Data Protection Guidelines

THE FOLLOWING INFORMATION IS FROM THE DATA PROTECTION OFFICE 

  OFFICE OF THE DATA PROTECTION COMMISSIONER
BLOCK 6, FLOOR 3, IRISH LIFE CENTRE,
LOWER ABBEY STREET, DUBLIN 1

TELEPHONE NO. (01) 874 8544
FAX NO. (01) 874 5405
E-MAIL ADDRESS: This e-mail address is being protected from spambots. You need JavaScript enabled to view it

CONTENTS

1. What is Registration?
2. Who are required to register?
3. Multiple/separate registrations - Sect 17 (1) (b) (c)
4. Public Register
5. Status of applicant while the application for registration is pending.
6. How do I renew my registration?
7. “Off Register”
8. Amending your Registration
9. Refusing your application for Registration
10. Completing the Registration Application Form
11. Fees

12 Forms (  download from www.dataprotection.ie)

13. Appendix1

REGISTRATION
Data Protection Acts 1988 & 2003
Section 16

1. What is Registration?
Under the Data Protection Acts 1988 and 2003 certain categories of data controllers who control the contents and use of personal data (Data Controllers) and persons whose business consists wholly or partly in processing such data for others (Data Processors) must register details with the Data
Protection Commissioner.
Data Controllers - Form DPA1 registration is a simple process which entails submitting the form to the Data Protection Commissioner setting out the type of personal data you keep on computer, for what purpose/purposes you keep it and to whom the information is disclosed, so that these practices can be made available to the public for viewing (Public Register).
Data Processors - Form DPA 3, registration is even simpler.  Submit the form to the Data Protection Commissioner Section 1 show your name, address, Section 2 state the countries or territories to which you transfer, or intend to transfer personal data.
 

2. Who are required to register?
Under Section 16 of the Data Protection Act, 1988, certain categories of data controllers are required to register providing that personal data is being held in an automated form (e.g. on computer). In order for Section 16 of the Data Protection Act to apply, the applicant must have a presence in this State.
Every data controller is bound by data protection requirements. Certain categories of controllers are in addition required to register with the Commissioner. For a list of the categories of data controllers who are required to register please see Appendix 1.

3. Multiple/separate registrations - Sect 17 (1) (b) (c)
If you keep personal data for two or more unrelated purposes, then you are required to apply for a separate registration for each of those unrelated purposes.  Separate registrations allow you to reflect the clear distinctions between different databases in your organisation, in terms of the nature and uses of the personal data involved, the assignment of control over and responsibility for the databases, and the legal compliance arrangements.
If you wish to make an application for a separate registration, use the separate registration form DPA2 and remember to complete section 11 of the form which shows the total number of separate
registrations for your organisation.

4. Public Register
The register of data controllers and processors is a public register intended to bring transparency to the processing of personal data. All register entries are now available on this office’s website www.dataprotection.ie.

5. Status of applicant while the application for registration is pending.
Under Section 19 of the Data Protection Act, it is an offence to keep personal data unless you are
registered. However, an exception is made in the case of persons whose application for registration is pending. Such persons may keep personal data and use it in a way consistent with the details set out in their application, while the application is being considered by the Commissioner.

6. How do I renew my registration?
The registration period is for one year. You are obliged to renew your registration annually. The
Commissioner’s office will contact you six weeks prior to this date, and supply you with the required paperwork.   The appropriate fee should be included with your signed application for continuance.

7. “Off Register”
If you fail to renew, you will be classified as “Off Register” and your details will be removed from the public register. Any “Off Register” period may remain on file and may be a factor in the investigation of any future complaint.
If you are required to register and fail to do so or fail to renew a registration, then you shall be
committing an offence under Section 19 of the Act if you continue to hold or process data. You may be liable to prosecution and a possible fine of up to €100,000.

8. Amending your Registration
The annual process of renewing your registration gives you an opportunity to update your registration details.  However, if the details contained in your register entry become out of date during the year, you will need to apply to the Commissioner to have the details amended. This is important because if you are engaging in data handling practices that are not in conformity with the details in your public register entry, you may be committing an offence.
To apply for an amendment to your registration details, complete Form DPA5 and return it to the Data Protection Commissioner along with the amendment fee of €63.49.

9. Refusing your application for Registration
Under Section 17 of the Data Protection Act the Commissioner is required/obliged to accept an
application for registration unless he is of the opinion that the details submitted by the applicant are
insufficient, that other information requested has not been forthcoming, or that the applicant is likely to contravene any of the provisions of the Act. If the Commissioner’s office has queries regarding the
details submitted, the applicant will be contacted to give him the opportunity to resolve the matter.
If sensitive data is held by the data controller, then the Commissioner must not accept the application unless he/she is satisfied that appropriate safeguards for the protection of the privacy of the individuals concerned will be provided.
If your application is rejected you have a right to appeal such a rejection to the Circuit Court within 21 days of receipt of such a notification.

10. Completing the Registration Application Form
Although the registration application form is largely self-explanatory, the following notes indicate the level of detail required to enable your application to be speedily processed. Please note that the
suggested answers to particular sections of the form are provided for illustrative purposes only, and you will need to amend and/or supplement them to fit the particular circumstances of your
organisation.
You should also note that not all of the details which you provide in your application form will be made available as part of the public register. Only the responses to section 1 to 6 (inclusive) form part of the public register; the other details are required for the purposes of the office of the Data
Protection Commissioner, and will be treated as confidential. For clarity, each section below includes an indication of whether the information under that section forms part of the public register.

FORM DPA1
Section 1: Name & Address
This information forms part of the public register
You should give the registered name of the company or person carrying on business. In the case of a partnership, you should give its name and list each of the partners. Foreign companies who have a presence in the state and who are required to register must put the Irish address in Section 1.
Note: You must keep this office informed of any change of address. Failure to do so is an
offence under section 19 of the Act.

Section 2: Contact Person
This information forms part of the public register
You should identify the person to whom members of the public may address any applications for access to their personal data under section 4 of the Act. It is sufficient to identify the contact person by
title or position, e.g. “Finance Officer”, “County Secretary”, “Senior, Executive Officer’’, ”Director”, or
“Manager” etc. if you wish.

Section 3. Purpose(s) for which you keep or use personal data:-
You should provide a general, but comprehensive, statement of the purposes for which you carry on your business, trade or profession.  Here are some examples:
Administration/provision of health services
Administration/provision of life, pension and disability insurance and related services
Administration/provision of local authority services
Provision of banking and related services
Provision of medical care
Provision of dental care
Provision of legal services
The general statement of purposes must be sufficiently comprehensive to cover all the purposes for which the business is carried on since your statement of purposes will be copied into the register and it is an offence to keep or use personal data for any purpose not described in a register entry (section 19(2) (b)).
The requirement to set out publicly your purpose for holding personal data makes an important contribution towards meeting your requirement under section 2 of the Data Protection Act to keep and use personal data ‘only for one or more specified and lawful purposes’.  This is a requirement which applies to all data controllers, not just those who are obliged to register.
If the purpose for which personal data are processed, are unrelated then a separate application must be made for each unrelated purpose.

Section 4: Description
This information forms part of the public register
This section is divided into ‘Applications’ and ‘Description of Personal Data’. You are
required to identify the various applications, i.e. distinct areas or aspects of your work, for which personal data are held and to detail the types of personal data kept in respect of each such application.
Where the personal data held is what would normally be associated with that scheme or service then it can be described briefly like “contact details” or “income details”. If the data held would not normally be associated with that scheme or service or area of work then that data should be described in detail e.g. PPS Number, Racial Origin etc.
Personal data held for applications which are ancillary to your primary purpose, such as personnel and payroll data, should be recorded separately in the left hand column.
Below are two illustrative lists of
(i)     applications, services, schemes or areas where it is expected that personal data would be held
         on computer i.e. appropriate to the left hand column of part 4 of the form.
(ii)     Brief descriptions of data that might be held in respect of those applications, services,
         schemes or areas i.e. appropriate to the right hand column of part 4 of the form.
The lists below contain examples of what might appear in the two columns of part 4. Complete part 4 using your own knowledge of your business/organisation describing the data you process on
computer. In the table below the personal data descriptions on the right are not matched to the
“applications” on the left. When filling out the form you should match the information in both columns.

Keeping personal data of any description other that that specified in the register entry may
involve an offence under section 19 of the Act.

Section 5: Disclosures
This information forms part of the public register

Section 2 of the Act requires inter alia that any disclosure of the data must be compatible with your specified purpose for holding the data.  You should list in this section any third parties to whom you make such disclosures.  You should note that the inclusion of a particular disclosure in your registration does not, of itself, make disclosure to that person legitimate.

In case of doubt, it is advisable to list the disclosure in any event.
Example: Possible disclosures are given below for illustrative purposes.