Dáil Éireann Debate, Wednesday - 16 June 2021
186. Deputy Holly Cairns asked the Minister for Children, Equality, Disability, Integration and Youth the way in which his Department is facilitating and addressing subject data access requests by survivors of institutional abuse; and if he will make a statement on the matter. [32477/21]
View answerFormer residents of Mother and Baby Homes can make a Subject Access Request (SAR) to my Department for access to their record. My Department is cognisant of its obligations as a data controller when responding to SARs and is responding on a case by case basis to individuals within the timeframes required by the GDPR.
GDPR provides that the one month period for SARs may be extended by a further two months where necessary, taking into account the complexity of the request. The data controller is obliged to inform the data subject of any such extension within one month of the receipt of the request including the reasons for the delay. The deadline for responding to SARs commences from the time the identity of the requestor is verified. My Department is responding to SARs in accordance with its GDPR obligations and engages with each data subject in relation to the progress of their request.
The right of a person to obtain a copy of their personal data, contained in Article 15 of the GDPR, is not absolute. It is specifically limited by reference to the rights of others, which must not be adversely affected by the right of a data subject to obtain a copy of their personal data. Therefore, in responding to a SAR, my Department must consider the rights of the data subject and also ensure that the rights and freedoms of others are not adversely affected. The consideration of adverse effects and the balancing of rights test is a critical part of the SAR process and can be highly complex. My Department also has regard to relevant Regulations such as S.I. No. 82/89 – Data Protection (Access Modification) (Health) Regulations, 1989 where health data is included in a record.
My Department, in consultation with the Attorney General, developed guidelines which set out the steps that must be taken in response to each subject access request.
In order to assist the processing of subject access requests and to vindicate the rights of data subjects, my Department has put in place a multi-disciplinary team which includes legal and data protection expertise. In addition, my Department has engaged external data protection consultants to support the processing of SARs.
Information relevant to making a SAR is available on my Department's website. The webpage also includes a detailed guide to making a SAR that provides responses to Frequently Asked Questions. The guide includes information on the different means available to make a SAR such as by email, post or other means.
In addition, my Department also operates a dedicated telephone information line which provides information to callers on procedures for making a SAR in respect of records relating to the Mother and Baby Home Commission of Investigation.
