Data Protection

Data Protection

Data Protection and the General Data Protection Regulation (GDPR)

Introduction

On the 25^th May 2018 the General Data Protection Regulation (GDPR) came into effect. In Ireland GDPR has been given legislative effect in the new Data Protection Act 2018.

This new legislation updates the current law in relation to data protection and seeks to strengthen and unify data protection for all individuals within the European Union including Ireland. It grants new and enhanced rights for all individuals in relation to their own personal information. An individual about whom data is held by an organisation is referred to as a data subject.

Mayo, Sligo and Leitrim Education & Training Board (MSLETB) is the state education and training authority for the Mayo, Sligo and Leitrim region established by the Education and Training Boards Act 2013.

To fulfil its statutory obligations MSLETB gathers, stores and processes large amounts of data on a variety of data subjects. This would include students, learners, staff, third parties and members of the public. This personal data can range from some personal details and CCTV footage to financial transactions. Personal data is any data that permits an individual to be identified.

MSLETB is committed to a policy of protecting the rights and freedoms of individuals with respect to the processing of their personal data.

The Data Protection regulations and legislation require the staff of MSLETB to process data fairly and to ensure the security of that data.

MSLETB is required to:

• explain why personal data is being gathered
• outline the purpose for which it will be used
• only gather the minimum amount of data necessary
• inform persons whether MSLETB will share data with anyone else
• only keep data for as long as it is needed
• protect data from loss or theft
• keep data accurate and up to date

GDPR places restrictions on what MSLETB is allowed to do with personal data such as passing personal information on to third parties, transferring information outside the EU or using it for direct marketing.

GDPR also provides individuals with important rights.

GDPR therefore:

• reinforces the right of a person to ask for a copy of all personal data held relating to them personally
• gives a right to object to direct marketing practices,
• allows a person to ask for inaccuracies in their personal data to be corrected,
• give a right to data portability,
• in certain cases it allows for personal data to be erased,
• gives the right to seek compensation through the courts where privacy rights have been infringed.

Also under the new legislation the digital age of consent has been set at 16. This means that social media and other online companies will need parental consent where they wish to use the personal data of a child under the age of 16 for marketing purposes or for creating personality profiles.

MSLETB has developed a range of policies that must be adhered to in order to comply with GDPR:

The Rights of a Data Subject under the General Data Protection Legislation

A Data Subject has the following rights under Data Protection Legislation which can be exercised at any time:

• Right of access
• Right to Rectification
• Right to be forgotten
• Right to restrict processing
• Right to data portability
• Right to object and to object to automated decision making /profiling
• Right to complain to the Supervisory Authority

For further information please consult our Data Protection Policy or contact our Data Protection Officer.

MSLETB has appointed a Data Protection Officer (DPO) on an interim basis:

For further information on Data Protection and the General Data Protection Regulation please visit: The Data Protection Commission