Data protection legislation aims to protect the rights to privacy of individuals (all of us). The key data protection laws in Ireland are the GDPR and the Data Protection Act 2018.

These laws matter as they lay down rules relating to the protection of individuals with regard to the processing of personal data. They impose obligations on controllers and processors, and provide individuals with rights in relation to their data, such as a right of access.

People who determine the means and purposes for processing personal data  are called data controllers. The Adoption Authority is a data controller and we protect your personal data and that of others. We can only share information with you in line with our data protection obligations.

Personal data is any information relating to an identified or identifiable living person. Examples of personal information are:

• a name
• date of birth
• address
• phone number
• email address
• Personal Public Service (PPS) number
• photos
• Internet Protocol address

These are all protected by law.

When you have made a request for personal information, a staff member from the Adoption Authority will acknowledge your correspondence/request. They will tell you what is happening and how long it will take to get your information. You are entitled to a response within 30 days (or within 90 days when requests are numerous or complex). They may ask you for more information to verify your identity, or to find what you have asked for, or to direct you to the correct person or organisation who can deal with your request.

We request proof of your identity to protect people’s personal information. We cannot provide information to any individual until they provide proof that they are who they say they are. If we did not ask for proof of your identity, then any member of the public could pretend to be you and could be given your personal information.

We accept most photographic and legal documents as proof of identity. Before we can give you the personal information we might have, we need a copy of one of the following of your personal items:

• Current Irish driving licence
• National Age Card
• Passport
• Public Service Card

Important: The copy of the identification you use should be verified (stamped). This means that before you send us a copy of your identification, you need to get the copy stamped by:

• your local Garda or police station (free), or
• a solicitor or commissioner for oaths if preferred. (There may be a fee in these instances.)

When we get this verified copy of your identity, we can start to work on your specific request for data.

I don’t have any of the above identification

It depends. The documents held by the Adoption Authority may contain personal data about you and a range of different individuals. The types of documents on most adoption files may include some of the following list:

• an application for the adoption order,
• assessments of prospective adoptive parents,
• references to support the application for the adoption,
• consents signed by birth parents,
• court orders.

(Note: When we talk about an ‘adoption file’ we are talking about the recording of an adoption having taken place. This will contain lots of documents not just your personal data.)

You may only have access to your own personal data. In circumstances where documents relating to you also contain third party data (such as data relating to your birth parents or adoption parents) such third party data may be redacted, or the documents may be withheld depending on the circumstances.

The reason that we redact third party data is because your right to a copy of personal data relating to you is not absolute.  Article 15(4) of the GDPR provides that your right to a copy of your personal data must ‘not adversely affect the rights and freedoms of others’.

A birth certificate contains personal data relating to people other than you (such as your birth parents). If provided to you, it would identify another person or people, and may have an adverse effect on them. As noted in our response to question 8 above, your right to a copy of your personal data is not absolute. Article 15(4) of the GDPR requires the Adoption Authority to ensure that disclosure of any documents containing your personal data does not adversely affect the rights of other people. Accordingly, it may be necessary for the Adoption Authority to withhold birth certificate information. It is possible to disclose birth information if all parties named on the birth certificate have given their prior written consent to the disclosure of the information

By law, we are required to respond to your personal data access request within one month from our receipt of stamped (verified) ID from you. However, if your access request is complex, we may extend the timeline for a two further months. We will write to you if this longer time period applies to you so you will know to expect it.

For adoption-related personal information

Unfortunately, you cannot get personal information under the Freedom of Information (FOI) Act from the Authority if it relates to the making of an adoption order.

The Adoption Authority is referred to in the Freedom of Information Act. The Act lists the Authority as a “Partially Included Agency” and this means that adoption-related files are exempt – not covered – as part of FOI requests.

For other information

People can get other information we may hold about them on other types of records under FOI. For example, a person who attended an interview for a job with us may request under FOI feedback on their performance.

You can request this or other information/queries from us by writing to aai.gov.ie/en/contact-us.html with FOI request written at the top of your letter or email.

Yes, in some situations you can correct information about you that is incorrect. This is known as “a right to rectification” under the GDPR. We can advise you as to how to do this if you tell us what has been recorded incorrectly.

Correcting some information (like factual information) may mean that documents have to be amended by the organisation who gave us the information in the first instance. This may take some time as there are legal procedures to follow. However, we can correct simple mistakes such as misspellings or a typing error.

How to get us to correct incorrect information

In order for the correction to be made, please write to us in with the correction you want. The correction might be to:

• update an address
• telephone number
• correct the spelling of your name

What happens when we can’t correct information?

Sometimes we are not able to make corrections. For example, if the spelling mistake or the date of birth is on an official document which we hold, we may not be able to make the correction for you. If this is the case, we will explain this and tell you how you can get the official document corrected if necessary.

Top tip: Please tell us if you spot a mistake or you need us to update your contact details or similar. Thank you in advance.

It depends. While there is a right to erasure under GDPR (also known as  “the right to be forgotten”), it is not an absolute right as certain records cannot be erased because they must be kept by law. For example, the record of an adoption order is a legal record and must be kept for that reason.

The Adoption Authority has to keep much of the data we have about you as it is part of a legal process. We will review the data we hold about you, when we receive a request to erase information, and consider whether it can be erased. We will inform you of the actions we have taken in response to your erasure request within one month of receipt of your request (or within 90 days where necessary due to the complexity of your request.

Yes, when you receive a response to your initial request for data, we will send you the details of our Appeals Officer in the Adoption Authority. If you wish to appeal the Data Protection Officer’s decision about what information they have given you or what you did not receive, for example, extra information, you can contact our Appeals Officer. They will thoroughly review your application and the response that you received.

You may also appeal to the Data Protection Commission. Here are the relevant contact details:

DATA PROTECTION COMMISSION
21 FITZWILLIAM SQUARE SOUTH
DUBLIN 2
D02 RD28
IRELAND

Tel: 01-765 0100 / 1800 437 737