A+ A A-

    FAQs: Data Protection & GDPR

    Frequently Asked Questions about Data Protection and Privacy Rights (under GDPR)

    This section tells you answers to the top questions we are asked in relation to data protection. The answers below give you our best advice about this area and we hope you find them helpful, particularly when seeking personal information. We have organised the questions and answers under the following headings:

    Part 1: Data protection and GDPR (General Data Protection Regulation) and why they matter.

    Part  2: The best way to ask us for personal information about you (not other people’s information).

    Part 3: How to change information we may hold about you. 

    Part 4: How to appeal a decision about any personal information we give you.

     This information can also be downloaded as a PDF file by clicking here
     

    PART 1: Data Protection and GDPR and why they matter

    1. What is data protection legislation?

     Data protection legislation are laws that aim to protect the rights to privacy of individuals (all of us). 

    These laws matter as they try to make sure that our personal information is used correctly by anyone that has it or collects it. 

    People who keep personal information are called data controllers. The Adoption Authority is a data controller and we protect your information and that of others. We can only share information about you with you. 

    2. What is GDPR?

    GDPR stands for General Data Protection Regulation. It is a European Union legislation and is in place since 25 May 2018.

    GDPR matters as it sets out the ways in which the privacy rights of every European Union citizen must be protected and the ways in which a person’s personal data (information) can and cannot be used. The Adoption Authority must follow the GDPR requirements around the personal information that we can and cannot share.

    3. What is personal information?

    Personal information is any information that can be used to identify a living person. Examples of personal information are:

    • a name
    • date of birth
    • address
    • phone number
    • email address
    • Personal Public Service (PPS) number
    • photos
    • Internet Protocol address
     These are all protected by law.

    Part 2: The best way to ask us for personal information we may have about you

    4. How do I find out what personal information the Adoption Authority holds about me?

    You can do this in one of two ways: making an informal request or making a formal request. Let’s look at each of these options in turn using the table below:

    How to request personal information from the Adoption Authority

    Option 1: An Informal Request Option 2: A Formal Request
    Often a good first option. This is also a good option and the Adoption Authority must respond to this request
    in 30 days once it has confirmed your identity.
    (See questions 7 and 8 about proof of identity.)
    A formal request is a legal structured process and may not answer all your questions.
    (See questions 5 and 12 for more details.)
    To make a simple informal request to locate files and to get personal
     information we hold about you, please ask us in one of the following
     three ways:

    1. email us at aai.gov.ie/en/contact-us.html or
    2. email our data protection officer at dataprotection@aai.gov.ie or
    3. phone us at 01-230 9300 during office hours (9.30am - 4.30pm)



    To make a formal request, you may like to do it in one of the following two ways:
    1. complete our form called a Subject Access Request form (SAR Form) on our website and then either: print it and post it to the address on the form or send it to us as an attachment to this email address dataprotection@aai.gov.ie

    Or

    2. you can:
    •  email us at aai.gov.ie/contact-us.html
    •  email our data protection officer at dataprotection@aai.gov.ie
    • phone us at 01-230 9300 during office hours (9.30am - 4.30pm) and say or write "I would like to make a Data Protection request".
    [You can make this formal subject access request under Article 15 GDPR.]
    Top tip:
     If possible, use reference numbers from earlier contact with us when you contact us. You can usually find these numbers at the top of letters we sent you. Contact us with what you have if you don't have these numbers.
    Top tip:
    Know that the Adoption Authority will try to give you any information that you are legally entitled to.

    What Happens after I have made a request?

    When you have made a request for personal information, a staff member from the Adoption Authority will acknowledge your correspondence/request. They will tell you what is happening and how long it will take to get your information. They may ask you for more information to find what you have asked for and direct you to the correct person who can deal with your request.

    5. Is it always better to make a formal subject access request (also called data protection request) for information?

    Not necessarily. Data protection requests are part of a very rigid process and must follow a particular format. This means the information you can get from a formal subject access request (SAR or data protection request) can be quite limited in what you are entitled to receive by law.

    You may be disappointed or surprised because you might not get information you already have through another source. Sometimes a simple informal request can help you more.

    6. Can I have information about someone other than me personally, for example, a family member who is now deceased?

    Unfortunately, the answer to this is no. The laws governing the Data Protection Act refer to a “Living Individual” only, so information about a deceased person is not covered.

    GDPR will only make your personal data available to you. This means information about a person other than you:

    •  is not available to you under GDPR, and
    •  will not be given to you under GDPR.

    7. Why do I have to give the Adoption Authority proof of identity when making a request for personal information?

    By law, you have to give us proof of your identity to protect people’s personal information. We cannot provide information to any individual until they provide proof that they are who they say they are. If we did not ask for proof of your identity, then any member of the public could pretend to be you and could be given your personal information.

    8. What proof of identity do you need to get for the Authority?

    We accept most photographic and legal documents as proof of identity. Before we can give you the personal information we might have, we need a copy of one of the following of your personal items:
    • Current Irish driving licence 
    • National Age Card
    • Passport
    • Public Service Card

    Important: The copy of the identification you use should be verified (stamped). This means that before you send us a copy of your identification, you need to get the copy stamped by:

    • your local Garda or police station (free), or
    • a solicitor or commissioner for oaths if preferred. (There may be a fee in these instances.)

    When we get this verified copy of your identity, we can start to work on your specific request for data. We can’t start working on a request without having formally confirmed your identity.

    I don’t have any of the above identification

    Do not worry if you do not have any of the items above. You can call to your local Garda station with a recent photograph and they will help you complete a form called ML10. We can accept this form as proof of identity when you send it to us.

    9. If there are documents about my adoption, can I see them?

    It depends. The documents held in the Adoption Authority may have personal information about you and a range of different individuals. The types of documents on most adoption files may include some of the following list:

    • an application for the adoption order,
    • assessments of prospective adoptive parents,
    • references to support the application for the adoption,
    • consents signed by birth parents,
    • court orders.

    You may only have access to your own personal data. (Note: When we talk about an ‘adoption file’ we are talking about the recording of an adoption having taken place. This will contain lots of documents, not just your personal information.)

    10. I am looking for my original birth certificate. It is a public document, why can’t I have it?

    A birth certificate contains the personal data of people other than you. If provided to you, it would identify another person or people without their prior consent.

    11. I got copies of some documents, but they are heavily redacted (blacked out in parts). Why is that?

    Sometimes we have to redact parts of documents. Redact means to black out parts . We do this as these blackened parts are private or cannot be legally shared due to reasons like confidentiality concerns. If a document refers to someone other than you, any information which would identify them, we must legally protect.


    Similarly, if another person asked us for documents that mentioned you we would black out (redact) the references to you to protect your personal information.

    12. What or who are “third parties”?

    ‘Third parties’ is a term that you might hear when we reply to your request for information. It is important that you know what it means. ‘Third party’ is a term used to refer to individuals other than you personally. We work hard to get you the documents you are legally entitled to. Sometimes, we are not legally allowed to release documents that contains ‘third party information’ to you.

    For example, on an adoption file there can often be the marriage certificate of the adoptive parents, or references from doctors, employers or Gardaí on behalf of the adoptive parents. These documents do not have your personal information. They have third-party information, so we cannot share them with you. Third party information is protected by law and we would be breaking the law if we shared such information with you.

    13. How long does it take before I get my personal data?

    By law, once we have stamped (verified) ID for you – we have 30 days to get the information to you. But, if your information is complex, we may extend the timeline for a two further months. We will write to you if this longer time period applies to you so you will know to expect it.

    14. Can I get personal information under the Freedom of Information Act from the Adoption Authority?

    For adoption-related personal information
    Unfortunately, you cannot get personal information under the Freedom of Information (FOI) Act from the Authority if it relates to the making of an adoption order. 


    [The Adoption Authority is referred to in the Freedom of Information Act. The Act lists the Authority as a “Partially Included Agency” and this means that adoption-related files are exempt – not covered – as part of FOI requests.] 

     

    For other information 
    People can get other information we may hold about them on other types of records under FOI. For example, a person who attended an interview for a job with us may request under FOI feedback on their performance.


    You can request this other information/queries from us by writing to aai.gov.ie/en/contact-us.html with FOI request written at the top of your letter or email.

    Part 3: How to change information we may hold about you (correct, erase or update information)

    15. If I discover something is incorrect in my data which I received from the Adoption Authority, do I have the right to get it corrected?

    Yes, in some situations you can correct information about you that is incorrect. [We can do this, it is called “a right to rectification” under GDPR.] We can advise you as to how to do this if you tell us what has been recorded incorrectly.

    Correcting some information (like factual information) may mean that documents have to be amended by the organisation who gave us the information in the first instance. This may take some time as there are legal procedures to follow. However, we can correct simple mistakes such as misspellings or a typing error.

    How to get us to correct incorrect information
    To get the correction made, please write to us in with the correction you want. The correction might be to: 
    • update an address
    • telephone number
    • correct the spelling of your name

    What happens when we can’t correct information? 

    Sometimes we are not able to make corrections. For example, if the spelling mistake or the date of birth is on an official document which we hold, we may not be able to make the correction for you. If this is the case, we will tell you this and tell you how you can get the official document corrected if necessary. 

    Top tip: Please tell us if you spot a mistake or you need us to update your contact details or similar. Thank you in advance.

    16. Can I have my information erased?

    It depends. While there is a right under GDPR called “the right to be forgotten”, it is not an absolute right as there are some records which cannot be erased because they must be kept by law (that is under The Adoption Act 2010). For example, the record of an adoption order is a legal record and must be kept for that reason. 


    The Adoption Authority has to keep much of the data we have about you as it is part of a legal process. We will review the data we hold when we receive a request to erase information. We will do this to see if any of the data we hold about you may be erased. One of our staff will write you after this to tell you this has been done or why other data cannot be erased.

    Part 4: How to appeal a decision about personal information we give to you

    17. If I’m not happy with the information I get from the Authority, can I appeal it?

    Yes, when you receive a response to your initial request for data, we will send you the details of our Data Protection Appeals Officer in the Adoption Authority. If you wish to appeal the Data Protection Officer’s decision about what information they have given you or what you did not receive, for example, extra information, you can contact our Appeals Officer. They will thoroughly review your application and the response that you received.

    Tip: Try and contact the Appeals Officer within four weeks of getting a response to your request for information. We can consider late appeals in certain circumstances.

    The Appeals Officer will write to you with their decision. If you are still unhappy with the process, you may then make a further appeal to the Office of the Data Protection Commission. The contact details for the Office of the Data Protection Commission will be provided to you in the letter from the Appeals Officer.

    We hope the above questions and answers have been helpful.

    Mission Statement

    " To ensure the provision of the highest possible standards of adoption related services, throughout the lifelong adoption process, with the best interests of children as the first and paramount objective."

    Please publish modules in offcanvas position.