using a data subject’s consent as the lawful basis for processing personal data. The Centre will not rely on consent as the basis for processing personal data if another lawful condition is more appropriate. Consent will usually be the lawful basis used by the Centre to legitimise the publication of participants’ photographs in print publications and electronic media. It will also be used as the basis for using Contact details to advertise relevant CPD events.

3. Consent

Where consent is relied upon as the appropriate condition for lawful processing, then that consent must be freely given, specific, informed and unambiguous. All of these conditions must be satisfied for consent to be considered valid. There are a significant number of restrictions around using consent.

• A separate consent will be sought for each processing activity (together with appropriate guidance as necessary to ensure the data subject is informed).
• When asking for consent, the Centre will ensure that the request is not bundled together with other unrelated matters.
• Consent requires some form of clear affirmative action (Silence or a pre-ticked box is not sufficient to constitute consent). Consent can be provided by means of an oral statement.
• Consent must be as easy to withdraw as to give.
• A record should be kept of how and when consent was given.
• The Centre will take steps to ensure the consent is always freely given i.e. that it represents a genuine choice and that the data subject does not feel under an obligation to consent to processing.
• If the consent needs to be explicit, this means the Centre must minimise any future doubt about its validity. This will typically require the Centre to request and store a copy of a signed consent statement.

4. Special Category Data

Some personal data is defined as Special Category Data and the processing of such data is more strictly controlled. In a Centre context this will occur whenever data that relates to Special Needs or Medical Needs is being processed. GDPR Article 9 identifies a limited number of conditions, one of which must be applicable if the processing of special category data is to be lawful. Some of these processing conditions, those most relevant in the Centre context, are noted here.

• Processing is necessary for reasons of substantial public interest on the basis of Union or Member State law. This condition could provide an appropriate basis for processing of data relating to employee health e.g. proportionate sharing of special category data to ensure the Centre is compliant with provisions in health, safety and welfare legislation.
• Processing is necessary for the assessment of the working capacity of an employee;…. on the basis of Union or Member State law.
• Processing is based on Explicit Consent.

5. Transparency

The Centre as Controller is obliged to act with Transparency when processing personal data. This requires the communication of specific information to individuals in advance of any processing of their personal data.

• Transparency is usually achieved by providing the data subject with a written document known as a Privacy Notice or a Privacy Statement. This notice will normally communicate:
  • the name of the controller and their contact details;
  • the categories of personal data being processed;
  • the processing purposes and the underlying legal bases;
  • any recipients (i.e. others with whom the data is shared/disclosed);
  • any transfers to countries outside the EEA (and safeguards used);
  • the storage period (or the criteria used to determine this);
  • the rights of the data subject.
• Transparency information should be provided in a manner that is concise and easy to understand. To best achieve this, the Centre may use a “layering” strategy to communicate information. And, while a written Privacy Notice is the default mode, transparency information may also be communicated using other means, for example through the spoken word or through use of pictorial icons or video.
• Privacy statements (include those used on Centre websites) should be regularly reviewed to take account of any enhancements, new practices or additional services which involve the collection and use of personal data.

6. Purpose Limitation

• Personal data stored by the Centre has been provided by data subjects for a specified purpose or purposes. Data must not be processed for any purpose that is incompatible with the original purpose or purposes.
• Retaining certain data (originally collected or created for a different purpose) with a view to adding to a Centre archive for public interest, scientific or historical research purposes or statistical purposes is acceptable subject to certain safeguards, most particularly the need to respect the privacy of the data subjects concerned.

7. Data Minimisation

As Controller, the Centre must ensure that personal data is adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. In practice, this principle has a number of important implications illustrated in the examples below.

• The Centre should ensure, when data is being collected from data subjects, that this is limited to what is necessary for the completion of the duties.
• Data minimisation also requires that the sharing of data within the Centre should be carefully controlled. Members of staff may require varying levels of access to data and reports. Access should be restricted to those who have a defined processing purpose. Staff will not access personal data unless processing is essential to deliver on their role within the Centre.
• Centre staff will necessarily create personal data in the course of their duties. However employees should ensure that this processing is necessary and appropriate. For example, while it will often be necessary for Centre staff to communicate information to each other by email, consideration should be given, on a case by case basis, as to whether it is necessary for personal data to be included in these communications.
• Data sharing with external recipients should be continuously reviewed to ensure it is limited to that which is absolute necessary. This may mean, for example, that when the Centre is seeking professional advice, no personal data will be included in communications unless the disclosure of this information is essential.

8. Storage Limitation

Personal data is kept in a form which permits the identification of data subjects for no longer than is necessary for the purposes for which it is being processed. Some personal data may be stored for longer periods insofar as the data is being processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

• When deciding on appropriate retention periods, the Centre’s practices will be informed by advice published by the relevant bodies (notably the Department of Education, the Data Protection Commission, and the Centre management advisory bodies).
• When documentation or computer filescontaining personal data are no longer required, the information is disposed of in a manner that respects the confidentiality of the data.
• Data subjects are free to exercise a “right to erasure” at any time (also known as the “right to be forgotten”, see Data Subject Rights).
• Data should be stored in a secure manner that recognises controller obligations under GDPR and the Data Protection Act. This requires the Centre for example, to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

9. Integrity and Confidentiality

Whenever personal data is processed by the Centre, technical and organisational measures are implemented to safeguard the privacy of data subjects. The Centre as controller is obliged to take its security responsibilities seriously, employing the most appropriate physical and technical measures, including staff training and awareness. These security procedures should be subject to regular review.

• Centre employees are required to act at all times in a manner that helps to maintain the confidentiality of any data to which they have access. Guidance and training are important to help identify and reinforce appropriate protocols around data security.
• The Centre is legally required to consider the risks to the data subject when any processing of personal data is taking place under its control. Any Risk Assessment should take particular account of the impact of incidents such as accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of, or access to, the personal data.
• As well considering the potential severity of any data incident, a risk assessment should also consider the likelihood of any incident occurring. In this way risks are evaluated on the basis of an objective assessment, by which it is established whether the data processing operations involve a risk or a high risk.
• The follow-on from any risk assessment is for the Centre to implement appropriate technical and organisational measures that ensure a level of security appropriate to the risk. These measures should ensure an appropriate level of security, including confidentiality, taking into account the state of the art and the costs of implementation in relation to the risks and the nature of the personal data to be protected (GDPR Recital 83).
• As well as processing activities undertaken by staff, the Centre must also consider the risks associated with any processing that is being undertaken on behalf of the Centre by other individuals or organisations (Data Processors). Only processors who provide sufficient guarantees about the implementation of appropriate technical and organisational measures can be engaged.
• The important contribution that organisational policies can make to better compliance with the Accountability principle was previously highlighted. Similarly, the implementation of agreed policies and protocols around data security is very helpful. Some possible areas are listed below.
  • Centre ICT policy
  • Acceptable User Polices for employees, board members, students etc
  • Accessing Centre data from home
  • Password policy
  • Social Media Policy
  • Mobile phone code
  • Centre use of Apps and Cloud Based Systems
• Managing Rights Requests

1. Responding to rights requests

• The Centre will log the date of receipt and subsequent steps taken in response to any valid request. This may include asking the data subject to complete an Access Request Form in order to facilitate efficient processing of the request. There is no charge for this process.
• The Centre is obliged to confirm the identity of anyone making a rights request and, where there is any doubt on the issue of identification, will request official proof of identity (e.g. photographic identification such as a passport or driver’s licence).
• If requests are manifestly unfounded or excessive, in particular because of their repetitive character, the Centre may either: (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or refuse to act on the request.
• The Centre will need to confirm that sufficient information to locate the data requested has been supplied. Where appropriate the Centre may contact the data subject if further details are needed.
• In responding to rights requests (e.g. data access requests) the Centre will ensure that all relevant manual and automated systems (computers etc.) are checked.
• The Centre will be conscious of the need to respond without undue delay and within the advised timeframes. A response will be made within one month of receipt of any request.
• The Centre must be conscious of the restrictions that apply to rights requests. Where unsure as to what information to disclose, the Centre reserves the right to seek legal advice.
• Where a request is not being fulfilled, the data subject will be informed as to the reasons and the mechanism for lodging a complaint, including contact details for the Data Protection Commission.
• Where action has been taken by the Centre with regard to rectification, erasure or restriction of processing, the Centre will ensure that relevant recipients (i.e. those to whom the personal data has been disclosed) are appropriately informed.

2. Format of Information supplied in fulfilling a request

• The information will be provided in writing, or by other means, including where appropriate, by electronic means. (When requested by a data subject the information access may be provided in alternative means e.g. orally.)
• The Centre will endeavour to ensure that information is provided in an intelligible and easily accessible format.

Where a request relates to video, then the Centre may offer to provide the materials in the form of a series of still images. If other people’s images cannot be obscured, then it may not prove possible to provide access to the personal data.

• Reference sites

Data Protection Act 2018 http://www.irishstatutebook.ie/eli/2018/act/7/enacted/en/html

General Data Protection Regulation (GDPR official text) 2016 https://eur-lex.europa.eu/eli/reg/2016/679/oj

General Data Protection Regulation (GDPR unofficial web version) 2016 https://gdpr-info.eu/

Irish Data Protection Commission https://www.dataprotection.ie/

Data Breach Report https://forms.dataprotection.ie/report-a-breach-of-personal-data

European Data Protection Board (EDPB) https://edpb.europa.eu/

EDPB Guidelines, Recommendations and Best Practices on GDPR https://edpb.europa.eu/our-work-tools/general-guidance/gdpr-guidelines-recommendations-best-practices_en

DE Data Protection Page https://www.education.ie/en/The-Department/Data-Protection/Information.html

PDST Technology in Education https://www.pdsttechnologyineducation.ie

Cyber Security Centre (Ireland) https://www.ncsc.gov.ie/

Cyber Security Centre (UK) https://www.ncsc.gov.uk/

[1] The Centre is also cognisant of other legislation which relates to the processing of personal data, whether in manual or in electronic form. For example, the 2011 e-Privacy Regulations (S.I. No. 336 of 2011) provide statutory guidance with regard to certain data processing operations (e.g. direct marketing, cookie notifications on Centre website etc.).

[2] Data may be stored for longer periods if being processed for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes (subject to appropriate technical and organisational measures required to safeguard the rights and freedoms of the data subject).

[3] GDPR Article 9 sets out the lawful bases that apply to the processing of special categories of personal data.

[4] The Data Protection Policy of the Department of Education can be viewed on its website (www.education.ie).

[5] The Data Protection Act 2018 established a number of offences whereby breaches of the Act can result in fines and/or imprisonment.

[6] For further information on your rights see www.GDPRandYOU.ie.

[7] See GDPR Articles 12-23 for a full explanation of subject rights and their application.

[8] Túsla, the Child and Family Agency, is the State agency responsible for improving wellbeing and outcomes for children.