This Privacy Notice will set out the following:
Children’s Health Ireland (CHI) is committed to safeguarding the confidentiality and privacy of all personal information collected through the Data Subject Notification (DSN) process. The purpose of this notice is, in the interest of transparency, to explain how we collect and use personal information.
CHI is the Data Controller for all personal information which is collected and used by this website for the purpose of the DSN process. A Data Controller is the legal entity which determines how and why Personal Data is collected and used. CHI’s headquarters are located at Children’s Health Ireland, Herberton, St James’s Walk, Rialto D08 HP97, Ireland. You can view CHI’s full Privacy Policy here.
CHI has appointed a Data Protection Officer to oversee CHI’s compliance with its data protection obligations. You can contact the CHI Data Protection Officer (DPO) by email at the emails: dpo@olchc.ie for Crumlin and Tallaght and dpo@cuh.ie for Temple Street and Connolly.
‘Personal Data’ means any information relating to you which allows CHI to identify you, such as your name & address, contact phone numbers and email address.
CHI will collect and use the following Personal Data about you in relation to your use of the DSN Portal:
| Description | What its used for |
|---|---|
| First and last name | We collect this information to help us identify you when you log onto the DSN Portal during the registration process. It is used for verification purposes and to deal with your queries |
| Personal Identification Number (PIN) | The PIN provided to you in your notification letter will be used to help us identify you when you log onto the DSN Portal during the registration process. |
| Phone Number | We collect your mobile phone number to help us identify you and to send relevant service-based SMS notifications. |
| Date of Birth | We collect this information to help us identify you |
| Sex | We collect this information to help us identify you |
| Address | We collect this information to help us identify you |
| Email Address | We collect your email address via the DSN Portal during the portal registration process to help us identify you |
| IP Address | IP address is recorded only when the user accesses the DSN website |
| Identity documents of individuals (‘data subjects’ and 'legal guardians') who are successfully authenticated in ID-Pal | We collect this information during the ID Verification process. Users who consent to the ID verification process are requested to upload a photo of government issued ID in the integrated ID verification system (ID-Pal) to help us verify your identity and prevent fraud. |
| Photo - authenticated in ID-Pal | As part of provisioning access for data subjects on the DSN portal, data subjects will have an option to consent for online ID verification. As part of this online ID verification process, CHI via ID-Pal will be storing incoming information which is voluntarily provided. This will involve Biometric data (photo) and Personal Data (ID documents) to verify their identity. |
| Chat | We collect this information to help us manage your queries |
| SMS Messages | We collect this information to help us manage your queries |
| Identity documents (Photocopies provided by post) | We collect this information where a data subject chooses to verify your identity by sending us a photocopy of your government issued ID. |
| Proof of Legal Guardianship |
We collect this information to ascertain the legal proof of Guardianship/Parent of the affected data subject, when that data subject is a minor. Legal guardians/parents may be required to share the following documents based on their relationship with the affected data subject.
Mothers: Child’s birth cert or court order appointing them as guardian Fathers: Child’s birth cert and marriage certificate to child’s mother or guardianship declaration signed by child’s mother or court order appointing them as guardian Other Legal Guardians: Court order or other legal/court documents appointing them as child’s guardian |
| Utility bills or other proof of address (Provided by post) | We may collect this information when a data subject requests a change of address. Utility bills will be used to verify data subject’s current address. |
We will handle any data you share with CHI in line with the General Data Protection Regulation (GDPR).
Any Personal Data we collect from you on this website will only be used by CHI for the following purposes:
It is a Legal and regulatory obligation for CHI to contact the impacted data subjects and share details of the breach and further facilitate any requests by the data subjects regarding the breached data. Throughout this process, Personal Data will be used only where necessary for the purposes set out above.
Under data protection law (such as the General Data Protection Regulation (GDPR)), we can only process Personal Data where we have a legal basis to do so. CHI’s legal basis for processing Personal Data in the course of the DSN process is as follows:
Cookies and other tracking tools used on the DSN portal, and this website are retained for the duration of their “Lifetime” set out in section 7.
Personal Data collected and processed for identification and verification checks by automated means via ID-Pal is retained (i) where successful, for the life of the DSN service; or (ii) where unsuccessful, for no longer than 30 days.
All other Personal Data collected by CHI is retained for the life of the DSN process and where necessary for the establishment, exercise or defence of any legal claims, proceedings or related complaints concerning your Personal Data based on the relevant limitation periods for taking related legal action. For these purposes, such Personal Data collected and processed as part of the DSN process will be retained for the life of the DSN process and up to 7.5 years. CHI will conduct scheduled reviews of its retention periods for this purpose to ensure that your personal data is not kept for longer than is necessary. Personal Data may be retained for a longer period where necessary due to the existence of, or where CHI becomes aware of likely, related legal proceedings.
When CHI no longer needs your Personal Data, we will securely delete or destroy your Personal Data.
CHI staff, agents and suppliers who are directly involved with the management and delivery of the DSN portal. These suppliers provide services including but not limited to identity verification services, telephony and SMS website portal and customer relationship management portal.
In certain situations, CHI may have to disclose information to other agencies where permitted or required by law. The categories of other organisations that CHI may share information with include the following:
All CHI staff, agents and suppliers who may have access to Personal Data shall be bound to CHI via confidentiality agreements and are obliged to keep your Personal Data secure, and to use it only for the purposes specified by CHI. A full list of suppliers is available upon request via the contact details in section 3 (The Data Protection Officer (DPO)) above.
There are special requirements set out under Chapter V of the GDPR to regulate transfers of Personal Data outside the European Economic Area (EEA) and to ensure that adequate security measures are in place to safeguard and maintain the integrity of your transferred Personal Data.
Where we transfer your Personal Data outside the EEA to our suppliers, we will make sure that it is done in compliance with the provisions of data protection laws (including Chapter V of the GDPR) such that Personal Data is protected to the same extent as in the EEA and we will use at least one of the following safeguards:
Some of the suppliers involved with the Data Subject Notification Process who provide SMS communication services as part of the identity and verification process may process your mobile number outside the EEA to the United States.
The supplier used for sending SMS communication relies upon EU approved Binding Corporate Rules (BCRs) and SCCs to ensure compliance with applicable data protection laws (including the GDPR) when processing Personal Data on behalf of CHI.
For further information on international data transfers involving Personal Data in the delivery of the DSN process, please contact us via the contact details in section 3 (The Data Protection Officer (DPO)) above.
Under certain circumstances, data subjects have certain legal rights concerning their personal information and the manner in which we process it, such as:
| Right of access | You have the right to request a copy of the information that CHI holds about you. |
|---|---|
| Right of rectification | You have a right to correct data that CHI holds about you that is inaccurate or incomplete. |
| Right to erasure | You can ask for the data CHI holds about you to be erased from our records where CHI no longer needs the Personal Data for the purpose for which we collected it or where you withdraw consent to our use of your Personal Data and where there is no other legal basis for continuing to use it. This right does not apply where Personal Data is required for the purpose of compliance with a legal obligation. Therefore, this right is not applicable in respect of much of the processing undertaken for the DSN process. |
| Right to restriction of processing | Where certain conditions apply, you have the right to restrict the processing. Where this right is exercised, we are still permitted to store your Personal Data, but other use of the data is prohibited, save in certain limited circumstances. |
| Right of portability | You have the right to have the data we hold about you in a format that enables you to transfer that Personal Data to another organisation where processing your Personal Data on the basis of consent or on the fulfilment of a contract. This right does not apply where Personal Data is required for the purpose of compliance with a legal obligation. Therefore, this right is not applicable in respect of much of the processing undertaken for the DSN process. |
| Right to object | In certain circumstances, you have the right to object to certain types of processing of your Personal Data. We will comply with such objection unless there are compelling legitimate grounds to do so or we need to use your Personal Data in connection with any legal claims. |
| Right not to be subject to a decision based solely on automated processing which results in legal or similarly significant effects upon you unless certain conditions are met | Where your identity is verified by ID-Pal, this conducts identification and verification checks by automated means. This processing is only carried out where you have explicitly consented to the processing. You may contest the outcome of this verification processing by contacting the email address below. You may also choose to have your identity verified via other means such as by providing your verification documents by post. |
| Right to review | In the event that CHI’s refuses your request under the right of access, we will provide you with a reason as to why. |
| Right to withdraw your consent | Where you have uploaded your biometric data for the purpose of verification, you may withdraw your consent at any time. This will not affect the lawfulness of our processing before the withdrawal. |
| Right to make a complaint to the Data Protection Commission | If you do not think that we have processed your Personal Data in accordance with this Notice, please contact us in the first instance (see contact details below or in section 3 (The Data Protection Officer (DPO)) above). If you are not satisfied, you can make a complaint to the Data Protection Commission. Please see further information below. |
If you wish to exercise any of these rights, then please submit a request, to either: dpo@olchc.ie, for Crumlin and Tallaght dpo@cuh.ie for Temple Street and Connolly. When submitting a request, CHI may need information from you to confirm your identity. Once your identity has been confirmed, CHI will supply you with your information free of charge, however, we may charge a reasonable fee if we believe your request is clearly unfounded, excessive, or repetitive.
If you are unhappy with the way that CHI has processed your Personal Data, please contact CHI’s Data Protection Officer (DPO). You can contact them by email at the email addresses: dpo@olchc.ie, for Crumlin and Tallaght or dpo@cuh.ie for Temple Street and Connolly. If we are not able to resolve your complaint, you have the right to lodge a complaint directly with our supervisory authority, the Data Protection Commission. Information on how to do this is available on the Commission’s website (www.dataprotection.ie).