On the 25th May 2018 the General Data Protection Regulation (GDPR) came into effect. In Ireland GDPR has been given legislative effect in the new Data Protection Act 2018.
This new legislation updates the current law in relation to data protection and seeks to strengthen and unify data protection for all individuals within the European Union including Ireland. It grants new and enhanced rights for all individuals in relation to their own personal information. An individual about whom data is held by an organisation is referred to as a data subject.
Longford and Westmeath Education and Training Board (LWETB) is the state education and training authority for the Longford and Westmeath region established by the Education and Training Boards Act 2013.
To fulfil its statutory obligations LWETB gathers, stores and processes large amounts of data on a variety of data subjects. This would include students, learners, staff, third parties and members of the public. This personal data can range from some personal details and CCTV footage to financial transactions. Personal data is any data that permits an individual to be identified. LWETB is committed to a policy of protecting the rights and freedoms of individuals with respect to the processing of their personal data.
The Data Protection regulations and legislation require the staff of LWETB to process data fairly and to ensure the security of that data. LWETB is required to:
• explain why personal data is being gathered
• outline the purpose for which it will be used
• only gather the minimum amount of data necessary
• inform persons whether LWETB will share data with anyone else
• only keep data for as long as it is needed
• protect data from loss or theft
• keep data accurate and up to date
GDPR places restrictions on what LWETB is allowed to do with personal data such as passing personal information on to third parties, transferring information outside the EU or using it for direct marketing.
GDPR also provides individuals with important rights. GDPR therefore:
• reinforces the right of a person to ask for a copy of all personal data held relating to them personally
• gives a right to object to direct marketing practices,
• allows a person to ask for inaccuracies in their personal data to be corrected,
• give a right to data portability,
• in certain cases, it allows for personal data to be erased,
• gives the right to seek compensation through the courts where privacy rights have been infringed.
Also, under the new legislation the digital age of consent has been set at 16. This means that social media and other online companies will need parental consent where they wish to use the personal data of a child under the age of 16 for marketing purposes or for creating personality profiles.
LWETB has developed a range of policies that must be adhered to in order to comply with GDPR. Links to these policies are available below.
LWETB has appointed a Data Protection Officer as the point of contact for all data privacy queries that you may have including subject access requests. His name and contact details are David McGreal, Longford and Westmeath Education and Training Board, Marlinstown Business Park, Mullingar, Co. Westmeath. Telephone Number 044 9394015. If you have any queries, please contact our DPO at firstname.lastname@example.org
For more information on Data Protection and the work of the Data Protection Commission, click here
As part of our compliance with Data Protection legislation, LWETB has developed the following policies: