Table of Contents

1. Title
2. Introductory Statement
3. Data Protection Principles
4. Scope
5. Definition of Data Protection Terms
6. Rationale
7. Other Legal Obligations
8. Personal Data

8.1. Staff Records
8.2. Student Records
8.3. Annual Post-Primary School October Return/Examination Entries (known as the “October Returns”)
8.4. Records of students (and parents/guardians) applying for further education grants and scholarships
8.5. Examination Results
8.6. Records of students (and parents/guardians) applying for courses/ programmes
8.7. Records of students (and parents/guardians of ‘under 18s’) applying for adult, community and further education courses/programmes
8.8. ETB, Boards of Management and Selection Boards records
8.9. Creditors
8.10. Charity Tax-Back Forms
8.11. CCTV images/recordings

9. Links to other Policies and to Curriculum Delivery
10. Processing in line with Data Subject’s Rights
11. Dealing with an Access Requests
12. Providing Information over the ‘phone
13. Implementation arrangements, roles and responsibilities
14. Ratification and communication
15. Monitoring the implementation of the policy
16. Reviewing and Evaluating the Policy

Appendices
Appendix 1: Data Protection Statement (for inclusion on relevant forms when personal information is being requested)
Appendix 2: Protecting the confidentiality of Personal Data Guidance Note” (CMOD Department of Finance, Dec. 2008)
Appendix 3: Records Management Procedures
Appendix 4: Record Retention Schedule
Appendix 5: Personal Data Rectification/Erasure Form
Appendix 6: Data Access Procedures
Appendix 7: Data Access Request Form

1. Title
Laois and Offaly Education and Training Board Data Protection Policy

2. Introductory Statement
2.1. All personal information which Laois and Offaly ETB holds is protected by the Data Protection Acts 1988 and 2003. The ETB takes its responsibilities under these laws seriously.
2.2. This policy document will set out, in writing, the manner in which Personal Data relating to staff, students and other individuals (e.g. parents, ETB members, members of board of management etc.) are kept and how the data are protected.
2.3. The functions of the ETB extend to schools, centres and programmes established or maintained by that ETB as well as the ETB’s Administrative Centres. Unless otherwise stated in this Policy:
2.3.1. The provisions herein shall apply to all those bodies which are under the remit of the ETB, and
2.3.2. all references within this Policy to “ETB” shall refer to all bodies established or maintained by that ETB.

3. Data Protection Principles
Laois and Offaly ETB is a data controller of Personal Data relating to its past, present and future employees, students, parents, ETB members, members of ETB schools boards of management and various other individuals. As such, the ETB is obliged to comply with the principles of data protection set out in the Data Protection Acts 1988 and 2003 which can be summarised as follows:
3.1. Obtain and process Personal Data fairly: Information on ETB students is gathered with the help of parents/guardians and staff. Information is also transferred from their previous school(s). In relation to information the ETB holds on other individuals (members of staff, individuals applying for positions within the ETB, parents/guardians of students etc.), the information is generally furnished by the individual themselves with full and informed consent, and compiled during the course of their employment or contact with the ETB. All such data is treated in accordance with the Data Protection Acts and the terms of this Data Protection Policy. The information will be obtained and processed fairly. This will be achieved by adopting appropriate data protection notices at the point of data capture e.g. Staff Application forms, student enrolment forms. An example of such a notice is set out in Appendix 1 which contains the Data Protection Statement used by Laois and Offaly ETB in its student enrolment forms. While an express signature of indication of consent is not necessarily always required, it is strongly recommended, and will be requested, where possible. The minimum age at which consent can be legitimately obtained for processing and disclosure of Personal Data is not defined in the Data Protection Acts. However, the Data Protection Commissioner recommends, that, “as a general rule in the area of education, a student aged eighteen or older may give consent themselves. A student aged from twelve up to and including seventeen should give consent themselves and, in addition, consent should also be obtained from the student’s parent or guardian.
In the case of students under the age of twelve consent of a parent or guardian will suffice.”
3.2. Keep it only for one or more specified and explicit lawful purposes: The ETB will inform individuals of the reasons they collect their data, and will inform individuals of the uses to which their data will be put. All information is kept with the best interest of the individual in mind at all times.
3.3. Process it only in ways compatible with the purposes for which it was given initially: Data relating to individuals will only be processed in a manner consistent with the purposes for which it was gathered.
Information will only be disclosed on a need to know basis, and access to it will be strictly controlled. From time to time it may be necessary for the ETB to disclose employee’s personal information to third parties, including: the Department of Education & Skills, Revenue Commissioners, Department of Social Protection, the Central Statistics Office, the Teaching Council, An Garda Síochána, other educational institutions, banks and other financial institutions, past and future employers, auditors, pension administrators, trade unions, staff associations, the Education Training Board Ireland and/or other bodies. Student (and/or parent/guardian) data may be disclosed to third parties including: The Department of Education and Skills (which includes the Inspectorate, and the National Educational Psychological Service (NEPS)), HSE, TUSLA (particularly in relation to Child Protection issues), An Garda Síochana, Universities/Colleges/Institutes, banks (re the awarding of grants/ scholarships) and the Education Training Board Ireland (for the school to obtain advices and support).
It may also be necessary to disclose information in order to comply with any legal obligations.
Laois and Offaly ETB takes all reasonable steps as required by law to ensure the safety, privacy and integrity of the information and, where appropriate, enter into contracts with such third parties to protect the privacy and integrity of any information supplied.
Laois Offaly ETB have appointed Data Processors to assist the ETB with the processing and storage of certain classes of automated data in relation to students and staff of the ETB.
Laois and Offaly ETB will endeavour to comply with Department of Finance Guidelines (copy available at Appendix 2) in relation to the transfer of data to third parties.
3.4. Keep Personal Data safe and secure: Only those with a genuine reason for doing so may gain access to the information. Sensitive Personal Data is securely stored under lock and key in the case of manual records, and protected with firewall software and password protection in the case of electronically stored data. Portable devices storing personal data (such as laptops) should be encrypted and password protected before they are removed from ETB premises. Confidential information will be stored securely, and in relevant circumstances, it will be placed in a separate file which can easily be removed if access to general records is granted to anyone not entitled to see the confidential data. Laois and Offaly ETB stores personal information in controlled access, centralised databases (including computerised and manual files) in the ETB Administration Centres, Ridge Road, Portlaoise and Castle Buildings, Tara Street, Tullamore. The ETB will take appropriate security measures against unauthorised access to, or alteration, disclosure or destruction of the data and against their accidental loss or destruction. The ETB acknowledges that high standards of security are essential for processing all personal information and endeavours to comply with the Department of Finance Guidelines (see Appendix 2) which contains comprehensive guidelines regarding best practice in the area of data security. Some of the security measures we take include:
 Access to files containing personal data (computerised and manual) is restricted to the staff who work in that particular area e.g. only HR staff have access to personnel files.
 Computer systems are password protected and are backed up daily to a secure server
 The Administration Centres are secured and alarmed (monitored) when not occupied.
 Waste paper which may include personal information is confidentially shredded.
All ETB Staff shall adhere to the “Records Management Procedures” of Laois and Offaly ETB a copy of which is set out at Appendix 3.
3.5. Keep Personal data accurate, complete and up-to-date: Students, parents/guardians, and/or staff should inform the ETB of any change which should be made to their Personal Data and/or Sensitive Personal Data to ensure that the individual’s data is accurate, complete and up-to-date. Once informed, the ETB will make all necessary changes to the relevant records. A copy of the Laois and Offaly ETB “Personal Data Rectification/Erasure Form” is available at Appendix 5. The authority to update/amend such records may be delegated to a member of ETB staff. However, records must not be altered or destroyed without proper authorisation. If alteration/correction is required, then a note of the fact of such authorisation and the alteration(s) to be made to any original record/documentation should be dated and signed by the person making that change. Laois and Offaly ETB has procedures in place that are adequate to ensure high levels of data accuracy and completeness and to ensure that personal data is kept up to date. These procedures include:
 Cross-checking of data entry e.g. entering pay details onto payroll system requires one person to enter the data while another person checks for accuracy.
 Files (electronic and manual) are audited periodically by the internal auditors the Vocational Support Services Unit (VSSU) and the Comptroller & Auditor General (C& AG).
 We rely on the individuals who supply personal information (staff, students and others) to ensure that the information provided is correct and to update us in relation to any changes to the information provided. Notwithstanding this, under Section 6 of the Data Protection Acts, individuals have the right to have personal information corrected if necessary.
 If an individual feels that the information held is incorrect they should complete the “Personal Data Rectification/Erasure Request Form” set out at Appendix 5 and submit it to the ETB.
3.6. Ensure that it is adequate, relevant and not excessive: Only the necessary amount of information required to provide an adequate service will be gathered and stored. Personal data held by Laois and Offaly ETB will be adequate, relevant and not excessive in relation to the purpose/s for which it is kept. Periodic checks will be made of files (electronic and manual) to ensure that personal data held is not excessive and remains adequate and relevant for the purpose for which it is kept. See Appendix 3 “Records Management Procedures” of Laois and Offaly ETB and Appendix 4 “Records Retention Schedule”. 3.7. Retain it no longer than is necessary for the specified purpose or purposes for which it was given: Laois and Offaly ETB will have a defined policy on retention periods for personal data and appropriate procedures in place to implement such a policy. For more information on this, see the ETB’s “Record Retention Schedule” as set out at Appendix 4 to this Data Protection Policy. As a general rule, where the data relates to an ETB student, the information will be kept for the duration of the individual’s time as an ETB student and thereafter may be retained for a further period for a specific purpose depending on the nature or classification of the data. In setting retention periods for different sets of data, regard will be taken of the relevant legislative and taxation requirements, the possibility of litigation, the requirement to keep an archive for historical purposes and the retention periods laid down by funding agencies e.g. European Structural Funds, NDP. In the case of members of ETB staff, the ETB will comply with both DES guidelines and the requirements of the Revenue Commissioners with regard to the retention of records relating to employees. The ETB may also retain the data relating to an individual for a longer length of time for the purposes of complying with relevant provisions of law and or/defending a claim under employment legislation and/or contract and/or civil law. Retention times cannot be rigidly prescribed to cover every possible situation and the ETB will use the “Record Retention Schedule” as a guideline only. The ETB reserves the right to exercise its judgment and discretion in relation to specific classes of data, taking account of its statutory obligations and best practice in relation to each category of records held.
3.8. Provide a copy of their Personal Data to any individual, on request: Individuals have a right to know what Personal Data/Sensitive Personal Data is held about them, by whom, and the purpose for which it is held. On making an access request any individual about whom Laois and Offaly ETB keeps Personal Data, is entitled to a copy of their personal data and a description of:
 The categories of data being processed,
 The personal data constituting the data of which that person is the subject,
 The purpose for the processing,
 The recipients/categories of recipients to whom the data is or may be disclosed
 Any information known or available to the ETB as to the source of those data unless the communication of that information is contrary to the public interest
To make an access request, the individual should read the ETB’s “Data Access Procedures” set out at Appendix 6, and then complete the “Data Access Request Form” set out at Appendix 7. Guidance on how the ETB shall handle the Data Access Request is set out at Appendix 6: “Data Access Procedures”.

4. Scope
4.1. Scope: The functions of the ETB extend to schools, centres and programmes established or maintained by that ETB as well as the ETB’s Administrative Centres. Unless otherwise specifically specified in this
Policy, this Policy shall apply to all those bodies which are under the remit of the ETB.
4.2. Purpose of the Policy: The Data Protection Acts apply to the keeping and processing of Personal Data, both in manual form and on computer. The purpose of this Policy is to assist the ETB to meet its statutory obligations while explaining those obligations to staff. The Policy shall also inform staff, ETB members, students and their parents/guardians how their data will be treated.
4.3. To whom will the Policy apply? The Policy applies to all staff, the ETB members, parents/guardians, students and others (including prospective or potential students and their parents/guardians, and applicants for staff positions within the ETB) insofar as the ETB handles or processes their Personal Data in the course of their dealings with the ETB.

5. Definition of Data Protection Terms
5.1. Definitions: In order to properly understand the ETB’s obligations, there are some key terms derived from the Data Protection Acts 1988 and 2003 which should be understood by all relevant staff:
5.1.1. Data means information in a form that can be processed. It includes both automated data (eg. electronic data) and manual data. Automated data means any information on computer, or information recorded with the intention that it be processed by computer. Manual data means information that is kept/recorded as part of a relevant filing system or with the intention that it form part of a relevant filing system.
5.1.2. Data Controller for the purposes of this Policy is the ETB, but where the Policy is adopted by an ETB School may also refer to the Board of Management of that School.
5.1.3. Relevant filing system means any set of information that, while not computerised, is structured by reference to individuals, or by reference to criteria relating to individuals, so that specific information relating to a particular individual is readily, quickly and easily accessible. Examples might include student files stored in alphabetic order in a filing cabinet or personnel files stored in the HR office.
5.1.4. Personal Data means data relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the Data Controller (ie the ETB).
5.1.5. Sensitive Personal Data refers to Personal Data regarding a person’s:
 racial or ethnic origin, political opinions or religious or philosophical beliefs;
 membership of a trade union;
 physical or mental health or condition or sexual life;
 commission or alleged commission of any offence; or
 any proceedings for an offence committed or alleged to have been committed by the person, the disposal of such proceedings, or the sentence of any court in such proceedings, criminal convictions or the alleged commission of an offence.

6. Rationale
6.1. Why is it necessary to have a Data Protection Policy? In addition to its legal obligations under the broad remit of educational and other legislation, the ETB has a legal responsibility to comply with the Data Protection Acts 1988 and 2003. This policy explains what sort of data is collected, why it is collected, for how long it will be stored, and with whom it will be shared.
6.2. As more and more data is generated electronically and as technological advances enable the easy distribution and retention of this data, the challenge of meeting the ETB’s legal responsibilities has increased. The ETB takes its responsibilities under Data Protection law very seriously, and wishes to put in place safe practices to safeguard individual’s personal data.
6.3. It is also recognised that recording factual information accurately and storing it safely facilitates an evaluation of the information, enabling the Chief Executive and the ETB Board to make decisions in respect of the efficient running of the ETB. The efficient handling of data is also essential to ensure that there is consistency and continuity where there are changes of personnel within the ETB.

7. Other Legal Obligations
Implementation of this Policy should take account of the legal obligations and responsibilities imposed on both the ETB and ETB Schools. Some legislation places an obligation on the ETB to obtain and retain personal data and is therefore directly relevant to data protection. For example:
7.1. Teaching Council Act 2006.
7.2. Social Welfare Acts.
7.3. Minimum Notice & Terms of Employment Act 1973.
7.4. Payment of Wages Act 1979.
7.5. Pensions Acts 1990-2003.
7.6. Comptroller & Auditor General Act 1993.
7.7. Maternity Protection Acts 1994-2004.
7.8. Organisation of Working Time Act 1997.
7.9. Parental Leave Acts 1998-2006.
7.10. Carers Leave Act 2001.
7.11. Adoptive Leave Act 2005.
7.12. Safety, Health & Welfare at Work Act 2005.
7.13. Various taxation legislation.
7.14. Other employment and equality legislation.
7.15. The ETB is also regulated by Circular Letters and Memos issued by the Department of Education and Skills. These regulations require personal data to be collected, retained by the ETB and in some cases data is to be transferred to DES.
7.16. Education and Training Boards Act 2013
 S.10 Functions of ETBs
 S.11 Additional Functions
 S.27 Duty to prepare and submit a strategy statement to the Minister
 S.30 Composition of ETBs
 Elections to ETBs are conducted under the regulations issued by the Minister1 pursuant to the power granted under S.3 of the Act of which the following is the relevant: “election” refers to elections of staff representatives; The Minister is obliged to appoint a returning officer;
(1) duty of returning officer: on appointment “shall cause to be prepared a provisional electoral roll containing the names and addressed of each eligible member of staff”;
(3) returning officer must make this roll available for inspection “in the manner the retuning officer considers appropriate”;
“The electoral roll of eligible members of staff shall contain the name and address of every eligible member of staff who qualifies to be entered on the roll”.
7.17. Education Act 1998
Under Section 9(g) of the Education Act, 1998, the parents of a student, or a student who has reached the age of 18 years, must be given access to records kept by the School relating to the progress of the student in his or her education.
7.18. Education (Welfare) Act 2000
(a) Under Section 20 of the Education (Welfare) Act, 2000, the School must maintain a register of all students attending the School. In addition, under section 20(5), a Principal is obliged to notify certain information relating to the child’s attendance in School and other matters relating to the child’s educational progress to the Principal of another School to which a student is transferring.
(b) Under Section 21 of the Education (Welfare) Act, 2000, the School must record the attendance or non-attendance of students registered at the School on each School day.
(c) Under Section 28 of the Education (Welfare) Act, 2000, the School may supply Personal Data kept by it to certain prescribed bodies (the Department of Education and Skills, TUSLA, the National Council for Special Education, other Schools, other centres of education) provided the School is satisfied that it will be used for a “relevant purpose” (which includes recording a person’s educational or training history or monitoring their educational or training progress in order to ascertain how best they may be assisted in availing of educational or training opportunities or in developing their educational potential; or for carrying out research into examinations, participation in education and the general effectiveness of education or training).
7.19. Education for Persons with Special Educational Needs Act 2004
Under Section 14 of the Education for Persons with Special Educational Needs Act, 2004, the School is required to furnish to the National Council for Special Education (and its employees, which would include Special Educational Needs Organisers (“SENOs”)) such information as the Council may from time to time reasonably request.
7.20. Freedom of Information Act 1997
The Freedom of Information Act 1997 provides a qualified right to access to information held by public bodies which does not necessarily have to be “personal data” as with data protection legislation. ETBs and schools are subject to Freedom of information legislation, and if an ETB has furnished information to a body covered by the Freedom of Information
1 SI 270/2014 – Education and Training Boards Act 2014 (Election of Staff) Regulations 2014
Act (such as the Department of Education and Skills etc) these records could be disclosed if a request is made to that body.
Health Act 1947
Under Section 26(4) of the Health Act 1947 a School shall cause all reasonable facilities (including facilities for obtaining names and addresses of pupils attending the School) to be given to a health authority who has served a notice on it of medical inspection e.g. a dental inspection.
7.21. Children First
Under Children First: National Guidance for the Protection and Welfare of Children (2011) published by the Department of Children & Youth Affairs, Schools, their Boards of Management and their staff have responsibilities to report child abuse or neglect to the Child & Family Agency (“TUSLA”) (or in the event of an emergency and the unavailability of TUSLA, to An Garda Síochana).
7.22. Criminal Justice (Withholding of Information on Offences Against Children and Vulnerable Persons) Act 2012
Under the Criminal Justice (Withholding of Information on Offences against Children and Vulnerable Persons) Act 2012, all individuals are mandatorily obliged to disclose information on certain offences against children and against vulnerable adults to An Garda Síochana.
7.23. Youth Work Act 2001
Under Section 9.(1) in addition to the functions conferred on it by or under the ETB Act 2013, each ETB shall, insofar as practicable and within the financial resources available to it (a) ensure the provision within its vocational education area of youth work programmes or youth work services, (b) ensure co-ordination within its vocational education area of youth work programmes and youth work services with education programmes and other programmes that provide services for young persons, (c) ensure that in the provision of youth work programmes or youth work services, or both, (d) monitor and assess the youth work programmes or youth work services, (e) consult with and report to, in regard to youth work, such person or persons as the Minister may, from time to time, direct.

8. Identifying Personal Data
The Personal Data records held by Laois and Offaly ETB at the ETB Administration Centre and held by the ETB School and ETB Centres or by ETB Programmes in their administrative offices may include:
8.1. Staff records
8.1.1. Categories: As well as existing members of staff (and former members of staff) these records may also relate to applicants applying for positions within the school, trainee teachers and teachers under probation. These staff records may include:
 Name, address and contact details,
 date of birth, PPS number
 marital and family details
 educational or previous employment background
 Original records of application and appointment including those relating to promotion posts/in-house applications
 interview records, references
 Details of approved absences (career breaks, parental leave, study leave etc.)
 Records of in-service courses attended
 Details of work record (qualifications, classes taught, subjects etc.)
 Details of complaints and/or grievances and/or disciplinary procedures including consultations or competency discussions, action/improvement/evaluation plans and record of progress. Note: A record of grievances may be maintained which is distinct from and separate to individual personnel files.
 Records of any reports made in respect of the staff member to State departments and/or other agencies under mandatory reporting legislation and/or child-safeguarding guidelines (subject to the DES Child Protection Procedures)
 Superannuation and pension documentation
 Salary, payroll details, bank details.
 Medical information, including the medical questionnaire which employees complete prior to taking up employment, records of sickness absence and medical certificates. Laois and Offaly ETB will request all employees to have a medical examination and will therefore hold the resulting medical report. The purpose of keeping this sort of information is to administer sick pay and disability entitlement, monitor and manage sickness absence and to comply with our health and safety obligations. Satisfactory health is one of the conditions of admission to the Superannuation Scheme.
 Information regarding Trade Union membership. Laois and Offaly ETB holds this information for the purposes of facilitating the deduction-at-source of union subscriptions.
 Information on commission/alleged commission of offence, any proceedings for an offence. Laois and Offaly ETB holds this information to meet the requirements of the Department of Education & Skills and to satisfy itself of the employee’s suitability for their position. Garda Vetting records will be retained in compliance with DES C/L 0063/2010 and subsequent relevant circular letters.
 Information regarding disability. Laois and Offaly ETB holds this information for the purposes of reporting (on an aggregated, anonymised basis) to the Department of Education and Skills on the target for employment of persons with disability under the Disability Act 2005.
8.1.2. Purposes: Staff records are processed and kept for the purposes of:
 For the management and administration of ETB business now and into the future
 To facilitate the payment of staff, and calculate other benefits/entitlements and to assist the member of staff applying for other benefits/entitlements (including but not limited to State Illness Benefit, State Disability Allowance, State Invalidity Pension, State Maternity Benefit etc.) to determine reckonable service for the purpose of calculation of pension payments, ex gratia or statutory entitlements, and/or redundancy payments where relevant)
 To calculate annual leave allowances or other leave allowances (e.g. parental leave, maternity leave etc)
 to facilitate pension payments in the future,
 human resources management,
 to obtain advices on and to address IR/HR matters, disciplinary matters, complaints under the Dignity in the Workplace Policy, complaints made under the grievance policy, and performance management issues. Note: this may involve records being transferred to third parties including the national representative body for Education and Training Boards, ETBI, and legal advisors.
 recording promotions (documentation relating to promotions applied for) and changes in responsibilities
 To enable the ETB to comply with its obligations as an employer, including the preservation of a safe, efficient working and teaching environment (including complying with its responsibilities under the Safety, Health and Welfare At Work Act 2005)
 To enable the ETB and ETB school to comply with requirements set down by the Department of Education and Skills, the Revenue Commissioners, the National Council for Special Education, TUSLA, the HSE and any other governmental, statutory and/or regulatory departments and/or agencies
 For compliance with legislation relevant to the ETB including the generation of electoral registers for the election of staff representatives onto the ETB under the Education and Training Boards Act 2013.
8.1.3. Location: Staff records are kept in the Human Resources and Finance departments of the ETB Administration Centres, Ridge Road, Portlaoise and Castle Buildings, Tullamore. Some records will also be held by the ETB School/ETB Centre. Manual Records will be held in a secure, locked filing cabinet that only personnel who are authorised to use the data can access. Employees are required to maintain the confidentiality of any data to which they have access.
8.1.4. Security: Laois and Offaly ETB stores all personal information in controlled access, centralised databases (including computerised and manual files) in the ETB Administration Centres, Ridge Road, Portlaoise and Castle Buildings, Tullamore. Where records are held by the ETB School, these will be held in the administrative offices of that School. Manual records are stored in locked filing cabinets, in offices which are accessed only by ETB staff. Automated data is stored on ETB computers and the ETB server. The ETB IT system is password protected, with sufficient firewall software, adequate levels of encryption etc. The ETB will take appropriate security measures against unauthorised access to, or alteration, disclosure or destruction of the data and against their accidental loss or destruction. The ETB acknowledges that high standards of security are essential for processing all personal information.
8.2. Student records
8.2.1. Categories: In general student records are kept by the individual ETB schools, ETB centres and programmes run under the auspices of the ETB. These records may include:
(a) Information may be sought and recorded at enrolment and may be collated and compiled during the course of the student’s time at the School/Centre/Programme. Information which may be sought and recorded at enrolment, including:
 name, address and contact details, PPS number
 date and place of birth
 names and addresses of parents/guardians and their contact details (including any special arrangements with regard to guardianship, custody or access)
 religious belief
 racial, or ethnic origin
 membership of the Traveller community, where relevant
 whether they (or their parents) are medical card holders;
 Whether English is the student’s first language and/or whether the student requires English language support,
 any relevant special conditions (e.g. special educational needs, health issues etc.) which may apply
(b) Information on previous academic record (including reports, references, assessments and other records from any previous school(s) attended by the student
(c) Psychological, psychiatric and/or medical assessments
(d) Attendance Records
(e) Photographs and recorded images of students (including at school events and noting achievements).
(f) Academic record – subjects studied, class assignments, examination results as recorded on official School reports
(g) Records of significant achievements
(h) Whether the student is repeating the Leaving Certificate
(i) Whether the student is exempt from studying Irish
(j) Records of disciplinary issues and/or sanctions imposed
(k) Garda vetting outcome record (where student is engaged in work experience organised with or through the ETB which requires that they be Garda vetted)
(l) Other records e.g. records of any serious injuries/accidents etc. (Note: it is advisable to inform parents that a particular incident is being recorded)
(m) Records of any reports the school (or its employees) have made in respect of the student to State departments and/or other agencies under mandatory reporting legislation and/or child safeguarding guidelines (subject to the DES Child Protection Procedures).
8.2.2. Purposes: The purposes for obtaining, processing, holding and keeping student records are:
a) To enable each student to develop their full potential.
b) To comply with legislative or administrative requirements.
c) To ensure that eligible students can benefit from the relevant additional teaching or financial supports.
d) To support the provision of religious education.
e) To enable parent/guardians to be contacted in the case of emergency etc. or to inform parents of their child’s educational progress or to inform parents of school events etc.
f) To meet the educational, social, physical and emotional requirements of the student.
g) To obtain advice necessary to assist and support the student, and to enable the student to access additional resources etc. Note: this may involve student records being transferred to third parties including: TUSLA, social workers or medical practitioners, the National Council for Special Education, any Special Education Needs Organiser, the National Educational Psychological Service, the national representative body for Education and Training Boards (ETBI), and legal advisors.
h) Photographs, and recorded images of students are taken to celebrate school achievements, compile yearbooks, establish a school website, record school events, and to keep a record of the history of the school/centre/programme.
i) To ensure that the student meets the ETB admissions criteria.
j) To ensure that students meet the minimum age requirements for their course.
k) To ensure that any student seeking an exemption from Irish meets the criteria in order to obtain such an exemption from the authorities.
l) To furnish documentation/information about the student to the Department of Education and Skills, the National Council for Special Education, TUSLA and other schools etc. in compliance with law and directions issued by government departments;
m) To furnish, when requested by the student (or their parent/guardian in the case of a student under 18 years) documentation/information/references to third-level educational institutions and/or prospective employers
n) In respect of a work experience placement (where that work experience role requires that the student be Garda vetted) the ETB School will assist the student in obtaining their Garda vetting outcome (with the consent of the student and their parent/guardian) in order to furnish a copy of same (with the consent of the student and the student’s parent/guardian) to the work experience employer.
o) For compliance with legislation relevant to the ETB including the generation of electoral registers for the election of parent/guardian representatives onto the ETB under the Education and Training Boards Act 2013.
8.2.3. Location: Student records will be retained in the ETB Administration Centres, Ridge Road, Portlaoise and Castle Buildings, Tullamore. The ETB Human Resources Department receives and retains a copy of some student data and documentation, in particular records of student with Special Educational Needs (Psychological Reports which may include name, address and date of birth, PPS Number, psychological assessment (if supplied by school), category of assessed disability parent/guardian name and contact details), and records of non-national students (name, date of birth, nationality and year of entry to Ireland). Note: Some records will also be held by the ETB School. Note: some records may be transferred to third parties as disclosed
at (3.3) above. Manual Records will be held in a secure, locked filing cabinet that only personnel who are authorised to use the data can access. Employees are required to maintain the confidentiality of any data to which they have access.
8.2.4. Security: Laois and Offaly ETB stores all personal information in controlled access, centralised databases (including computerised and manual files) in the ETB Administration Centres, Ridge Road, Portlaoise and Castle Buildings, Tullamore. Where records are held by the ETB School, these will be held in the administrative offices of that School. Manual records are stored in locked filing cabinets, in offices which are accessed only by ETB staff. Automated data is stored on ETB computers and the ETB server. The ETB IT system is password protected, with sufficient firewall software, adequate levels of encryption etc. The ETB will take appropriate security measures against unauthorised access to, or alteration, disclosure or destruction of the data and against their accidental loss or destruction. The ETB acknowledges that high standards of security are essential for processing all personal information.
8.3 Annual Post-Primary School October Return/Examination Entries (known as the “October Returns”)
Each year, each recognised post-primary school makes a return to the Department of Education and Skills, the data from which allows the Department of Education and Skills calculate the teaching posts and core funding to be allocated to each recognised post primary school, for the following school year. These returns are made in accordance with The Rules and Programme for Secondary Schools via a process called the Annual Post-Primary School October Return/Examination Entries, or more commonly known as the ‘October Returns’.
8.3.1 Categories: In making their respective returns to the Department, post-primary schools transfer personal data and personal sensitive data on each of their enrolled students (including students who have transferred and are enrolled in the school). Sensitive Data which may be sought at the time of enrolment includes membership of the travelling community and medical card information. This information is sought and retained for the purpose of completion of the ‘October Returns’. The ‘October Returns’ include sensitive personal data regarding personal circumstances which are provided by parents/guardians and students on the basis of explicit and informed consent. The ‘October Return’ contains individualised data (such as an individual student’s PPS number) which acts as an “identifier” for the DES to validate the data that belongs to a recognised student. The DES also transfers some of this data to other Government departments and other State bodies to comply with legislation, such as transfers to the Department of Social Protection pursuant to the Social Welfare Acts, transfers to the State Examinations Commission, transfers to the Educational Research Centre, and transfers to the Central Statistics Office pursuant to the Statistics Acts. The data will also be used by the DES for statistical, policy-making and research purposes. However the DES advises that it does not use individual data, but rather aggregated data is grouped together for these purposes. The DES has a data protection policy which can be viewed on its website (www.education.ie). The DES has also published a “Fair Processing Notice” to explain how the personal
data of students and contained in October Returns is processed. This can also be found on www.education.ie (search for Circular Letter 0047/2010 in the “Circulars” section). Explicit permission will be sought from parents/guardians before processing this data in line with DES C/L 47/2010.
8.3.2 Purposes: The only purpose some post-primary schools may collect some of these data is to meet the data requirements for its ‘October Return’ to the Department. The school asks parents/guardians and students to complete October Returns for the purposes of complying with DES requirements to determine staffing and resource allocations and to facilitate the orderly running of the school. The main purpose of the October Returns is for the DES to determine whether the student qualifies for English language support and/or additional resources and support to meet their particular educational needs. The October Returns are submitted to the DES electronically. The DES has their own policy governing the security of the data sent to them by all post-primary schools. The co-operation of each student and/or their parents/guardians in completing the ‘October Return’ is greatly appreciated as the school’s aim is to ensure that each student is assisted in every way to ensure that s/he meets his/her full potential.
8.3.3 Location: In a secure, locked filing cabinet that only personnel who are authorised to use the data can access. Employees are required to maintain the confidentiality of any data to which they have access.
8.3.4 Security: Laois and Offaly ETB stores all personal information in controlled access, centralised databases (including computerised and manual files) in the ETB administration Centres, Ridge Road, Portlaoise and Castle Buildings, Tullamore. Where records are held by the ETB School, these will be held in the administrative offices of that School. Manual records are stored in locked filing cabinets, in offices which are accessed only by ETB staff. Automated data is stored on ETB computers and the ETB server. The ETB IT system is password protected, with sufficient firewall software, adequate levels of encryption etc. The ETB will take appropriate security measures against unauthorised access to, or alteration, disclosure or destruction of data and against unauthorised access to, or alteration, disclosure or destruction of the data against accidental loss or destruction. The ETB acknowledges that high standards of security are essential for processing all personal information.
8.3.5 Purposes: The only purpose some post-primary schools may collect some of these data is to meet the data requirements for its ‘Annual Census’ to the Department. The purpose for which the DES collects this information is set out in the DES Fair Processing Notice which can also be found on www.education.ie (search for Circular 17/2014).
8.3.6 Location: In a secure, locked filing cabinet that only personnel who are authorised to use the data can access. Employees are required to maintain the confidentiality of any data to which they have access.
8.3.7 Security: Laois and Offaly ETB stores all personal information in controlled access, centralised databases (including computerised and manual files) in the ETB administration offices in Ridge Road,
Portlaoise and Castle Buildings, Tara Street, Tullamore. Where records are held by the ETB school, these will be held in the administrative offices of that school. Manual records are stored in locked filing cabinets, in offices which are accessed only by ETB staff. Automated data is stored on ETB computers and the ETB server. The ETB IT system is password protected, with sufficient firewall software adequate levels of encryption etc. The ETB will take appropriate security measures against unauthorised access to, or disclosure or destruction of the data and against their accidental loss or destruction. Laois and Offaly ETB acknowledges that high standards of security are essential for processing all personal information.
8.4 Records of students (and parents/guardians) applying for further education grants and scholarships
Laois and Offaly ETB Administration Centre keeps some records of students (and parents/guardians) who have applied for education grants and scholarships. Note: Student Universal Support Ireland (SUSI) is the single awarding authority for all student grant applications since the 2012/13 academic year. All new students or students changing course apply to SUSI online. Laois and Offaly ETB holds personal data on students (and parent/guardians) who applied for further education grants and scholarships prior to 2012/13 academic year.
8.4.1 Categories of data: These may include information which may have been sought and recorded at application, including:
 name, address and contact details, date of birth, PPS number
 gender, marital and family status (i.e. number of children in family)
 nationality
 details of previous and current/future education
 employment details
 bank details
 name, address and contact details, PPS number of parent/guardian
 marital and family status of parent/guardian
 employment details of parent/guardian
 details of income of parent/guardian
8.4.2 Purposes: to assess eligibility for grant/scholarship and for the administration of the scheme.
8.4.3 Location: records of grant applications are kept in the Education Support Service department of the ETB Administration Centres, Ridge Road, Portlaoise and Castle Buildings, Tullamore.
8.4.4 Security: Laois and Offaly ETB stores all personal information in controlled access, centralised databases (including computerised and manual files) in the ETB Administration Centres, Ridge Road, Portlaoise and Castle Buildings, Tullamore. The ETB will take appropriate security measures against unauthorised access to, or alteration, disclosure or destruction of the data and against their accidental loss or destruction. The ETB acknowledges that high standards of security are essential for processing all personal information.
8.5 Examination results
8.5.1 Categories: An ETB school/centre will hold data comprising examination results in respect of its students. These include class, mid-term, annual, continuous assessment and mock- examinations results.
8.5.2 Purposes: The main purpose for which these examination results and other records are held is to monitor a student’s progress and to provide a sound basis for advising them and their parents or guardians about subject choices and levels. The data may also be aggregated for statistical/reporting purposes, such as to compile results tables. The data may be transferred to the respective ETB, the Department of Education and Skills, the National Council for Curriculum and Assessment and such other similar bodies.
8.5.3 Location: In a secure, locked filing cabinet that only personnel who are authorised to use the data can access. Employees are required to maintain the confidentiality of any data to which they have access.
8.5.4 Security: Identify the format in which these records are kept, e.g. manual record (personal file within a relevant filing system), computer record (database) or both. [Describe applicable security measures, e.g. locks, padlocks, password protection, firewall software, adequate levels of encryption etc.]
8.6 Records of students (and parents/guardians) applying for courses/ programmes Laois and Offaly ETB runs a number of programmes for children. These include:
 Outdoor education centres activities/educational programmes held at Birr Outdoor Education Centre, Roscrea Road, Birr, Co. Offaly
 Other activities/educational programmes held in various ETB schools.
The applications for these activities/educational programmes may be accepted by the ETB Administration centres as well as by the programme concerned.
8.6.1 Categories: These may include: Information which may be sought and recorded at application, including:
 name, address, date of birth, of student,
 details of relevant medical conditions affecting student,
 name, address and contact details of parent/guardian
8.6.2 Purposes: for the administration of the Outdoor education centre activities/educational programmes/ Music lessons/Youth Theatre and Drama programme etc.
8.6.3 Location: records of applicants are kept in the Education Support Service department of the ETB Administration Centres, Ridge Road, Portlaoise and Castle Buildings, Tullamore and/or kept in the administrative offices from which the programme is run. The original application forms are transferred to the centre/programme co-ordinator.
8.6.4 Security: Laois and Offaly ETB stores all personal information in controlled access, centralised databases (including computerised and manual files) in the ETB Administration Centres, Ridge Road, Portlaoise and Castle Buildings, Tullamore and/or in the offices from which the programme is run. The ETB will take appropriate security measures against unauthorised access to, or alteration, disclosure or destruction of the data and against their accidental loss or destruction. The ETB acknowledges that high standards of security are essential for processing all personal information.
18
8.7 Records of students (and parents/guardians of ‘under 18s’) applying for adult, community and further education courses/programmes
Laois and Offaly ETB runs a number of adult and community education programmes. Applications for these courses/programmes may be accepted by the ETB Administration Centre as well as by the Centre/Programme concerned.
8.7.1 Categories: Information which may be sought and recorded at application, including: name, address and date of birth, PPS Number, Garda Vetting (as required).
8.7.2 Purposes: for the administration of the courses/programmes. Garda Vetting is required for students who, in the course of their work experience, will be in contact with children and/or vulnerable adults. Information regarding social welfare entitlement/benefit is required for assessment of eligibility for various programmes e.g. BTEI/VTOS.
8.7.3 Location: records of adult, community and further education students are kept in the ETB Administration Centres, Ridge Road, Portlaoise and Castle Buildings, Tullamore. [The original application forms are transferred to the Programme Co-ordinator running the programme].
8.7.4 Security: Laois and Offaly ETB stores all personal information in controlled access, centralised databases (including computerised and manual files) in the ETB Administration Centres, Ridge Road, Portlaoise and Castle Buildings, Tullamore. The ETB will take appropriate security measures against unauthorised access to, or alteration, disclosure or destruction of the data and against their accidental loss or destruction. The ETB acknowledges that high standards of security are essential for processing all personal information.
8.8 ETB, Boards of Management and Selection Boards records
8.8.1 Categories: These may include:
 Name, address and contact details of each member of the ETB, Board of Management and Selection Board (including former members).
 Records in relation to appointments to the ETB/Board.
 Minutes of meetings and correspondence which may include references to particular individuals.
 Travel expenses paid, PPS Number, tax details, bank details.
8.8.2 Purposes: To enable the ETB and Board of Management to operate in accordance with the Education and Training Boards Act 2013, the Education Act 1998 and other applicable legislation and to maintain a record of appointments and decisions. To facilitate the payment of members expenses and selection board expenses.
8.8.3 Location: These records are kept in the Finance department and the office of the Chief Executive at the ETB Administration Centres, Ridge Road, Portlaoise and Castle Buildings, Tullamore.
8.8.4 Security: Laois and Offaly ETB stores all personal information in controlled access, centralised databases (including computerised and manual files) in the ETB Administration Centres, Ridge Road, Portlaoise and Castle Buildings, Tullamore. Where records are held by the ETB School these will be held in the administrative offices of that school. Manual records are stored in
locked filing cabinets, in offices which are accessed only by ETB staff. Automatic data is stored on ETB computers and the ETB server. The ETB System is password protected, with sufficient firewall software, adequate levels of encryption etc. The ETB will take appropriate security measures against unauthorised access to, or alteration, disclosure or destruction of the data and against their accidental loss or destruction. The ETB acknowledges that high standards of security are essential for processing all personal information.
8.9 Creditors
8.9.1 Categories of Data: Laois and Offaly ETB holds some or all of the following information about creditors (some of whom are self-employed individuals):
 Name, address, contact details,
 PPS Number, tax details, bank details and amount paid.
8.9.2 Purposes: This information is required for routine management and administration of Laois and Offaly ETB’s financial affairs including the payment of invoices.
8.9.3 Location: These records are kept in the Finance department of the ETB Administration Centres, Ridge Road, Portlaoise and Castle Buildings, Tullamore.
8.9.4 Security: Laois and Offaly ETB stores all personal information in controlled access, centralised databases (including computerised and manual files) in the ETB Administration Centres, Ridge Road, Portlaoise and Castle Buildings, Tara Street, Tullamore. Where records are held by the ETB school, these will be held in the administrative offices of that school. Manual records are stored in locked filing cabinets, in offices which are accessed only by ETB staff. Automated data is stored on ETB computers and the ETB server. The ETB IT system is password protected, with sufficient firewall software and adequate levels of encrypton. The ETB will take appropriate security measures against unauthorised access to, or alteration, disclosure or destruction of the data and against their accidental loss or destruction. The ETB acknowledges that high standards of security are essential for processing all personal information.
8.10 Charity Tax-Back Forms
8.10.1 Categories of data: An ETB school/centre may hold the following data in relation to donors who have made charitable donations to an ETB school/centre/programme:
• Name
• Address
• Telephone number
• PPS number
• Tax rate
• Signature and
• The gross amount of the donation.
8.10.2 Purposes: Schools are entitled to avail of the scheme of tax relief for donations of money they receive. To claim the relief, the donor must complete a certificate (CHY2) and forward it to the school to allow it to claim the grossed up amount of tax associated with the donation. The information requested on the appropriate certificate is the parent’s name, address, PPS number, tax rate, telephone number, signature and the gross amount of the donation. This is retained by the school in the case of audit by the Revenue Commissioners.
8.10.3 Location: In a secure, locked filing cabinet that only personnel who are authorised to use the data can access. Employees are required to maintain the confidentiality of any data to which they have access.
8.10.4 Security: : Laois and Offaly ETB stores all personal information in controlled access, centralised databases (including computerised and manual files) in the ETB Administration Centres, Ridge Road, Portlaoise and Castle Buildings, Tullamore. Where records are held by the ETB School these will be held in the administrative offices of that school. Manual records are stored in locked filing cabinets, in offices which are accessed only by ETB staff. Automatic data is stored on ETB computers and the ETB server. The ETB System is password protected, with sufficient firewall software, adequate levels of encryption etc. The ETB will take appropriate security measures against unauthorised access to, or alteration, disclosure or destruction of the data and against their accidental loss or destruction. The ETB acknowledges that high standards of security are essential for processing all personal information.
8.11 Register of Electors
8.11.1 Categories of Data: Laois and Offaly ETB holds some or all of the following information about electors:
 Name,
 address
 Completed ballot paper
8.11.2 Purposes: Under the Education and Training Boards Act 2013, 2 members of the ETB are elected by members of staff of that ETB. Elections are to be held every 5 years and the Administration Centre Staff will prepare a Provisional Electoral Roll from a list of staff. This information is required for the preparation of the provisional and final electoral rolls, the distribution of ballot papers and to maintain a record of the election of staff representatives to the ETB.
8.11.3 Location: These records are kept in the ETB Administration Centre, Castle Buildings, Tara Street, Tullamore.
8.11.4 Security: Laois and Offaly ETB stores all personal information in controlled access, centralised databases (including computerised and manual files) in the ETB Administration Centres, Ridge Road, Portlaoise and Castle Buildings, Tara Street, Tullamore. The ETB will take appropriate security measures against unauthorised access to, or alteration, disclosure or destruction of the data and against their accidental loss or destruction. The ETB acknowledges that high standards of security are essential for processing all personal information.
8.12 CCTV Images/Recordings
8.12.1 Categories: CCTV is installed in some of the ETB’s schools, centres and offices, externally i.e. perimeter walls/fencing and internally as detailed in the CCTV policy. These CCTV systems may record images of staff, students and members of the public who visit the premises in accordance with the ETB CCTV Policy.
8.12.2 Purposes: Safety and security of staff, students and visitors and to safeguard ETB property and equipment.
8.12.3 Location: Cameras are located externally and internally as detailed in the CCTV Policy. Recording equipment is located in the Principal/Manager’s office, secure room or in the reception office of each school or centre which can be accessed only by the Principal/Manager.
8.12.4 Security: Access to images/recordings is restricted to the Chief Executive, Director of Education Services/Director of Further Education, Principal and Deputy Principal of each school and Manager of each centre. Tapes, DVDs, hard disk recordings are retained for 28 days, except if required for the investigation of an incident. Images/recordings may be viewed or made available to An Garda Siochana pursuant to section 8 Data Protection Acts 1988 and 2003.

9. Links to Other Policies and to Service Delivery
9.1. Our policies need to be consistent with one another, within the framework of the entire ETB. Relevant school policies already in place or being developed or reviewed shall be examined with reference to this Data Protection Policy and any implications which it has for them shall be addressed. This policy should be read in conjunction with the following policy documents applicable to bodies within the ETB (Schools, Centres, Programmes etc):
 Data Breach Management Policy and Procedure Data in ETBs
 Department of Finance Guidance on Protecting the Confidentiality of Personal Data
 Customer Service Charter
 Records Retention Schedule
 CCTV Policy
 Acceptable Usage (ICT) Policy
 Child Protection Policy
 Anti-Bullying Policy
 Code of Behaviour
 Mobile Phone Code/Policy
 Admissions/Enrolment Policy
 Substance Use Policy
 Employee Handbook
 Disciplinary Policy
 Relevant Department of Education and Skills Circular Letters
Note: Where relevant and applicable to students, a number of these policies may be made available by the ETB school/centre/administration centre concerned on/following student enrolment.

10. Dealing with Data Access Requests
10.1. Section 3 Access Request: Under section 3 of the Data Protection Acts, an individual has the right to be informed whether the data controller holds data about them and to be given a description of the data together with details of the purposes for which their data is being kept. The individual must make this request in writing and the data controller will accede to the request within 21 days.
10.2. The right under Section 3 must be distinguished from the much broader right contained in Section 4 where individuals are entitled to a copy of their data.
10.3. Section 4 Access Request: Individuals are entitled to a copy of their personal data on written request:
10.3.1. The individual is entitled to a copy of their personal data (subject to some exemptions and prohibitions set down in Section 5 of the Data Protection Act)
10.3.2. Request must be responded to within 40 days.
10.3.3. Fee may apply but cannot exceed €6.35
10.3.4. Where a subsequent or similar request is made soon after a request has just been dealt with, it is at the discretion of the ETB as data controller to comply with the second request (no time limit but reasonable interval from the date of compliance with the last access request). This will be determined on a case-by-case basis.
10.3.5. No personal data can be supplied relating to another individual unless that third party has consented to the disclosure of their data to the applicant. Data will be carefully redacted to omit references to any other individual and only where it has not been possible to redact the data to ensure that the third party is not identifiable would the ETB refuse to furnish the data to the applicant.

11. Providing information over the ‘phone
11.1. In our ETB school/centre, any employee dealing with telephone enquiries should be careful about disclosing any personal information held by the school/centre over the phone. In particular the employee concerned should:
 Check and verify the identity of the caller to ensure that information is only given to a person who is entitled to that information.
 Request that the caller put their request in writing if the employee is not sure about the identity of the caller and in circumstances where the identity of the caller cannot be verified.
 Refer the request to the Principal/ETB Co-ordinator for assistance in difficult situations.
 No employee should feel forced into disclosing personal information.

12. Implementation Arrangements, Roles and Responsibilities
12.1. The Chief Executive of Laois and Offaly ETB and delegated Officers i.e. the Directors of Education and Further Education, School Principals, Centre Managers, Co-ordinators and Section Heads are responsible for implementing this Policy, and for ensuring that staff who handle or have access to Personal Data are familiar with their data protection responsibilities. However all employees who collect and/or control the contents and use of personal data are individually responsible for compliance with the data protection legislation. The ETB will provide support, advice and training to all staff concerned to ensure compliance with the legislation.
12.2. Within the ETB, the following personnel will have responsibility for implementing the Data Protection Policy:
Name/Role
Responsibility
ETB
Data Controller
Chief Executive, Directors of Education/Further Education, ETB School Principals, Centre Managers,Co-ordinators, Section Heads, ETB School Board of Management
Implementation of Policy
Teaching personnel
Security, confidentiality and awareness of responsibilities
Administrative personnel
Security, confidentiality and awareness of responsibilities
IT personnel
Security, encryption, confidentiality
Data Protection Officer
Provision of advice and support

13. Ratification & Communication
13.1 This Policy was adopted by Laois and Offaly ETB at its ETB meeting on 22nd June 2015
13.2 It is published on the Laois and Offaly ETB website www.laoisoffalyetb.ie where it can be accessed by all staff, students and their parents and members of the public.
13.3 The policy will be brought to the attention of all ETB staff. All ETB staff must be familiar with the Data Protection Policy and ready to put it into practice in accordance with the specified implementation arrangements.
13.4 The Data Protection Policy shall be brought to the attention of new members of ETB staff during their induction training.
13.5 ETB students and their parents/guardians shall be informed of the Data Protection Policy from the time of enrolment of the student, eg. by including the Data Protection Policy as part of the enrolment pack, by either enclosing it or incorporating it as an Appendix to the enrolment form.
14. Monitoring the implementation of the Policy
14.1 The implementation of the Policy will be monitored by the Chief Executive and delegated officers of Laois and Offaly ETB.
14.2 At least one annual report shall be issued to the ETB board to confirm that the actions/measures set down under this Data Protection Policy are being implemented.

15. Reviewing and evaluating the Policy
15.1. The Policy will be reviewed and evaluated at certain predetermined times and as necessary.
15.2. Ongoing review and evaluation will take cognisance of changing information or guidelines (e.g. from the Data Protection Commissioner, Department of Education and Skills, VSSU, C&AG or TUSLA), legislation and feedback from parents/guardians, students, staff and others.
15.3. This Policy shall be revised as necessary in the light of such reviews and evaluations and within the framework of ETB planning.

Appendix 1
Data Protection Statement (for inclusion on relevant forms when personal information is being requested) Personal Data on this Form: Laois and Offaly ETB is a data controller under the Data Protection Acts 1988 and 2003. The personal data supplied on this ________________form is required for the purposes of:  student enrolment,  student registration,  allocation of teachers and resources to the school  determining a student’s eligibility for additional learning supports and transportation,  examinations  school administration,  child welfare (including medical welfare)  and to fulfil our other legal obligations. ETB Contacting You Please confirm if you are happy for us to contact you by SMS/text message, and to call you on the telephone numbers provided and to send you emails for all the purposes of:  sports days,  parent teacher meetings,  school concerts/events,  to notify you of school closure (eg. where there are adverse weather conditions),  to notify you of your child’s non-attendance or late attendance or any other issues relating to your child’s conduct in school,  to communicate with you in relation to your child’s social, emotional and educational progress, and to contact you in the case of an emergency Tick box if “yes” you agree with these uses Use your email address to alert you to these issues?  Use your mobile phone number to send you SMS texts to alert you to these issues?  Use your mobile phone/landline number to call you to alert you to these issues?  Please note: Laois and Offaly ETB reserves the right to contact you in the case of an emergency relating to your child, regardless of whether you have given your consent. School sending you direct marketing We would like to send you emails/SMS text messages or call you or to write to you at your home address to inform you of special offers or promotions by certain third parties involved in the supply of school stationery and school uniform supplies etc. (eg. [disclose name of organisation/company]). Do you give your consent for us to do each of the following: Tick box if “yes” you agree with these uses Use your email address to alert you to these offers?  Use your mobile phone number to send you SMS texts in relation to these offers? 
Use your mobile phone/landline number to call you in relation to these offers?  Use your address to send you written letters/brochures in relation to these offers?  While the information provided will generally be treated as private to Laois and Offaly ETB, and will be collected and used in compliance with the Data Protection Acts 1988 and 2003, from time to time it may be necessary for us to transfer your personal data on a private basis to other bodies (including the Department of Education & Skills, the Department of Social Protection, An Garda Síochána, the Health Service Executive, TUSLA, social workers or medical practitioners, the National Council for Special Education, any Special Education Needs Organiser, the National Educational Psychological Service, or (where the student is transferring with another school). We rely on parents/guardians and students to provide us with accurate and complete information and to update us in relation to any change in the information provided. Should you wish to update or access your/your child’s personal data you should write to the school Principal requesting an Access Request Form. Data Protection Policy: A copy of the full Data Protection Policy is available on Laois and Offaly ETBs website: www.laoisoffalyetb.ie and you and your child should read it carefully. When you apply for enrolment, you will be asked to sign that you consent to your data/your child’s data being collected, processed and used in accordance with this Data Protection Policy during the course of their time as a student in the school. Where the student is over 18 years old, they will be asked to sign their consent to this. Photographs of Students: The ETB maintains a database of photographs of ETB events held over years. It has become customary to take photos of students engaged in activities and events in the interest of creating a pictorial as well as historical record of life at the school/centre. Photographs may be published on our website or in brochures, yearbooks, newsletters, local and national newspapers and similar school-related productions. In the case of website photographs, student names will not appear on the website as a caption to the picture. If you or your child wish to have his/her photograph removed from the school website, brochure, yearbooks, newsletters etc. at any time, you should write to the ETB Chief Executive. Consent (tick one only) 1. If you are happy to have your child’s photograph taken as part of ETB activities and included in all such records tick here  2. If you would prefer not to have your child’s photograph taken and included in such records, please tick here  3. If you are happy for your child’s photograph to be taken and included, as 1. above, but would prefer not to have images of your child appear on the website, in school brochures, yearbooks, newsletters etc please tick here.  Signed: ____________________ Parent/Guardian/Student (where over 18) Date: __________________

Appendix 2
“Protecting the confidentiality of Personal Data Guidance Note” (CMOD Department of Finance, Dec. 2008)
Taken from https://www.dataprotection.ie/documents/guidance/GuidanceFinance.pdf

Appendix 3
Records Management Procedures
Note to ETBs: this is an internal document for internal ETB use only. This Appendix does not have to be circulated to students/parents
1. Purpose
Good records management is of special significance in the context of Laois and Offaly ETB’s functions, where the maintenance of academic records is a core activity. We aim to implement records management procedures and to ensure preservation of records of permanent value and to establish archival criteria to maintain and assure continued access to appropriate historical records.
2. Ownership of Records
All records, irrespective of format, (i.e. both manual and automated data) created or received by ETB staff in the course of their duties on behalf of Laois and Offaly ETB , are the property of Laois and Offaly ETB and subject to its overall control. Any employees leaving Laois and Offaly ETB or changing positions within Laois and Offaly ETB must leave all records intact for their successors and is not permitted to remove or retain records (in electronic or manual format) for any reason.
3. Management of ETB Records
3.1. All records created and received by ETB staff in the course of their duties on behalf of Laois and Offaly ETB must be retained for as long as they are required to meet the legal, administrative, financial and operational requirements of Laois and Offaly ETB, after which time they are either destroyed or transferred to Laois and Offaly ETB archives.
3.2. The final disposition (either destruction or transfer to the archives) of records is carried out according to approved Records Retention Schedules as appended to the Laois and Offaly ETB Data Protection Policy.
3.3. While the Records Retention Schedule (set out at Appendix 4 of the ETB Data Protection Policy) prescribes the minimum period that ETB records must be retained, officers may, at their discretion, keep the records for a longer period of time if it is deemed necessary and appropriate, and where it is required for a specific purpose (e.g. the defence of litigation).
3.4. A list of the vital records held within Laois and Offaly ETB, shall be prepared and reviewed periodically. For example, Board/Committee meetings, Sub-committee meetings, Board of Management meetings, financial information, legal documentation etc. should be included in this. It is recommended that vital records be duplicated with one set being stored on site and the other off site in case of a disaster such as fire.
4. Employee Duties
4.1. All ETB employees are responsible for making and keeping the records of their work and shall:
4.1.1. Comply with the “Filing Guidelines” set out at Appendix 1 hereto.
4.1.2.Create records needed to do the business of Laois and Offaly ETB, record decisions and actions taken, and generally document activities for which they are responsible and take care of records so that information can be found when needed. This means establishing or adhering to good directories and files, and filing materials (in any format) regularly and carefully in a manner that allows them to be safely stored and efficiently retrieved and returned when necessary.
4.1.3. Ensure that all records under their control are stored/retained/destroyed or archived in accordance with Laois and Offaly ETB’s Records Retention Schedule (see Appendix 4 of the ETB Data Protection Policy).
5. Retention and Disposal
5.1. After the records have been retained by the creating/receiving department/ office/school/institute/centre (in-situ or off-site storage) for the requisite time in the Record Retention Schedule, they are either securely destroyed (e.g. by confidential cross-shredding by a third party contractor retained pursuant to a Data Processing Agreement as required by the Data Protection Policy of Laois and Offaly ETB), or securely transferred to archival storage.
5.2. It is the responsibility of the Principal/Director/Co-ordinator/Head of Section to ensure that records are scheduled as necessary to be retained in the appropriate storage facility or securely disposed of.
5.3. If a file is to be destroyed, then a Destruction Record Form needs to be completed by the employee and countersigned by the senior member of staff responsible for records destruction. The Destruction Record Form shall be filed and kept permanently.
5.4. A Destruction Register must be created and maintained by each administrative department/school/institute centre/programme under the remit of Laois and Offaly ETB which contains all the completed Destruction Record Forms.
6. Life-Cycle of Records within the ETB
6.1. Each record has a Life Cycle, which is as follows:
Current Records Are those that are held on site in offices and are used on a very regular basis.
Non-current Records These are records that are needed for occasional reference. Can be held on site in a dedicated storage area or stored off site with easy access.
Disposition Records which should either be archived or securely and confidentially cross-shredded.
6.2. Current Records:
6.2.1. Active Records: Active records are records that are required and referred to constantly for current use, and which need to be retained and maintained in office space and equipment close and readily accessible to users
30
6.2.2. Semi-active Records: Semi-active records are records that are referred to infrequently and are not required constantly for current use. Semi-active records are removed from office space to storage until they are no longer needed.
6.3. Non-Current Records
6.3.1. Inactive Records: Inactive records are records which are no longer required to carry out the functions for which they were created. They should be stored until the retention period has lapsed.
6.3.2. Permanently Valuable Records – Archives: Permanently valuable records include those with legal, operational, administrative, historical, scientific, cultural and social significance.
APPENDIX 1: Filing Guidelines
a) Before filing a piece of paper, ask yourself, “Will I need this in the future?” Don’t keep a piece of paper just on the chance that you may need it “someday.”
b) Don’t always save every draft of a document. For most purposes the final version is sufficient.
c) Don’t file multiple copies of the same document, unless justified.
d) The originator normally keeps copies of reports and correspondence. Just because a document is sent to you doesn’t mean that you are obliged to keep it indefinitely. If you need to see it again, ask the originator for another copy.
e) If, for example, records are scheduled for destruction after three years, don’t store them for five years.
f) In general, records received from ETB schools/institutes/centres/offices should be filed under the name of the originating school/institute/centre/office.
g) Some records may belong under more than one series or category. To handle this, file the records in one category and place a cross-reference note in the other. It is important to be consistent in deciding where to file records. Once information is filed in a given series and category, it should always be filed there.
h) Label and date all files.
i) Color-coding the different series is a useful tool, especially for refiling folders.
j) Create a file guide with a description of the filing system and instructions for the user so new personnel can continue to use the filing system easily. This will also avoid the arbitrary creation of new file folders.
k) Create cross-listings to help locate items. Create a file database on the PC using the file-folder heading, cross-listing, and location notes.
l) Spell out acronyms and abbreviations.
m) Sort records prior to filing.
n) Use staples rather than paper clips in folders.
o) Discard envelopes if the return address is available on the document itself. Most phone messages, illegible notes, and routine acknowledgements can also be discarded.
p) Do not overfill file folders. If they are overfilled, divide them into several folders with the same name and File number (e.g.: Maternity Leave Applications 2008/2009, File 1).
31
q) Do not overstuff file drawers. This can make retrieval of files difficult, as well as creating a dangerous work environment.
r) Weed files regularly, using the approved Record Retention Schedule.
s) Consider using “Out Markers” when removing folders for use. This makes refiling much easier and lets others in the office know that a file exists so another is not created, who has the file, and when it was checked out.

Appendix 4
Laois and Offaly ETB Record Retention Schedule
[Note to ETB – For template Record Retention Schedule, see http://www.dataprotectionschools.ie/en/Resources/

Appendix 5
Laois and Offaly ETB Personal Data Rectification/Erasure Form
Date:_________________________
Personal Data Rectification/Erasure Request Form:
Request to have Personal Data rectified or erased.
Data Protection Act 1988 and Data Protection (Amendment) Act 2003
Important: Proof of identity (e.g. official/State photographic identity document such as drivers licence, passport) must accompany this form.
Full Name
Address
Contact number *
Email addresses *
* The ETB may need to contact you to discuss your Access Request
Please tick the box which applies to you:
Student

Parent/guardian of student 
Former Student

Current Staff

Former Staff

Age:
Yeargroup/class:
Name of Student:
Insert Year of leaving:
Insert Years From/To:
I, …………………………………………………..[insert name] wish to have the data detailed below which Laois and Offaly ETB holds about me/my child rectified / erased (delete as appropriate). I am making this access request under Section 6 of the Data Protection Acts.
Details of the information you believe to be inaccurate and rectification required OR Reason why you wish to have data erased:
You must attach relevant documents as proof of correct information e.g. where a date of birth is incorrect, please provide us with a copy of the official State Birth Certificate. Please note that your right to request rectification/deletion is not absolute, and may be declined by Laois and Offaly ETB in certain cases. You have the right to complain this refusal to the Office of the Data Protection Commissioner: see www.dataprotection.ie .
Signed ……………………………………… Date ……………
Checklist: Have you:
1) Completed the Access Request Form in full? 
2) Included document/s as proof of correct information? 
3) Signed and dated the Request Form? 
4) Included a photocopy of official/State photographic identity document (drivers licence, Passport etc.)*. 
*Note to ETB: the ETB should satisfy itself as to the identity of the individual, and make a note in the ETB records that identity has been provided, but the ETB should not retain a copy of the identity document.
Please return this form to: Kathleen Donnellan, Administrative Office, Castle Buildings, Tullamore, Co. Offaly

Appendix 6
Data Access Procedures Policy
Date of adoption by Laois and Offaly ETB: 22nd June 2015
The Data Protection Acts, 1988 and 2003 provide for a right of access by an individual data subject to personal information held by Laois and Offaly ETB. The following procedure is provided to ensure compliance with the ETB’s obligations under the Acts and governs the manner in which requests for access to personal data will be managed by the Laois and Offaly ETB. A data subject is required to familiarize themselves with the procedure and to complete the Data Access Request Form (see Appendix 7 of the Data Protection Policy) which will assist the ETB in processing the access request where personal information (or in the case of a parent/guardian making an access request on behalf of a student, personal information in relation to their child) as a data subject is processed and retained by Laois and Offaly ETB. It is important to note that only personal information relating to the individual (or in the case of a parent/guardian making an access request on behalf of a student, only personal information in relation to his/her/their child) will be supplied. No information will be supplied that relates to another individual.
Important note to students making access requests
Where a student (aged under 18 years) makes an access request, the ETB may inform the student that:
(a) Where they make an access request, their parents will be informed that they have done so and
(b) A complete copy of the access request materials being furnished to the data subject by the ETB will also be furnished to the student’s parent/guardian.
This is provided for in the ETB’s Data Protection Policy. The right of access under the Data Protection Acts is the right of the data subject. However, there may be some data held by the ETB which may be of a sensitive nature and the ETB will have regard to the following guidance issued by the Office of the Data Protection Commissioner in relation to releasing such data:
a) A student aged eighteen years or older (and not suffering under any medical disability or medical condition which may impair his or her capacity to give consent) may give consent themselves.
b) If a student aged eighteen years or older has some disability or medical condition which may impair his or her ability to understand the information, then parental/guardian consent will be sought by the school before releasing the data to the student.
c) A student aged from twelve up to and including seventeen can be given access to their personal data, depending on the age of the student and the nature of the record, i.e. it is suggested that:
 If the information is ordinary, routine or non-controversial (e.g. a record of a test result) the student could readily be given access
 If the information is of a sensitive nature, it would be prudent to seek parental/guardian consent before releasing the data to the student
 If the information would be likely to be harmful to the individual concerned, parental/guardian consent should be sought before releasing the data to the student.
d) In the case of students under the age of twelve, an access request may be made by their parent or guardian on the student’s behalf. However, the ETB must note that the right of access is a right of the data subject themselves (i.e. it is the right of the student). Therefore, access documentation should be addressed to the child at his/her address which is registered with the school as being his/her home address. It should not be addressed or sent to the parent who made the request. For further information, see “Important Note to Parents Making Access Requests on Behalf of their Child” below.
Important note to parents making access requests on behalf of their child
Where a parent/guardian makes an access request on behalf of their child (a student aged under 18 years), the right of access is a right of the data subject (i.e. it is the student’s right). In such a case, the access materials will be sent to the child, not to the parent who requested them. This means that the access request documentation will be sent to the address at which the child is registered on the school’s records and will be addressed to the child. The documentation will not be sent to or addressed to the parent/guardian who made the request. Where a parent/guardian is unhappy with this arrangement, the parent/guardian is invited to make an application to court under section 11 of the Guardianship of Infants Act 1964. This provision enables the court (on application by a guardian) to make a direction on any question affecting the welfare of the child. Where a court issues an order stating that a school should make certain information available to a parent/guardian, a copy of the order should be given to the school by the parent/guardian and the school can release the data on foot of the court order.
Individuals making an access request
On making an access request, any individual (subject to the restrictions in Notes A and B below) about whom a ETB keeps Personal Data, is entitled to:
 a copy of the data which is kept about him/her (unless one of the exemptions or prohibitions under the Data Protection Acts apply, in which case the individual will be notified of this and informed of their right to make a complaint to the Data Protection Commissioner)
 know the purpose/s for processing his/her data
 know the identity (or the categories) of those to whom the data is disclosed
 know the source of the data, unless it is contrary to public interest
 where the processing is by automated means (e.g. credit scoring in financial institutions where a computer program makes the “decision” as to whether a loan should be made to an individual based on his/her credit rating) know the logic involved in automated decisions.
Data access requirements
To make an access request, you as a data subject must:
1. Apply in writing requesting access to your data under section 4 Data Protection Acts or, alternatively, request an Access Request Form (see
Appendix 7 of the Data Protection Policy) which will greatly assist the ETB in processing your access request more quickly. In the case of ETB schools, correspondence should be addressed in the first instance to the school principal (save where personnel files or other files are retained by the ETB head office – in such circumstances correspondence should be addressed to the Chief Executive Officer of the ETB)
2. You will be provided with a form which will assist the ETB in locating all relevant information that is held subject to the exceptions and prohibitions outlined in Appendix A. The school reserves the right to request official proof of identity (e.g. photographic identification such as a passport or driver’s licence) where there is any doubt on the issue of identification.
3. On receipt of the access request form, a co-ordinator will be appointed to check the validity of your access request and to check that sufficient information to locate the data requested has been supplied (particularly if CCTV footage/images are to be searched). In the case of ETB schools, the co-ordinator is the Chief Executive of the ETB. It may be necessary for the co-ordinator to contact you in the event that further details are required with a view to processing your access request.
4. The co-ordinator will log the date of receipt of the valid request and keep a note of all steps taken to locate and collate the requested data.
5. The co-ordinator will ensure that all relevant manual files (held within a “relevant filing system”) and computers are checked for the data in respect of which the access request is made.
6. The co-ordinator will ensure that the information is supplied promptly and within the advised timeframes in items 7, 8 and 9 as appropriate.
7. Where a request is made under Section 3 of the Data Protection Acts, the following information will be supplied: (i) what the ETB holds by way of personal information about you ((or in the case of a request under section 3 made by a parent/guardian of a student aged under 18 years, then the personal information held about that student) and (ii) a description of the data together with details of the purposes for which his/her data is being kept will be provided. Actual copies of your personal files (or the personal files relating to the student) will not be supplied. No personal data can be supplied relating to another individual. A response to your request will be provided within 21 days of receipt of the access request form and no fee will apply.
8. Where a request is made under Section 4 of the Data Protection Acts, the following information will be supplied within 40 days and an administration fee of €6.35 will apply. The individual is entitled to a copy of all personal data, i.e.
 A copy of the data which is kept about him/her (unless one of the exemptions or prohibitions under the Data Protection Acts applies, in which case the individual will be notified of this and informed of their right to make a complaint to the Data Protection Commissioner)
 Be advised of the purpose/s for processing his/her data
 Be advised of the identity (or the categories) of those to whom the data is disclosed
 Be advised of the source of the data, unless it is contrary to public interest
 where the processing is by automated means (e.g. credit scoring in financial institutions where a computer program makes the “decision” as to whether a loan should be made to an individual based on his/her credit rating), know the logic involved in automated decisions.
9. Where a request is made with respect to examination results an increased time limit of 60 days from the date of the first publication of the results or from the date of the access request, whichever is the later will apply.
10. Before supplying the information requested to you as data subject (or where the access request is made on behalf of a student aged under 18 years, information relating to the student), the co-ordinator will check each item of data to establish:
 If any of the exemptions or restrictions set out under the Data Protection Acts apply, which would result in that item of data not being released, or
 where the data is “health data”, whether the obligation to consult with the data subject’s medical practitioner applies, or
 where the data is “social work data”, whether the prohibition on release applies.
11. If data relating to a third party is involved, it will not be disclosed without the consent of that third party or alternatively the data will be anonymised in order to conceal the identity of the third party. Where it is not possible to anonymise the data to ensure that the third party is not identified, then that item of data may not be released.
12. Where an ETB may be unsure as to what information to disclose, the ETB reserves the right to seek legal advice.
13. The co-ordinator will ensure that the information is provided in an intelligible form (e.g. codes explained) or will provide an explanation.
14. Number the documents supplied.
15. Have the response “signed-off” by an appropriate person. In the case of ETB schools, this function is undertaken by the Chief Executive of the ETB/nominee.
16. The ETB will respond to your access request within the advised timeframes contingent on the type of request made.
17. The ETB reserves the right to supply personal information to an individual in an electronic format e.g. on tape, USB, CD etc.
18. Where a subsequent or similar access request is made after the first request has been complied with, the ETB has discretion as to what constitutes a reasonable interval between access requests and this will be assessed on a case-by case basis.
19. Where you as an individual data subject may seek to rectify incorrect information maintained by the ETB, please notify the ETB and a form will be supplied to you for this purpose. You should however note that the right to rectify or delete personal data is not absolute. You have the right to make a complaint to the Data Protection Commissioner about a refusal. Where the ETB declines to rectify or delete the personal data as you have instructed, the ETB may propose to supplement your personal record, pursuant to section 6(1)(b) Data Protection Acts.
20. In circumstances where your access request is refused, Laois and Offaly ETB will write to you explaining the reasons for the refusal and the administration fee, if provided, will be returned. In such circumstances, you have the right to make a complaint to the Office of the Data Protection Commissioner www.dataprotection.ie. Similarly, the administration access fee will be refunded to you if the ETB has to rectify, supplement or erase your personal data.
21. Where requests are made for CCTV footage, an application must be made in writing and the timeframe for response is within 40 days. All necessary information such as the date, time and location of the recording should be given to the ETB to assist the ETB in dealing with your request. Where the image is of such poor quality as not to clearly identify an individual, that image may not be considered to be personal data. In providing a copy of personal data, the ETB may provide the materials in the form of a still/series of still pictures, a tape, disk, USB, with relevant images. Other people’s images will be obscured before the data is released. If other people’s images cannot be obscured, then the images/recordings may not be released.
There are a number of exceptions to the general rule of right of access, including those specified in Notes A and B in Appendix A.
This procedure is regularly reviewed in line with the ETB’s commitment to its responsibilities under data protection.

Appendix A to the Data Access Procedures Policy
Note A: Access requests by students
 A student aged eighteen years or older (and not suffering under any medical disability or medical condition which may impair his or her capacity to give consent) may give consent themselves.
 If a student aged eighteen years or older has some disability or medical condition which may impair his or her ability to understand the information, then parental/guardian consent will be sought by the school before releasing the data to the student.
 A student aged from twelve up to and including seventeen can be given access to their personal data, depending on the age of the student and the nature of the record, i.e. it is suggested that
 If the information is ordinary, routine or non-controversial (e.g. a record of a test result) the student could readily be given access
 If the information is of a sensitive nature, it would be prudent to seek parental/guardian consent in writing before releasing the data to the student. Where the parent/guardian does not give their consent to releasing the data to the student, legal advice should be sought
 If the information would be likely to be harmful to the individual concerned, parental/guardian consent should be sought before releasing the data to the student.
 In the case of students under the age of twelve, an access request may be made by their parent or guardian on the student’s behalf. The consent of the child need not be obtained. However, the ETB must note that the right of access is a right of the data subject themselves (i.e. it is the right of the student). Therefore, access documentation should be addressed to the child at his/her address which is registered with the school as being his/her home address. It should not be addressed or sent to the parent who made the request. For further information, see “Important Note to Parents Making Access Requests on Behalf of their Child” below.
 In any of the circumstances outlined above, if the data contains health data and disclosure would be likely to cause serious harm to the physical or mental health of the individual concerned, the ETB is obliged to withhold the data until they have consulted with the data subject’s medical practitioner and (in the case of a student under 18 or a student with special educational needs whose disability or medical condition would impair his or her ability to understand the information), parental/guardian consent should also be sought.
 In some cases (i.e. where the information is “health data”), it is advised that the data be supplied by the medical practitioner.
 In any of the circumstances outlined above, if the data contains social work data and disclosure would be likely to cause serious harm to the physical or mental health of the individual, the ETB is not permitted to release the data to the individual.
Note B: Exceptions to note:
Data protection regulations prohibit the supply of:
– Health data to a patient in response to a request for access if that would be likely to cause serious harm to his or her physical or mental health. This is to protect the individual from hearing anything about
41
himself or herself which would be likely to cause serious harm to their physical or mental health or emotional well-being. In the case of health data, the information can only be released after the ETB has consulted with the appropriate health professional (usually the data subject’s GP).
– Personal Data obtained in the course of carrying on social work (“social work data”) (personal data kept for or obtained in the course of carrying out social work by a Government department, local authority, TUSLA etc) is also restricted in some circumstances if that would be likely to cause serious harm to the health or emotional condition of the data subject concerned. In the case of social work data, the information cannot be supplied at all if the ETB believes it would be likely to cause serious harm to the physical or mental health or emotional condition of the data subject. If the social work data includes information supplied to the ETB by an individual (other than one of the ETB’s employees or agents) while carrying out social work, the ETB is not permitted to supply that information to the data subject without first consulting that individual who supplied the information.
The Data Protection Acts state that the following data is exempt from a data access request:
1. Section 5 of the Data Protection Act provides that the right of access does not apply in a number of cases in order to strike a balance between the rights of the individual, on the one hand, and some important needs of civil society on the other hand. Examples would include the need for state agencies (like An Garda Síochána) to investigate crime effectively and the need to protect the international relations of the State.
2. Estimates of liability: where the personal data consists of or is kept for the purpose of estimating the amount of the liability of the ETB on foot of a claim for damages or compensation and where releasing the estimate would be likely to prejudice the interests of the ETB in relation to the claim, the data may be withheld.
3. Legally privileged information: the general rule is that all documentation prepared in contemplation of litigation is legally privileged. So correspondence between the ETB and their solicitors/legal advisors in relation to a case against the ETB should not be disclosed to the claimant pursuant to a data access request.
4. Section 4 states that the right of access does not include a right to see personal data about another individual, without that other person’s consent. This is necessary to protect the privacy rights of the other person. If it is reasonable for the ETB to conclude that redacting or omitting the particulars identifying the third party would both conceal the identity of the third party and enable the data to be disclosed (subject to the redactions), then the data could be disclosed with such redactions. However, if it is not possible to redact or omit the particulars which identify a third party, then the affected data should not be released to the applicant.
5. Section 4 also states that where personal data consists of expressions of opinion about the data subject made by another person, the data subject has a right to receive that expression of opinion except where that expression of opinion was given in confidence, and on the clear understanding that it would be treated as confidential.
42
6. The obligation to comply with an access request does not apply where it is impossible for the ETB to provide the data or where it involves a disproportionate effort.
Where a ETB refuses to hand over some or all of the personal data they hold in relation to a data subject (on the basis of any of the exemptions or prohibitions set out above), the ETB must advise the data subject of this in writing, setting out reasons for the refusal and notifying the data subject that he or she has the right to complain to the Office of the Data Protection Commissioner about the refusal. For further information, see What if a school/ETB refuses an access request?

Appendix 7
Data Access Request Form
Laois and Offaly ETB
Date:__________________________
Access Request Form: Request for a copy of Personal Data under the Data Protection Act 1988 and Data Protection (Amendment) Act 2003
Important: Proof of Identity must accompany this Access Request Form (eg. official/State photographic identity document such as driver’s licence, passport).
A fee of €6.35 must accompany this Access Request Form if it is a Section 4 Data Access Request together with proof of identity (eg. official/State photographic identity document such as driver’s licence, passport).
Full Name
Maiden Name (if name used during your school duration)
Address
Contact number *
Email addresses *
* We may need to contact you to discuss your access request
Please tick the box which applies to you:
Student

Parent/Guardian of student 
Former Student

Current Staff

Former Staff

Age:
Year group/class:
Name of Student:
Insert Year of leaving:
Insert Years From/To:
44
Section 3 Data Access Request:
I, …………………………………………………..[insert name] wish to be informed whether or not Laois and Offaly ETB holds personal data about me/my child and to be provided with a description of this data and to be informed of the purpose for holding such data. I am making this access request under Section 3 of the Data Protection Acts. 
OR
Section 4 Data Access Request:
I, ………………………………………………….. [insert name] wish to make an access request for a copy of any personal data that Laois and Offaly ETB holds about me/my child. I am making this access request under Section 4 of the Data Protection Acts. 
Section 4 Data Access Request only: I enclose €6.35 
Any other information relevant to your access request (e.g. if requesting images/recordings made by CCTV, please state the date, time and location of the images/recordings (otherwise it may be very difficult or impossible for the ETB to locate the data).
Signed ……………………………………… Date ……………
Checklist: Have you:
1) Completed the Access Request Form in full? 
2) Included a cheque or postal order made payable to Laois and Offaly ETB in the amount of €6.35 where a Section 4 request is made? (Please do not send us €6.35 if you are making a request under section 3. There is no administration charge for a section 3 request, and if you send us a cheque, it will be returned to you). 
3) Signed and dated the Access Request Form? 
4) Included a photocopy of official/State photographic identity document (driver’s licence, passport etc.)*. 
*Note to ETB: the ETB should satisfy itself as to the identity of the individual and make a note in the ETB records that identity has been provided, but the ETB should not retain a copy of the identity document.
Please return this form to: Laois and Offaly ETB: Joe Cunningham, Chief Executive, Administrative Offices, Laois and Offaly ETB, Ridge Road, Portlaoise, Co. Laois or to the Principal/Co-ordinator/Manager of School/Centre.