Privacy

Summary

Cheshire Ireland obtains, gathers and records data in relation to individuals and as a result of this is obliged to process data (that is working with and storage of the data) fairly, lawfully and openly in order to comply with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (‘GDPR’). This notice will set out the types of data we process, why we do so, with who that data is shared and who you can contact if you have any queries or concerns in relation to your data and your privacy rights.

Data Controller

Cheshire Ireland is a not for profit company and a registered charity that works to serve adults with physical and/or neurological disabilities.

Cheshire Ireland is a data controller as it processes and keeps data relating to people. Data is processed in manual (paper) and electronic (eg computer, laptop, tablet etc) form.

Data Protection Officer

Cheshire Ireland has nominated data protection officers who have responsibility in relation to data protection compliance in the organisation. Our data protection officer(s) can be contacted on dp@cheshire.ie or please call Central Office on 01-297 4100.

What types of data is processed

There are two main types of data:

  1. Personal Data

  2. Special Categories of Personal Data (this was, until recently, called Sensitive Personal Data)

Personal Data includes any information that might identify a person (for example a person’s name, address etc).

Special Categories of Personal Data includes reference to certain types of data such as a person’s health, race, ethnicity, political opinions, religious and/or philosophical beliefs, trade union membership and sexual orientation. It also includes data relating to a person’s genetics or biometric data (that is data which relates physically to a person and identifies them such as their fingerprint).

Because Cheshire Ireland provides clinical, social and support related services to people with disabilities it processes personal data and special categories of personal data. This is also the case for the people it employs as we often hold health related data (such as occupational health assessments etc) which may be of relevance to their employment.

In certain circumstances Cheshire Ireland may only process personal data (and not special categories of personal data) relating to individuals (for example where an individual signs a ‘visitor’s book’ within a service, where a relative of a person we support provides their contact details in case of emergency etc).

Why does Cheshire Ireland process the data. What is the Legal Basis to do so?

Cheshire Ireland must only process data legally and in way that is fair and transparent. It shall generally process and share personal data on the following grounds:

  1. It is necessary for us to process the data in order to provide our services to the people we support and/or employ to provide such services (by way of contract); and/or

  2. It is necessary for data to be processed in order to comply with a legal obligation (for example in our designated centres we are required to keep certain records in line with the Health Act 2007 Regulations 2013 for inspection by HIQA); and/or

  3. It is necessary to pursue the legitimate interests of Cheshire Ireland; in order to best support the people served by the organisation it is necessary to process their data so that we can ensure that way in which services are provided are individualised and proportionate and the data of the people employed in order to fulfil that purpose and relevant stakeholders’ data (eg the data of family members, funders, partners etc) for funding, reporting etc; and/or

  4. Consent has been given by an individual to Cheshire Ireland to process their data for one or more purposes.

In relation to the processing of special categories of personal data in addition to the above it shall lawfully do so because:

  1. It is necessary for the provision of health and social care related services and for the assessment of the working capacity of employees of Cheshire Ireland; and/or

  2. The processing is carried out during the course of Cheshire Ireland’s activities as a not for profit organisation where the processing relates to individuals who have regular contact in relation to its mission, vision and values and where the data is not disclosed outside the organisation; and/or

  3. Explicit consent has been given by a person to Cheshire Ireland to process their data for one or more specific purposes.

What does Cheshire Ireland do with your data?

Cheshire Ireland collects, records, stores, organises, uses, structures, analyses, makes available, disseminates, retains, erases and destroys (after applicable periods as outlined below) as necessary in order to:

  • Provide services to the people supported by Cheshire Ireland (which includes data recording and practices which are required by HIQA) The types of services provided can range from and include various elements such as clinical and social care type services and/or tenancy services and/or accommodation services.

  • Employ staff to provide services and to run the organisation in an appropriate manner;

  • Report to the HSE and other relevant stakeholders as required;

  • Advocate on your behalf to relevant stakeholders.

Cheshire Ireland is obliged to ensure that the processing of your data is secure and in a way that respects your privacy.

Categories of third parties who might receive your data

In some circumstances we have to share your information in order to meet our obligations as your service provider/employer. We share information we have about you with your consent and/or in accordance with this Privacy Notice as follows:

Internally: As is required in order to undertake the work of the organisation.

Third Party Stakeholders:

  • Regulators/Statutory Agencies: Which includes the HSE (who we are required to report to as a condition of our funding), HIQA, Residential Tenancies Board in the case of our services and service provision and in the case of our employees the Revenue, Gardai (in the case of seeking Garda E-Vetting and/or in the event of any lawful obligation such as under the Criminal Justice (Withholding of Information on offences against Children and Vulnerable Persons) Act 2012);

  • Third Party Service Providers: Which includes agency staff that are sometimes required where directly employed staff are unavailable to provide services, emergency response services and various approved housing bodies to assist in the management of your tenancy or in an attempt to find suitable accommodation;

  • Public Bodies: Which includes local authorities (in the case of tenants of our social housing accommodation and where RAS/HAP payments are received), social welfare (in the case of rent supplement where it’s paid directly to us or where a person is transferring from their payment over to RAS/HAP);

Third Party Processors:

  • IT Support: Cheshire Ireland uses a professional agency to provide its IT support and it therefore has access to its data but only for the specific purposes of providing support and protection to the said data.

  • Payroll/TMS: Which includes the IT systems used by employees to manage their working time, clocking in and clocking out and the payroll system that processes wages on a period basis

  • Occupational Health: Employees may be referred to occupational health for support and/or assessment.

How long does Cheshire Ireland keep your data?

We will retain your information only for as long as is necessary and required for the purposes set out in this Privacy Notice or as needed to provide services to you. Cheshire Ireland has a data retention schedule attached to its Data Management Policy which sets out the retention periods that Cheshire Ireland has for various types of records we process including health and social care records and human resource records. If you have a query in relation to any data we hold on you or for how long we hold it, please contact the Data Protection Officer(s) as mentioned above.

What rights do you have?

You have a number of rights in relation to how we use your personal information. In some circumstances you may have the right to object to us processing your data and to request for your records to be erased.

Please note that where we provide services to you or are your employer we cannot erase your data until such time as our obligation has expired for us to legally retain your information.

You also have the right to obtain a copy of the personal information we hold about you and/or to have any information we hold about you corrected (where same is inaccurate).

How can you make a complaint or request in relation to your data?

You can contact our Data Protection Officer(s) during normal working hours in relation to any queries or concerns you may have in relation to your data at the above contact email address or phone number. If you have an urgent query (outside office hours) please contact your service manager/service coordinator where you use our services and your line manager where you are employed by us.

You have the right to file a complaint against us with the Irish Data Protection Commissioner which is Ireland’s Data Protection Supervisory Authority.

Office of the Data Protection Commissioner

Canal House, Station Road, Portarlington, Co. Laois, R32 AP23, Ireland.
Phone +353 (0761) 104 800 · LoCall 1890 25 22 31 · Fax +353 57 868 4757 · email info@dataprotection.ie