Galway City Council Privacy Statement

This privacy statement will let you know how we look after your personal data. It also informs you as to our obligations and your rights under Data Protection Law.

Please note that this privacy statement (updated 03/10/2024) is a general council document about how we approach data protection as an organisation. It is subject to change from time to time and any changes will be posted on our website. Links to these specific privacy policies, Irish and European legislation can be found at section 15 of this document.

It is important that the personal data we hold about you is accurate and up to date. Please keep us informed of any changes to your personal data during the term of your relationship with us.

Please carefully review the privacy statement before giving your consent to our processing of your personal data.

The council has a data protection officer (DPO). Their contact details are as follows:

Telephone: (091) 536400

Email: dpo@galwaycity.ie

Post:

Data Protection Officer,
Galway City Council,
City Hall,
College Road,
Galway.

H91 X4K8

Galway City Council's Data Protection Policy 

Our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. If you do use one of these third-party links, we would recommend that you carefully read the privacy statement on the third-party website.

Data Controller/Processors

For the purposes of the EU General Data Protection Regulation (EU Regulation 679/2016) (the "GDPR"), Galway City Council may act as a data processor and/or a data controller regarding the personal data described in this privacy statement.

"Data Controllers" determine the purposes for which, and the manner in which, any personal data is processed, who/which make independent decisions in relation to the personal data and/or who/which otherwise control that personal data. 

For the purposes of the EU General Data Protection Regulation (EU Regulation 679/2016) (the “GDPR”), Galway City Council may act as a data processor and/or a data controller regarding the personal data described in this privacy statement and in the section specific privacy statements listed below.

“Data controllers” determine the purposes for which, and the manner in which, any personal data is processed, who/which make independent decisions in relation to the personal data and/or who/which otherwise control that personal data.

“Data processors” process personal data on behalf of the data controller.

1. “Personal data” means any information relating to an identified or identifiable natural person. Personal data can be factual (for example, a name, address or date of birth) or it can be an opinion about that person, their actions and/or behaviour. Personal data does not include anonymous data.
2. “Special Categories Data” We may collect special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data) and where this happens you will always be informed, and a higher standard of protective measures will apply.

Here are examples of the personal data we may collect, use, store and transfer which we have grouped together as follows:

• Identity Data includes, for example, first name, maiden name, last name, username or similar identifier, marital status, title, date of birth and gender.
• Contact Data includes, for example, billing address, delivery address, email address and telephone numbers.
• Financial Data includes, for example, bank account and payment card details.
• Transaction Data includes, for example, details about payments to and from you and other details of products and services you have purchased from us.
• Technical Data includes, for example, internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website.
• Profile Data includes, for example, your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.
• Usage Data includes, for example, information about how you use our website, products and services.
• Marketing and Communications Data includes, for example, your preferences in receiving marketing from us and our third parties and your communication preferences.
• Statistical or Demographic data; We may collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.

Here are examples of special categories of personal data that we may collect and process

• Health Data
• Racial or Ethnic origin
• Sex life or sexual orientation 
• Union membership

We have listed below examples of how we collect personal data relating to you:

1. Direct interactions. You may give us your Identity, contact and financial data, medical data and other personal data by filling in forms or by corresponding with us by post, phone, email, internet, by interacting with our staff or otherwise.
2. Websites: Galway City Council’s website (www.GalwayCity.ie) uses certain cookies. Information on our website and cookie policy. 
3. CCTV: CCTV and other surveillance systems are installed in the offices, properties, depots, plant, and other locations in the ownership of Galway City Council or in the public spaces such as streets and community CCTV systems. Information on our CCTV policies. 
4. Third parties or publicly available sources. We may receive personal data about you from various third parties and public sources.
5. Contact, Financial and Transaction Data from providers of technical, payment and delivery services based [inside OR outside] the EU.
6. Identity and contact data from publicly availably sources such as Companies Registration Office based inside the EU.

The legal basis for the processing of personal data by Galway City Council will depend on the legislative framework that applies and the purpose for which the processing is being carried out.  We will only process your personal data where we have a valid legal basis for doing so under GDPR or the Law Enforcement Directive, which are set out as follows:

1. the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
2. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
3. processing is necessary for compliance with a legal obligation to which the controller is subject.
4. processing is necessary in order to protect the vital interests of the data subject or of another natural person.
5. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The legal basis for the processing of special category of personal data will depend on the purpose for which the processing is being done and will be based on one of grounds from (a) to (e) that are set out above (article 6(1)) and one of the grounds set out at article 9(2) of the GDPR. Article 9(2) grounds are set out below.

1. the data subject has given explicit consent to the processing of those personal data for one or more specified purposes
2. processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law
3. processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent
4. processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects
5. processing relates to personal data which are manifestly made public by the data subject
6. processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity
7. processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject
8. processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1).

In relation to your special categories of personal data, we will seek your consent where further processing of the data or where it is provided to a third party. 

Law Enforcement Directive (‘LED’)

The LED deals with the processing of personal data for ‘law enforcement purposes’ by data controllers which fall within the definition of being a ‘competent authority’ for the purposes of the LED, as transposed into Irish law by Part 5 of the Data Protection Act 2018, as amended.  For certain processing activities which it carries out, Galway City Council is a ‘competent authority’ for the purposes of Part 5 of the 2018 Act. In this regard, data may be processed “for the purposes of (i) the prevention, investigation, detection or prosecution of criminal offences, including the safeguarding against, and the prevention of threats to public security, or (ii) the execution of criminal penalties.”

We will only use your personal data for the purposes for which we collected it. We are permitted to use it for another purpose where we reasonably consider that the other purpose is compatible with the original purpose. If we intend to use your personal data for an unrelated purpose, we will first notify you and either seek your consent to such further processing or inform you of the valid legal basis upon which we process your data for this new purpose. There may be circumstances where we are required to further process your personal data, without informing you of this fact, in compliance with EU or Irish law.

We may share your personal data with third parties in connection with our processing of your personal data. We require third-party processors to enter into a data sharing and/or processing agreement(s) with us which comply with our obligations under the GDPR. This agreement requires third parties to have appropriate security systems in place and only to use your personal data on our instructions and in accordance with data protection law.

Where we share your personal data with other public sector bodies, we are required to comply with the Data Sharing and Governance Act, 2019. Sharing with other public sector bodies will require Galway City Council to have a data sharing agreement in place and the contents of that agreement must comply with provisions of the 2019 Act.

We take appropriate security measures against unlawful or unauthorised processing of personal data, and against the accidental loss of, or damage to, personal data. We limit access to personal data to those employees, agents and third parties who are required to have access to it and where they have agreed they are subject to a duty of confidentiality.

We have put in place procedures and technologies to maintain the security of all personal data from the point of collection to the point of destruction. We have procedures in place to deal with actual and suspected data breaches which include an obligation on us to notify the supervisory authority and/or you, the data subject, where legally required to do so.

Galway City Council do not transfer your data outside of the European Economic Area (EEA). However, if in the future Galway City Council transfers your personal data outside of the EEA for the purposes of carrying out the services we provide to you, we will always ensure that there are appropriate safeguards in place to protect your personal data such as:

1. Entering data processing/sharing agreements that contain standard contractual clauses (SCCs). SCCs were developed the European Data Protection Board (EDPB) and any clauses use for the transfer of personal data will comply with EDPB drafted clauses.
2. Any transfer of your personal data will require the third-party to confirm that they are complying with the GDPR.
3. The European Commission has issued a decision confirming that the country to which we transfer the personal data ensures an adequate level of protection for the data subjects' rights and freedoms.
4. Appropriate safeguards are in place such as binding corporate rules (BCR), standard contractual clauses approved by the European Commission, an approved code of conduct or a certification mechanism, a copy of which can be obtained from the DPO.
5. The European Commission and the United States announce that they have agreed in principle on a new Trans-Atlantic Data Privacy Framework, which will address the concerns raised by the Court of Justice of the European Union in the Schrems II decision of July 2020. The agreement in principle will now be translated into legal documents. The U.S. commitments will be included in an executive order that will form the basis of a draft adequacy decision by the Commission to put in place the new Trans-Atlantic Data Privacy Framework.

We will only retain your personal data for as long as is necessary to fulfil the purposes for which we collected it and for as long as we are legally required to under EU or Irish law (Data Minimisation). 

We subscribe to the national local authority records retention policy and any updated national records retention schedules for local authority records. Any retention of your personal data will comply with GDPR requirements and the data will only be held as long as necessary. We may also maintain a data retention policy which supplements the National Retention Policy. Where you ask to be unsubscribed from marketing communications, we will keep a record of your email address and the fact that you have unsubscribed to ensure that you are not sent any further emails.

Under GDPR you have the following rights:

1. Request information about whether we hold personal data about you, and, if so, what that data is and why we are holding/using it. 
2. Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
3. Request rectification of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected.
4. Request erasure of your personal data. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
5. Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your individual situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
6. Object to automated decision-making including profiling, which is not to be the subject of any automated decision-making by us using your personal data or profiling of you. 
7. Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
8. Request transfer of your personal information in an electronic and structured form to you or to another party (commonly known as a right to “data portability”). This enables you to take your data from us in an electronically useable format and to be able to transfer your data to another party in an electronically usable format.
9. Withdrawal of consent: Where we rely on consent as our legal basis for processing you have the right to withdraw consent at any time by contacting us.

Galway City Council does not carry out automated decision-making or profiling. 

10. Obtain details of any transfer of data to a third country (outside the European Economic Area) and safeguards in place.
11. Complain to the data protection supervisory authority, the Data Protection Commission (DPC).

Data Protection Commission:

Website: https://www.dataprotection.ie/ 
Telephone: +353 57 8684800/+353 761 104 800
Email: info@dataprotection.ie 
Post:

Data Protection Commission
21 Fitzwilliam Square South
Dublin 2
D02 RD28
Ireland

When exercising your GDPR rights (the rights set out at 13 above) there is no requirement that the request be in writing. All your GDPR rights request require us to comply within 30-days but this may be extended to 60-days if the request is complex and/or voluminous. If any request is made, it will be necessary that certain information should be provided when submitting the request. This will assist us in responding to your request. You should include:

1. Name and surname.
    
   
   1. Address, housing list number or Council reference number (if applicable).
   2. Section or sections that you interacted with. 

If the above information is not provided at the time of submitting the request, the Council will seek this information from you. As you may have interacted with a number of sections in the Council, the Council may need to request that you provide us with details of the sections that hold your data. Submitting a GDPR rights request may require the Council to obtain certified identification from you. 

If you are submitting a request by e-mail, it is not a requirement, but it is advisable that you use the DPO e-mail address.

You will not usually have to pay a fee to access your personal data (or to exercise any of your other rights). However, we are entitled to charge a reasonable fee in circumstances where your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances. We will endeavour to respond to your requests without undue delay and within one month. If your request is particularly complex or voluminous, it may take us longer to respond. A request can be extended by a further 60-days.  If we anticipate that it will take us longer than one month to respond to your request, we will notify you of the delay and reasons for such delay within one month of your request or as soon as we anticipate that processing the request will exceed the timeframe of 1 month. 

If you are not satisfied with the outcome of the response you receive from the Council in relation to a data protection request/issue, you have the right to make a complaint to the DPC and who may investigate the matter for you.

Page last reviewed: 03/10/24

Content managed by: DPO - Corporate Services Department