Main menu:
Data Protection Policy (GDPR)
St. Patrick’s B.N.S.
Introductory Statement
This policy has been formulated in May 2018 in order to comply with the EU General Data Protection Regulation (GDPR). The policy was ratified by the board of management on 5th November, 2018 and will be reviewed and evaluated after two years.
The school’s Data Protection Policy applies to the personal data held by the school’s Board of Management (BoM), which is protected by the Data Protection Acts 1988 to 2018 and the EU General Data Personal Regulation (GDPR)
The policy applies to all school staff, the Board of Management, parents/guardians, students and others (including prospective or potential students and their parents/guardians and applicants for staff positions within the school) insofar as the measures under the policy relate to them. Data will be stored securely so that confidential information is protected in compliance with relevant legislation. This policy sets out the manner in which personal data and special categories of personal data will be protected by the school.
St. Patrick’s B.N.S. operates a “Privacy by Design” method in relation to Data Protection. This means we plan carefully when gathering personal data so that we build in the data protection principles as integral elements of all data operations in advance. We audit the personal data we hold in order to:
1. be able to provide access to individuals to their data;
2. ensure it is held securely;
3. document our data protection procedures;
4. enhance accountability and transparency.
Data Protection Principles
The school BoM is a data controller of personal data relating to its past, present and future staff, students, parents/guardians and other members of the school community. As such, the BoM is obliged to comply with the principles of data protection set out in the Data Protection Acts 1988 to 2018 and GDPR, which can be summarised as follows:
1. Obtain and Process Personal Data fairly
Information on students is gathered with the help of parents/guardians and staff. Information is also transferred from their previous school, if applicable. In relation to information the school holds on other individuals (members of staff, individuals applying for positions within the School, parents/guardians of students, etc.), the information is generally furnished by the individuals themselves with full and informed consent and compiled during the course of their employment or contact with the School. All such data is treated in accordance with the Data Protection Legislation and the terms of this Data Protection Policy. The information will be obtained and processed fairly. (See: Appendix 1)
2. Consent
Where consent is the basis for provision of personal data, (e.g. data required to join sports teams/ after-
3. Keep it only for one or more specified and explicit lawful purposes
The BoM will inform individuals of the reasons they collect their data and the uses to which their data will be put. All information is kept with the best interest of the individual in mind at all times
4. Process it only in ways compatible with the purposes for which it was given initially
Data relating to individuals will only be processed in a manner consistent with the purposes for which it was gathered. Information will only be disclosed on a ‘need to know’ basis, and access to it will be strictly controlled
5. Keep Personal Data safe and secure
Only those with a genuine reason for doing so may gain access to the information. Personal Data is securely stored under lock and key in the case of manual records and protected with computer software and password protection in the case of electronically stored data. Portable devices storing personal data (such as laptops) are encrypted and password-
6. Keep Personal Data accurate, complete and up-
Students, parents/guardians, and/or staff should inform the school of any change which the school should make to their personal data and/or sensitive personal data to ensure that the individual’s data is accurate, complete and up-
7. Ensure that it is adequate, relevant and not excessive
Only the necessary amount of information required to provide an adequate service will be gathered and stored
8.Retain it no longer than is necessary for the specified purpose or purposes for which it was given
As a general rule, the information will be kept for the duration of the individual’s time in the school. Thereafter, the school will comply with DES guidelines on the storage of Personal Data relating to a student. In the case of members of staff, the school will comply with both DES guidelines and the requirements of the Revenue Commissioners with regard to the retention of records relating to employees. The school may also retain the data relating to an individual for a longer length of time for the purposes of complying with relevant provisions of law and or/defending a claim under employment legislation and/or contract and/or civil law. (See: School Record Retention Table – Appendix 3)
9. Provide a copy of their personal data to any individual on request
Individuals have a right to know and have access to a copy of personal data held about them, by whom, and the purpose(s) for which it is held (See: Appendix 4)
Scope
The Data Protection legislation applies to the keeping and processing of Personal Data. The purpose of this policy is to assist the school to meet its statutory obligations, to explain those obligations to School staff, and to inform staff, students and their parents/guardians how their data will be treated
The policy applies to all school staff, the Board of Management, parents/guardians, students and others (including prospective or potential students and their parents/guardians, and applicants for staff positions within the school) insofar as the school handles or processes their Personal Data in the course of their dealings with the school
Definition of Data Protection Terms
In order to properly understand the school’s obligations, there are some key terms, which should be understood by all relevant school staff:
Personal Data means any data relating to an identified or identifiable natural person i.e. a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the Data Controller (BoM)
Data Controller is the Board of Management of the school
Data Subject – is an individual who is the subject of personal data
Data Processing – performing any operation or set of operations on data, including:
• Obtaining, recording or keeping the data;
• Collecting, organising, storing, altering or adapting the data;
• Retrieving, consulting or using the data;
• Disclosing the data by transmitting, disseminating or otherwise making it available;
• Aligning, combining, blocking, erasing or destroying the data;
Data Processor – a person who processes personal information on behalf of a data controller, but does not include an employee of a data controller who processes such data in the course of their employment, for example, this might mean an employee of an organisation to which the data controller out-
Special categories of Personal Data refers to Personal Data regarding a person’s:
• racial or ethnic origin;
• political opinions or religious or philosophical beliefs;
• physical or mental health;
• sexual life and sexual orientation;
• genetic and biometric data;
• criminal convictions or the alleged commission of an offence;
• trade union membership.
Personal Data Breach – a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed. This means any compromise or loss of personal data, no matter how or where it occurs
Rationale
In addition to its legal obligations under the broad remit of educational legislation, the school has a legal responsibility to comply with the Data Protection Acts 1988 to 2018 and the GDPR.
This policy explains what sort of data is collected, why it is collected, for how long it will be stored and with whom it will be shared. The school takes its responsibilities under data protection law very seriously and wishes to put in place safe practices to safeguard individual’s personal data. It is also recognised that recording factual information accurately and storing it safely facilitates an evaluation of the information, enabling the Principal and Board of Management to make decisions in respect of the efficient running of the school. The efficient handling of data is also essential to ensure that there is consistency and continuity where there are changes of personnel within the school and Board of Management.
Other Legal Obligations
Implementation of this policy takes into account the school’s other legal obligations and responsibilities. Some of these are directly relevant to data protection. For example:
Under Section 9(g) of the Education Act, 1998, the parents of a student, or a student who has reached the age of 18 years, must be given access to records kept by the school relating to the progress of the student in their education
Under Section 20 of the Education (Welfare) Act, 2000, the school must maintain a register of all students attending the School
Under Section 20(5) of the Education (Welfare) Act, 2000, a principal is obliged to notify certain information relating to the child’s attendance in school and other matters relating to the child’s educational progress to the principal of another school to which a student is transferring. St. Patrick’s B.N.S. sends, by post, a copy of a child’s passport, as provided by the National Council for Curriculum and Assessment, to the principal of the Post-
Where reports on pupils which have been completed by professionals, apart from St. Patrick’s B.N.S. staff, are included in current pupil files, such reports are only passed to the post-
Under Section 21 of the Education (Welfare) Act, 2000, the school must record the attendance or non-
Under Section 28 of the Education (Welfare) Act, 2000, the School may supply Personal Data kept by it to certain prescribed bodies (the Department of Education and Skills, Tusla, the National Council for Special Education and other schools). The BoM must be satisfied that it will be used for a ‘relevant purpose’ (which includes recording a person’s educational or training history or monitoring their educational or training progress; or for carrying out research into examinations, participation in education and the general effectiveness of education or training)
Under Section 14 of the Education for Persons with Special Educational Needs Act, 2004, the school is required to furnish to the National Council for Special Education (and its employees, which would include Special Educational Needs Organisers) such information as the Council may from time to time reasonably request
The Freedom of Information Act 1997 provides a qualified right to access to information held by public bodies which does not necessarily have to be “personal data”, as with data protection legislation. While most schools are not currently subject to freedom of information legislation, (with the exception of schools under the direction of Education and Training Boards), if a school has furnished information to a body covered by the Freedom of Information Act (such as the Department of Education and Skills, etc.) these records could be disclosed by that body if a request is made to that body
Under Section 26(4) of the Health Act, 1947 a school shall cause all reasonable facilities (including facilities for obtaining names and addresses of pupils attending the school) to be given to a health authority who has served a notice on it of medical inspection, e.g. a dental inspection
Under Children First Act 2015, mandated persons in schools have responsibilities to report child welfare concerns to Tusla-
Relationship to characteristic spirit of the School:
St. Patrick’s B.N.S. seeks to:
• enable students to develop their full potential; ‘Ó gach duine a dhícheall.’
• provide a safe and secure environment for learning;
• promote respect for the diversity of values, beliefs, traditions, languages and ways of life in society.
We aim to achieve these goals while respecting the privacy and data protection rights of students, staff, parents/guardians and others who interact with us. The school wishes to achieve these aims/missions while fully respecting individuals’ rights to privacy and rights under the Data Protection Legislation.
Personal Data
The Personal Data records held by the school may include:
1. Staff records:
• Categories of staff data:
As well as existing members of staff (and former members of staff), these records may also relate to applicants applying for positions within the school, trainee teachers and teachers being probated. These staff records may include:
• Name, address and contact details, PPS number.
• Name and contact details of next-
• Original records of application and appointment to promotion posts
• Details of approved absences (career breaks, parental leave, study leave, etc.)
• Details of work record (qualifications, classes taught, subjects, etc.)
• Details of any accidents/injuries sustained on school property or in connection with the staff member carrying out their school duties
• Records of any reports the school (or its employees) have made in respect of the staff member to State departments and/or other agencies under Children First Act 2015
• Purposes:
Staff records are kept for the purposes of:
• the management and administration of school business (now and in the future);
• to facilitate the payment of staff, and calculate other benefits/entitlements (including reckonable service for the purpose of calculation of pension payments, entitlements and/or redundancy payments where relevant)
• to facilitate pension payments in the future;
• human resources management;
• recording promotions made (documentation relating to promotions applied for) and changes in responsibilities, etc.;
• to enable the school to comply with its obligations as an employer, including the preservation of a safe, efficient working and teaching environment (including complying with its responsibilities under the Safety, Health and Welfare at Work Act 2005);
• to enable the school to comply with requirements set down by the Department of Education and Skills, the Revenue Commissioners, the National Council for Special Education, Tusla, the HSE, and any other governmental, statutory and/or regulatory departments and/or agencies;
• and for compliance with legislation relevant to the school.
• Location and Security Procedures of St. Patrick’s B.N.S.:
• Manual records are kept in a secure, locked filing cabinet in the main administrative office/ principal’s office only accessible to personnel who are authorised to use the data. Employees are required to maintain the confidentiality of any data to which they have access.
• Digital records are stored on password-
2. Student records:
• Categories of student data:
These may include:
• Information which may be sought and recorded at enrolment and may be collated and compiled during the course of the student’s time in the school. These records may include:
• name, address and contact details, PPS number;
• date and place of birth;
• names and addresses of parents/guardians and their contact details (including any special arrangements with regard to guardianship, custody or access);
• religious belief;
• racial or ethnic origin;
• membership of the Traveller community, where relevant;
• whether they (or their parents) are medical card holders;
• whether English is the student’s first language and/or whether the student requires English language support;
• any relevant special conditions (e.g. special educational needs, health issues, ) which may apply;
• Information on previous academic record (including reports, references, assessments and other records from any previous school(s) attended by the student;
• Psychological, psychiatric and/or medical assessments;
• Attendance records;
• Photographs and recorded images of students (including at school events and noting achievements) are managed in line with the accompanying policy on school photography;
• Academic record – subjects studied, class assignments, examination results as recorded on official school reports;
• Records of significant achievements;
• Whether the student is exempt from studying Irish;
• Records of disciplinary issues/investigations and/or sanctions imposed;
• Other records e.g. records of any serious injuries / accidents, (Note: it is advisable to inform parents that a particular incident is being recorded);
• Records of any reports the school (or its employees) have made in respect of the student to State Departments and/or other agencies under Children First Act 2015.
• Purposes: The purposes for keeping student records include:
• to enable each student to develop to his/her full potential;
• to comply with legislative or administrative requirements;
• to ensure that eligible students can benefit from the relevant additional teaching or financial supports;
• to support the provision of religious instruction;
• to enable parents/guardians to be contacted in the case of emergency or in the case of school closure, or to inform parents of their child’s educational progress or to inform parents of school events, etc.;
• to meet the educational, social, physical and emotional requirements of the student;
• photographs and recorded images of students are taken to celebrate school achievements, e.g. compile yearbooks, establish a school website, record school events, and to keep a record of the history of the school.
• to ensure that the student meets the school’s admission criteria
• to ensure that students meet the minimum age requirement for attendance at Primary School.
• to ensure that any student seeking an exemption from Irish meets the criteria in order to obtain such an exemption from the authorities
• to furnish documentation/information about the student to the Department of Education and Skills, the National Council for Special Education, Tusla, and other schools, etc. in compliance with law and directions issued by government departments
• to furnish, when requested by the student (or their parents/guardians in the case of a student under 18 years) documentation/information/references to second-
• (Location and Security Procedures as above):
3. Board of Management records:
Categories of Board of Management data:
• Name, address and contact details of each member of the Board of Management (including former members of the Board of Management)
• Records in relation to appointments to the Board
• Minutes of Board of Management meetings and correspondence to the Board, which may include references to individuals.
Purposes:
To enable the Board of Management to operate in accordance with the Education Act 1998 and other applicable legislation and to maintain a record of Board appointments and decisions.
(Location and Security procedures as above):
4. Other Records: Creditors
Categories of Board of Management data:
The school may hold some or all of the following information about creditors (some of whom are self-
• name
• address
• contact details
• PPS number
• tax details
• bank details and
• amount paid
Purposes: The purposes for keeping creditor records are:
This information is required for routine management and administration of the school’s financial affairs, including the payment of invoices, the compiling of annual financial accounts and complying with audits and investigations by the Revenue Commissioners.
(Location and Security procedures as above):
5. Other Records: Charity Tax-
• Categories of Board of Management data:
The school may hold the following data in relation to donors who have made charitable donations to the school:
• name
• address
• telephone number
• PPS number
• tax rate
• signature and
• the gross amount of the donation.
• Purposes: The purposes for keeping creditor records are:
Schools are entitled to avail of the scheme of tax relief for donations of money they receive. To claim the relief, the donor must complete a certificate (CHY2) and forward it to the school to allow it to claim the grossed up amount of tax associated with the donation. The information requested on the appropriate certificate is the name of the parent, address, PPS number, tax rate, telephone number, signature and the gross amount of the donation. This is retained by the School in the event of audit by the Revenue Commissioners.
(Location and Security procedures as above):
Examination results
The school will hold data comprising examination results in respect of its students. These include class, mid-
Purposes:
The main purpose for which these examination results are held is to monitor a student’s progress and to provide a sound basis for advising them and their parents or guardians about educational attainment levels and recommendations for the future. The data may also be aggregated for statistical/reporting purposes, such as to compile results tables. The data may be transferred to the Department of Education and Skills, the National Council for Curriculum and Assessment and other schools to which a pupil will move to.
Location and Security procedures. As above
Links to other policies and to curriculum delivery
Our school policies need to be consistent with one another, within the framework of the overall School Plan. Relevant school policies already in place or being developed or reviewed, shall be examined with reference to the Data Protection Policy and any implications which it has for them shall be addressed.
The following policies may be among those considered:
• Pupil Online Database (POD): Collection of the data for the purposes of complying with the Department of Education and Skills’ pupil online database.
• Child Safeguarding Statement and Protection Procedures
• Anti-
• Code of Behaviour
• Enrolment Policy
• ICT Acceptable Usage Policy
• Special Educational Needs’ Policy
• Critical Incident Policy
• Attendance Policy
Processing in line with a data subject’s rights
Data in this school will be processed in line with the data subject’s rights. Data subjects have a right to:
• Know what personal data the school is keeping on them;
• Request access to any data held about them by a data controller;
• Prevent the processing of their data for direct-
• Ask to have inaccurate data amended;
• Ask to have data erased once it is no longer necessary or irrelevant (See: Appendix 5)
Data Processors
Where the school outsources to a data processor off-
Personal Data Breaches
All incidents in which personal data has been put at risk must be reported to the Office of the Data Protection Commissioner within 72 hours
When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the BoM must communicate the personal data breach to the data subject without undue delay
If a data processor becomes aware of a personal data breach, it must bring this to the attention of the data controller (BoM) without undue delay.
Dealing with a data access request
Individuals are entitled to a copy of their personal data on written request (See: Appendix 4)
Request must be responded to within one month. An extension may be required (e.g. over holiday periods etc.)
No fee may be charged except in exceptional circumstances where the requests are repetitive or manifestly unfounded or excessive
No personal data can be supplied relating to another individual apart from the data subject
Providing information over the phone
An employee dealing with telephone enquiries should be careful about disclosing any personal information held by the school over the phone. In particular, the employee should:
• Ask that the caller put their request in writing
• Refer the request to the principal for assistance in difficult situations
• Not feel forced into disclosing personal information
Implementation arrangements, roles and responsibilities
The BoM is the data controller and the principal implements the Data Protection Policy, ensuring that staff who handle or have access to Personal Data are familiar with their data protection responsibilities
The following personnel have responsibility for implementing the Data Protection Policy:
Name Responsibility
Board of Management Data Controller
Principal Implementation of Policy
Teachers / Staff Implementation of Policy
Monitoring the implementation of the policy
The implementation of the policy shall be monitored by the principal, staff and the Board of Management
Reviewing and evaluating the policy
This policy has been formulated in May 2018 in order to comply with the EU General Data Protection Regulation (GDPR). The policy was ratified by the board of management on 5th November, 2018 and will be reviewed and evaluated after two years. On-
Signed: ____________________________
Phil O’ Kelly, Chairperson of BOM
Signed: ____________________________
Joseph McCarthy, Principal/Secretary to the BOM
Date: _____________________________
St. Patrick’s B.N.S.
Appendix 1
Fair Processing
Fair Processing of personal data
Section 2A of the Acts details a number of conditions, at least one of which must be met, in order to demonstrate that personal data is being processed fairly. These conditions include that the data subject has consented to the processing, or that the processing is necessary for at least one of the following reasons:
1. The performance of a contract to which the data subject is party, or
2. In order to take steps at the request of the data subject prior to entering into a contract, or
3. In order to comply with a legal obligation (other than that imposed by contract), or
4. To prevent injury or other damage to the health of the data subject, or
5. To prevent serious loss or damage to the property of the data subject, or
6. To protect the vital interests of the data subject where the seeking of the consent of the data subject is likely to result in those interests being damaged, or
7. For the administration of justice, or
8. For the performance of a function conferred on by or under an enactment or,
9. For the performance of a function of the Government or a Minister of the Government, or
10. For the performance of any other function of a public nature performed in the public interest by a person, or
11. For the purpose of the legitimate interests pursued by a data controller except where the processing is unwarranted in any particular case by reason of prejudice to the fundamental rights and freedoms or legitimate interests of the data subject
Fair processing of sensitive personal data
If processing sensitive data, you must satisfy the requirements for processing personal data set out above along with at least one of the following conditions (set out in section 2B of the Acts):
1. The data subject has given explicit consent, or
2. The processing is necessary in order to exercise or perform a right or obligation which is conferred or imposed by law on the data controller in connection with employment, or
3. The processing is necessary to prevent injury or other damage to the health of the data subject or another person, or serious loss in respect of, or damage to, property or otherwise to protect the vital interests of the data subject or of another person in a case where consent cannot be given, or the data controller cannot reasonably be expected to obtain such consent, or
4. The processing is necessary to prevent injury to, or damage to the health of, another person, or serious loss in respect of or damage to, the property of another person, in a case where such consent has been unreasonably withheld, or
5. The processing is carried out by a not-
6. The information being processed has been made public as a result of steps deliberately taken by the data subject, or
7. The processing is necessary for the administration of justice, or
8. The processing is necessary for the performance of a function conferred on a person by or under an enactment, or
9. The processing is necessary for the performance of a function of the Government or a Minister of the Government, or
10. The processing is necessary for the purpose of obtaining legal advice, or in connection with legal proceedings, or is necessary for the purposes of establishing, exercising or defending legal rights, or
11. The processing is necessary for medical purposes, or
12. The processing is necessary in order to obtain information for use, subject to, and in accordance with, the Statistics Act, 1993, or
13. The processing is necessary for the purpose of assessment of or payment of a tax liability, or
14. The processing is necessary in relation to the administration of a Social Welfare scheme
St. Patrick’s B.N.S.
Appendix 2
Consent
Where consent is the basis for provision of personal data (e.g. data required to join sports team/ after-
To ensure that the school’s practices are open and transparent and to obtain data fairly the data subject must, at the time the personal data is being collected, be made aware of:
1. the name of the data controller (i.e. School BoM)
2. the purpose/rationale for collecting the data and any secondary uses of their personal data which might not be obvious to them
3. the persons or categories of persons to whom the data may be disclosed e.g.
• DES
• other third parties operating in the education and welfare sphereg. NCSE, TUSLA, NEPS, SESS, the HSE,TUSLA, An Garda Síochána
• other third parties with whom the School contracts, such as cloud-
4. whether replies to questions asked are obligatory and the consequences of not providing replies to those questions
5. the existence of the right to access their personal data
6. the right to rectify their data if inaccurate or processed unfairly
7. any other information which is relevant so that processing may be fair and to ensure that the data subject has all the information that is necessary to facilitate their awareness of how their data will be processed
Where you use application forms or standard documentation in school for enrolment or other purposes, you should explain your purposes/uses etc. clearly on such forms or documentation
No age limit is associated with consent. However, it is important that the data subject appreciates the nature and effect of such consent. Therefore, different ages might be set for different types of consent. Where a person is unlikely to be able to appreciate the nature or effect of consent, by reason of physical or mental incapacity or age, then a parent, grandparent, uncle, aunt, brother, sister or guardian may give consent on behalf of the data subject. These are the only circumstances in which a third party may give consent on behalf of a data subject
Fair Obtaining: Test Yourself
When people are giving you information, you should be able to answer YES to the following questions:-
1. do they know what information you will keep about them?
2. do they know the purpose for which you keep and use it?
3. do they know the people or bodies to whom you disclose or pass it?
In general, the fair obtaining principle requires that every individual about whom information is collected for holding will be aware of what is happening
ST. PATRICK’S B.N.S.
Appendix 3
School Record Retention Table
Pupil Related
Retention Periods
School Register/Roll Books
Enrolment Forms
Disciplinary notes
Test Results – Standardised
Psychological Assessments etc.
SEN Files/IEPS
Accident Reports
Child Protection Reports/Records
S.29 Appeals Indefinitely
Hold until pupil is 25 Years
Never Destroy
Never Destroy
Never Destroy
Never Destroy
Never Destroy
Never Destroy
Hold until pupil is 25 Years
Interview Records
Interview Board
Marking Scheme
Board of Management notes (for unsuccessful candidates) 18 months from close of competition plus 6 months in case Equality Tribunal needs to inform school that a claim is being taken
Staff Records
Contract of Employment
Teaching Council Registration
Vetting Records
Accident/Injury at work Reports Retention for duration of employment + 7 years
(6 years to make a claim against the school plus 1 year for proceedings to be served on school)
BoM Records
BOM Agenda and Minutes
CC TV Recordings
Payroll & Taxation
Invoices/receipts
Audited Accounts Indefinitely
28 days normally. In the event of criminal investigation – as long as is necessary
Revenue require a 6-
Retain for 7 Years
Indefinitely
Indefinitely
Why, in certain circumstances, does the Data Protection Commission recommend the holding of records until the former pupil has attained 25 years of age?
The reasoning is that a pupil reaches the age of majority at 18 years and that there should be a 6-
Data that becomes obselete will be shredded. The school may employ the services of a private company in the destruction of such data.
St. Patrick’s B.N.S.
Appendix 4
Personal Data Access Request Form
Request for a copy of Personal Data under the Data Protection Acts 1988 to 2018
Important: Proof of Identity must accompany this Access Request Form (eg. official/State photographic identity document such as driver’s licence, passport).
Full Name:
Maiden Name (if name used during your school duration)
Address:
Contact number *
Email addresses *
* We may need to contact you to discuss your access request
Please tick the box which applies to you:
Parent/
Guardian of current Pupil
o Former Pupil
o Current Staff Member
o Former Staff Member:
o
Name of Pupil: Date of Birth of Pupil:
Insert Year of leaving: Insert Years From/To:
Data Access Request:
I, ……………………………………………… [name] wish to make an Access Request for a copy of personal data that St. Patrick’s B.N.S. holds about me/my child. I am making this access request under Data Protection Acts 2013 to 2018
To help us to locate your personal data, please provide details below, which will assist us to meet your requirements e.g. description of the category of data you seek.
This Access Request must be accompanied with a copy of photographic identification e.g., passport or drivers licence. I declare that all the details I have given in this form are true and complete to the best of my knowledge.
Signature of Applicant ……………………………………………………….. Date: …………………….
Please return this form to the relevant address:
To: The Chairperson Board of Management, St. Patrick’s B.N.S., Gardiner’s Hill, Cork.
ST. PATRICK’S B.N.S.
Appendix 5
Your rights as a data subject
1. Right to have your data processed in accordance with the Data Protection Acts
to have your personal information obtained and processed fairly, kept securely and not unlawfully disclosed to others
2. Right to be informed
to know the identity of the data controller and the purpose for obtaining your personal information
3. Right of access
to get a copy of your personal information
4. Right of rectification or erasure
to have your personal information corrected or deleted if inaccurate
5. Right to block certain uses
to prevent your personal information being used for certain purposes
6. Right to have your name removed from a direct marketing list
to stop unwanted mail
7. Right to object
to stop some specific uses of your personal information
8. Employment rights
not to be forced into accessing personal information for a prospective employer
9. Freedom from automated decision making
to have a human input in the making of important decisions relating to you
10. Rights under Data Protection and Privacy in Telecommunications Regulations
to prevent your phone directory entry details from being used for direct marketing purposes
St. Patrick’s B.N.S.
Appendix 6
The 8 Rules of Data Protection
1. Obtain and process information fairly
2. Keep it only for one or more specified, explicit and lawful purposes
3. Use and disclose it only in ways compatible with these purposes
4. Keep it safe and secure
5. Keep it accurate, complete and up-
6. Ensure that it is adequate, relevant and not excessive
7. Retain it for no longer than is necessary for the purpose or purposes
8. Give a copy of his/her personal data to that individual on request