http___www.welfare.ie_ga_Pages_Data-Protection-in-the-Department-of-Social-Protection.aspx_1.xml
1.1 2.1 3.1 4.1 5.1 5.2 5.3 6.1 6.2 7.1 8.1 9.1 10.1 11.1 12.1 13.1 14.1 15.1 16.1 17.1 17.2 17.3 17.4 18.1 19.1 19.2 19.3 19.4 20.1 21.1 22.1 23.1 23.2 23.3 23.4 24.1 24.2 25.1 25.2 25.3 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 36.1 37.1 38.1 38.2 39.1 39.2 40.1 41.1 42.1 43.1 44.1 44.2 45.1 46.1 46.2 47.1 47.2 48.1 48.2 49.1 50.1 50.2 50.3 50.4 50.5 51.1 51.2 52.1 52.2 53.1 54.1 55.1 55.2 56.1 57.1 58.1 59.1 59.2 60.1 61.1 61.2 62.1 63.1 64.1 64.2 65.1 66.1
DATA PROTECTION ACTS 1988 AND 2003 Purpose of these Guidelines The purpose of these Guidelines and Procedures is to assist staff in supporting the Department's Data Protection Policy, which affirms its commitment to protect the privacy rights of individuals in accordance with the legislation. What are the Data Protection Acts, 1988 and 2003? The Data Protection Acts 1988 and 2003 are designed to protect an individual's privacy. The Acts confer rights on individuals in relation to the privacy of their personal data as well as responsibilities on those persons holding and processing such data. In particular, they provide for the collection and use of data in a responsible way, while providing protection against unwanted or harmful uses of the data. All staff should familiarise themselves with the provisions of the Acts. Further information is available on the website of the Office of the Data Protection Commissioner www.dataprotection.ie. Department's Obligations There are eight rules of Data Protection which govern the processing of personal data: - Obtain and process the information fairly; - Keep it only for one or more specified and lawful purposes; - Process it only in ways compatible with the purposes for which it was given to you initially; - Keep it safe and secure; - Keep it accurate and up-to-date; - Ensure that it is adequate, relevant and not excessive; - Retain it no longer than is necessary for the specified purpose or purposes; - Give a copy of his/her personal data to any individual, on request. These provisions apply to ALL personal data held. Personal data means data relating to a person who is or can be identified either from the data itself or in conjunction with other information that is in, or is likely to come into, the possession of the Department. It covers any information that relates to an identifiable, living individual. This data can be held on computers or in manual files. The Acts also provide that a "duty of care" is owed to data subjects, which means that those controlling or processing the data should take care that their activities do not cause damage or distress to the people concerned by, for example, maintaining inaccurate information on our files, or disclosing personal data to someone who is not entitled to this data. The Department holds data to administer its functions. Staff are provided with access to that data in order to do their jobs. Under no circumstances should data be accessed without a direct business requirement. Confidential customer information must never be discussed with or disclosed to any unauthorised third party, either internal or external. Application of the rules of Data Protection In order to ensure the Department's compliance with the Rules of Data Protection, the following procedures must be observed at all times: * Rules 1, 2 and 6 (obtaining and processing all personal data fairly) Personal data is obtained fairly if the data subject is aware of the purpose for which the Department is collecting the data at the point of collection and of the categories or person/organisation to whom it may be disclosed. This is a normal part of the claim registration and maintenance function and is noted on Departmental application forms. Investigating Officers also make this clear during the course of any enquiries. Obtain personal data only when there is a clear purpose for doing so, obtain only that which is necessary for fulfilling that purpose and ensure that it is used only for that purpose. Rule 3. (disclosing personal data) Personal data should only be disclosed in ways that are necessary or compatible with the purpose for which it is held. Do not disclose any personal data to any third party without the consent of the data subject (see exceptions below). Personal data should not be disclosed to work colleagues unless they have a legitimate interest in the data in order to fulfil official duties. Permitted disclosures of personal data Personal data can be disclosed without the express written consent of the data subject in the following circumstances: - to the data subject or to a person acting on his/her behalf: - at the request or with the consent of the data subject or a person acting on his/her behalf; - where the data subject has already been made aware of the person/ organisations to whom the data may be disclosed; - required by law or a court order; - required for legal advice or legal proceedings, where the person making the disclosure is a party or witness; - required for the purposes of preventing, detecting or investigating offences, apprehending or prosecuting offenders, or assessing moneys due to the State, a local authority or a health board; - authorised for safeguarding the security of the State (if it is in the opinion of a member of the Garda Siochana not below the rank of chief superintendent or an officer of the Permanent Defence Forces not below the rank of colonel); - required urgently to prevent injury or damage to health or serious loss of or damage to property; - required to protect the international relations of the State. Further detailed guidelines will issue on the procedures to be followed in relation to the disclosure of personal data to authorised third parties. NOTE: Apart from receiving a query from the data subject or a person acting on his/her behalf, if you receive a request for information required for any of these reasons you should pass it on to your supervisor/manager. If the supervisor/manager has any doubt about the query s/he should contact Business Information Security Unit (BISU). Rule 4. (securing personal data) The Department must protect personal data from unauthorised access when in use and in storage and must protect it from inadvertent destruction, amendment, loss, disclosure, corruption or unlawful processing. Personal electronic data should be subject to appropriate stringent controls, such as passwords, access logs, back-ups etc, Screens, print-outs, documents and files showing personal data should not be visible to unauthorised persons, Personal manual data should be held securely in locked cabinets, locked rooms, or rooms with limited access, Special care must be taken where mobile computing and storage devices, such as laptops, are used. Further Guidelines will issue in respect of mobile devices. The Department, as a Data Controller, in disclosing personal data to a Data Processor (e.g. a Branch Office) should only do so under a written agreement, specifying the security arrangements which must be in place. Rule 5. (accuracy and completeness of personal data) Data subjects have a responsibility to advise the Department of any errors or changes to data. Once informed, it is imperative that the data be amended accordingly. Rule 7. (retention and disposal of personal data) Data should not be kept for any longer than is necessary for the purpose for which it was collected and should not be subject to further processing that is not compatible with that purpose. Personal data should be disposed of securely when no longer required. The method should be appropriate to the sensitivity of the data. Shredding or incineration is appropriate in respect of manual data; and reformatting or overwriting in the case of electronic data. Particular care should be taken when PCs or laptops are transferred from one person to another within the Department, or outside the Department, or when being disposed of. Further detailed guidelines will issue in respect of appropriate retention and disposal procedures. Rule 8. (rights of data subjects) The Data Protection Acts provide for the right of access by the data subject to his or her personal information. Subject Access Requests are dealt with by Data Access Section. Accordingly, if you receive a request of this nature you should send it to Data Access Section, Shannon Lodge, Carrick-on-Shannon, for immediate action. Responsibilities of data subjects All staff, customers and other data subjects are entitled to be informed how to keep their personal information up-to-date. All staff, customers and other data subjects are responsible for: - checking that any information that they provide to the Department is accurate and up-to-date; - informing the Department of any errors or changes to details that they have provided, e.g. change of address. Implementation of Data Protection Guidelines The Department takes its Data Protection obligations very seriously. All staff and third parties who are authorised to have access to personal data held by the Department must ensure that they are familiar with and adhere to these Guidelines. Breaches of Data Protection. The Department will investigate all allegations of suspected breaches of data protection. All complaints, from whatever source (e.g. the data subject, staff, management, etc.), should be forwarded to line management who must immediately notify the Head of Information Security (Principal Officer, Risk Management Division) who is responsible for the co-ordination of investigations across the Department. Any breach of trust with regard to the confidentiality of personal data will be treated as serious misconduct under the Disciplinary Code and comes under immediate consideration for dismissal. Further Information If you have any queries or require clarification on any aspect of these procedures and guidelines; please contact the Business Information Security Unit (BISU), Risk Management Division, Goldsmith House. All contact with the Data Protection Commissioner's Office should also be channelled through this section. Extensive information is available from the Data Protection Commissioners website www.dataprotection.ie. Issued 30 July 2008
1.1 1.2 1.3 1.4 1.5 2.1 3.1 4.1 4.2 4.3 5.1 6.1 7.1 8.1 9.1 10.1 11.1 12.1 13.1 14.1 15.1 16.1 16.2 17.1 18.1 19.1 20.1 21.1 22.1 23.1 23.2 24.1 25.1 25.2 25.3 25.4 25.5 26.1 27.1 27.2 27.3 27.4 28.1 29.1 30.1 30.2 30.3 30.4 30.5 31.1 32.1 33.1 33.2 33.3 33.4 33.5 34.1 35.1 36.1 37.1 38.1 39.1 40.1 41.1 42.1 43.1 44.1 45.1 46.1 47.1 48.1 49.1 50.1
Tá na hAchtanna um Chosaint Sonraí 1988 agus 2003 ceaptha le príobháideachas daoine a chosaint. Tugann siad éifeacht do Choinbhinsiún Chomhairle na hEorpa um Chosaint Sonraí. Tugann na hAchtanna cearta do dhaoine aonair i ndáil le príobháideachas a sonraí pearsanta chomh maith le freagrachtaí a thabhairt do na daoine sin a dhéanann na sonraí dá leithéid a choinneáil agus a phróiseáil. Is é an tArd-Rúnaí an Rialaitheoir Sonraí i gcomhair na Roinne. Is í an rannóg atá ainmnithe chun feidhmeanna an Rialaitheora Sonraí sa Roinn a chomhlíonadh ná an tAonad Slándála um Fhaisnéis Ghnó a dtugtar a shonraí teagmhála thíos. Chun amharc ar ráiteas na Roinne ar Phríobháideachas agus ar Fhianáin, féach anseo, le do thoil. Cad is "sonraí pearsanta" ann? Ciallaíonn sonraí pearsanta sonraí maidir le duine atá aitheanta nó duine is féidir a aithint ó na sonraí féin nó ó na sonraí i dteannta faisnéise eile atá i seilbh na Roinne nó ar dócha go dtiocfaidh siad i seilbh na Roinne. Cuimsíonn sonraí pearsanta aon fhaisnéis a bhaineann le duine beo inaitheanta. Is féidir na sonraí seo a choinneáil ar ríomhairí nó i gcomhaid láimhe. Dualgais na Roinne Is iad dualgais na Roinne faoi na hAchtanna um Chosaint Sonraí ná: - nach mór na sonraí a fháil agus a phróiseáil go cóir; - nach mór na sonraí a bheith cruinn, iomlán agus, i gcás inar gá sin, a choinneáil bord ar bhord leis na hathruithe is déanaí; - gan na sonraí a fháil ach chun críche amháin nó níos mó ná críoch amháin atá sonraithe, follasach agus dlisteanach; - gan a thuilleadh próiseála a dhéanamh ar na sonraí ar mhodh a bheidh ar neamhréir leis an gcríoch sin; - nach mór na sonraí a bheith leordhóthanach, ábhartha agus gan a bheith iomarcach i ndáil leis an gcríoch dár bailíodh iad nó dá ndéantar a thuilleadh próiseála orthu; - gan na sonraí a choinneáil níos faide ná mar is gá chun na críche sin; - nach mór bearta cuí slándála a dhéanamh in aghaidh rochtana neamhúdaraithe ar na sonraí nó in aghaidh athrú, nochtadh nó milleadh neamhúdaraithe a dhéanamh ar na sonraí, go háirithe i gcás ina dtarraingíonn an phróiseáil tarchur sonraí thar líonra, agus in aghaidh na gcineálacha mídhleathacha próiseála eile go léir (Baineann an Roinn feidhm as na bearta teicniúla fisiciúla is cuí, lena n-áirítear oiliúnt agus feasacht na foirne agus is go tráthrialta a dhéantar athbhreithniú orthu seo); - nach mór na sonraí pearsanta go léir i seilbh na Roinne a chlárú leis an gCoimisinéir Cosanta Sonraí; - go bhfuil dualgas cúraim orainn i dtaobh na n-ábhar sonraí atá i gceist, is é sin le rá nach mór dúinn a bheith cúramach nach mbeimid inár gcúis dochair ná imní d’aon duine dár gcustaiméirí trí, mar shampla, faisnéis mhíchruinn a choinneáil ar ár gcomhaid, nó trí shonraí pearsanta a nochtadh do dhuine éigin nach bhfuil i dteideal na sonraí seo. Tugann an Roinn aird an-mhór ar a dualgais agus déanann an Roinn an beart is láidre má bhaineann aon bhall foirne mí-úsáid as faisnéis chustaiméara. Pléitear le haon sárú iontaoibhe maidir le rúndacht na faisnéise mar mí-iompar tromchúiseach faoin gCód Smachta agus féadfaidh sé a bheith mar thoradh air seo go gcuirfear smachtbhannaí i bhfeidhm, lena n-áirítear an ball foirne a bhriseadh as a p(h)ost. Roinnt ceisteanna coitianta - Conas is féidir liom rochtain a fháil ar shonraí pearsanta fúm atá i seilbh na Roinne Coimirce Sóisialaí? - Má chreidim nach cruinn na sonraí fúm i seilbh na Roinne Coimirce Sóisialaí, conas is féidir liom a chur faoi deara go gceartófar iad? - Conas is féidir liom a fháil amach má fuair duine éigin rochtain ar mo chuid faisnéise pearsanta gan chead agus/nó má chuir sé/sí chuig duine eile í? - Cén áit ar féidir a thuilleadh faisnéise a fháil ar mo chearta faoi na hAchtanna um Chosaint Sonraí? Conas is féidir liom rochtain a fháil ar shonraí pearsanta fúm atá i seilbh na Roinne Coimirce Sóisialaí? Is ann do dhá bhealach inar féidir leat faisnéis phearsanta a fháil. Féach thíos faoi: Ceart Rochtana agus Saoráil Faisnéise (SF/FOI). Ceart Rochtana Faoi alt 4 de na hAchtanna, tá ceart ag duine chun cóip a fháil dá s(h)onraí pearsanta. Ní foláir an iarraidh rochtana ábhair (IRÁ/SAR) seo a dhéanamh i scríbhinn trí sheirbhís an phoist agus is gá an táille riachtanach €6.35 a íoc in éineacht leis an iarraidh seo. Is féidir leat iarraidh rochtana ábhair a dhéanamh trí scríobh chuig an Rannóg Rochtana Sonraí, An Roinn Coimirce Sóisialaí, Lóiste na Sionainne, Cora Droma Rúisc, Contae Liatroma. Ba chóir go mbeadh d’iarraidh chomh sonrach agus ab fhéidir, chun a chur ar ár gcumas teacht ar an áit a shealbhófaí na sonraí áirithe sin agus ba chóir freisin go gcuimseofaí fianaise ar d’aitheantas féin amhail fótachóip de do phas nó fótachóip de do cheadúnas tiomána. Eiseofar freagra ar d’iarraidh rochtana chugat a luaithe is féidir agus ar aon tslí laistigh de dhaichead lá. An bhfuil eisceachtaí ar bith ón gceart rochtana? Leagtar amach in ailt 4 & 5 de na hAchtanna um Chosaint Sonraí líon beag dálaí inar féidir teorainn a bheith le do cheart chun taifid phearsanta a fheiceáil. Tá sé seo riachtanach d'fhonn cothromaíocht a chinntiú idir cearta an duine aonair, ar thaobh amháin, agus riachtanais thábhachtacha áirithe na sochaí sibhialta, ar an taobh eile. Mar shampla, tá an ceart rochtana ar shonraí leighis srianta i ndálaí an-teoranta áirithe, i gcás go gcuirfí isteach ar shláinte agus ar leas meabhrach an duine trí rochtain a fháil ar na sonraí sin. Cuirtear srian chomh maith le do cheart rochtain a fháil ar thorthaí scrúduithe agus ar fhaisnéis a bhaineann le daoine eile. Saoráil Faisnéise (SF/FOI) Slí eile le faisnéis phearsanta a fháil is ea faoi na hAchtanna um Shaoráil Faisnéise. Faoi na hAchtanna um Shaoráil Faisnéise, tá ceart ag gach duine, faoi réir srianta áirithe, chun rochtain a fháil ar fhaisnéis i seilbh Ranna Rialtais, gníomhaireachtaí agus comhlachtaí sainithe eile a fhaigheann maoiniú ón Stát. Thairis sin, ceadaíonn na hAchtanna do dhaoine rochtain a lorg ar a shonraí féin i seilbh na gcomhlachtaí dá leithéid. Ní ghearrtar aon táille as an tseirbhís seo. Is féidir leat iarraidh Saorála Faisnéise a dhéanamh trí scríobh chuig an Rannóg Saorála Faisnéise, An Roinn Coimirce Sóisialaí, Lóiste na Sionainne, Cora Droma Rúisc, Contae Liatroma. Ba chóir go mbeadh d’iarraidh chomh sonrach agus ab fhéidir, chun a chur ar ár gcumas teacht ar an áit a shealbhófaí na sonraí áirithe sin. Má chreidim nach cruinn na sonraí fúm i seilbh na Roinne Coimirce Sóisialaí, conas is féidir liom a chur faoi deara go gceartófar iad? Ceart ceartúcháin Faoi alt 6 de na hAchtanna um Chosaint Sonraí, tá ceart ag duine chun a chur faoi deara go gceartófar a s(h)onraí pearsanta, má tá siad míchruinn, nó go scriosfar iad, mura bhfuil fáth dlisteanach leis na sonraí a choinneáil. Déanann an Roinn gach iarracht chun a chinntiú go bhfuil do shonraí pearsanta cruinn agus nach gcoinneofar iad ach go ceann na tréimhse a bheidh gá leo. Má tá údar agat lena chreidiúint nach cruinn na sonraí pearsanta i seilbh na Roinne nó nach cóir a thuilleadh iad a choinneáil, is féidir leat scríobh chuig an Roinn i dtaobh an ghnó trína leagan amach go soiléir cad iad na sonraí pearsanta atá i gceist agus cad iad na fáthanna a measann tú iad a bheith míchruinn agus/nó cén fáth nach cóir a thuilleadh don Roinn iad a choinneáil. Ní ghearrtar aon táille as an tseirbhís seo. Scríobh chuig Seirbhísí Aitheantais na gCliant, An Roinn Coimirce Sóisialaí, Lóiste na Sionainne, Cora Droma Rúisc, Contae Liatroma. Conas is féidir liom a fháil amach má fuair duine éigin rochtain ar mo chuid faisnéise pearsanta gan chead agus/nó má chuir sé/sí chuig duine eile í? Má tá imní ort go bhfuil rochtain faighte ag oifigeach ar do chuid faisnéise pearsanta go neamhdhlíthiúil nó gur féidir go bhfuil do shonraí pearsanta nochta do thríú páirtí go neamhdhlíthiúil, is féidir leat gearán foirmiúil i scríbhinn a dhéanamh chuig:- An tAonad Slándála um Fhaisnéis Ghnó An Roinn Coimirce Sóisialaí Teach Goldsmith Sráid an Phiarsaigh Baile Átha Cliath 2. Déanfaidh an Roinn an gnó a imscrúdú agus cuirfear toradh an imscrúdaithe in iúl duit a luaithe is féidir. Cén áit ar féidir a thuilleadh faisnéise a fháil ar mo chearta faoi na hAchtanna um Chosaint Sonraí? Tairgeann Láithreán Gréasáin an Choimisinéara Cosanta Sonraí míniú ar na cearta agus na freagrachtaí faoi na hAchtanna um Chosaint Sonraí(http://www.dataprotection.ie ) agus tá faisnéis ar fáil freisin ó Oifig an Choimisinéara Cosanta Sonraí Teach na Canála, Bóthar an Stáisiúin, Cúil an tSúdaire, Contae Laoise. Is féidir leat teagmháil a dhéanamh le hOifig an Choimisinéara Cosanta Sonraí tríd an ríomhphost info@dataprotection.ie nó ar an nguthán 1890 252231. Mionathraíodh an ráiteas seo ar Chosaint Sonraí sa Roinn Coimirce Sóisialaí (RCS) an uair dheireanach i Meitheamh 2016