Introduction

The purpose of this document is to set out the privacy entitlements of Data Subjects, as defined in the General Data Protection Regulation (GDPR), of living persons. Privacy can only apply to information that is not already in the public domain and GDPR only applies to such personal data.

The General Data Protection Regulation (GDPR) is a European Union Regulation that sets out the data entitlements of data subjects and the obligations of those who process the personal data of data subjects. GDPR seeks to protect and enhance the rights of data subjects. These rights cover the safeguarding of personal data, protection against the unlawful processing of personal data and the unrestricted movement of personal data within the EU.

Personal Data

As a public representative I have a copy of the database that is the Electoral Register for the Waterford Constituency, this is my home constituency, supplied to me through the Houses of the Oireachtas.

When a resident within the Waterford constituency contacts me to make a representation on their behalf, I store that information within the Houses of the Oireachtas database and server**. The data stored is a copy of our correspondence, any correspondence I receive on your behalf and your contact details to enable me or a member of staff to make contact with you. A record of this correspondence is kept in the event that you contact me again and I need to reference previous representations. Depending on the representation received, I may need to keep certain special category data to enable me to perform representations on your behalf; for example I have data about health issues when I am making a representation to the Department of Health.

For the sake of clarity: SPECIAL CATEGORY DATA means personal information about a person’s: • race • ethnic background • political opinions • religion • philosophical beliefs • membership of a trade union • genes (biological inheritance) • biometric data (such as fingerprints on a passport) • health • sex life • sexual orientation. I do not keep a record or database of voter preferences or political beliefs.

My office staff have access to this data and conduct aspects of representations on your behalf. When you first make contact with me, you will be required to confirm that you agree to the processing of your information.

Contact from outside the Waterford Constituency

As a Senator I also receive data from individuals outside of the Waterford Constituency, indeed from all around the country. If you contact me on a constituency related matter and you are not from the Waterford constituency, I will refer your query to the relevant Fine Gael Oireachtas Member to take up the enquiry on your behalf. I will then delete your data.

Contact via Website

The website www.johncumminswaterford.ie does not collect any unique information about you (such as your name, email address, etc.) except when you knowingly choose to provide such information as in the case of the submitting the contact form.

When an individual uses the contact form on the website www.johncumminswaterford.ie they must give consent to their data being processed. At the point in which an individual fills in their contact details, they are prompted to a further consent box explaining that the website is hosted by WIX and that use of the contact form may require personal data to be temporarily stored outside of the EU until it is logged on the Oireachtas database, at which point it is immediately deleted. A link to this Privacy notice is also contained within this consent button

See Section 5 "Where do we store your personal information" https://www.wix.com/about/privacy

Other Data

I also keep a record of the contact details for community groups, organisations, businesses and representatives in the constituency. Many of these are generic email addresses, but some contain the contact details of the person with whom my office engages. If you email me from your organisation, and it is not a generic email, I will process that data by virtue of storing the email address within your email, and replying to you.

I have access to the contact details of members of Fine Gael within the Waterford Constituency which is used to keep in regular contact with them and inform them of meetings/events etc.

**Oireachtas Server

All of our data is held on the Oireachtas server. The IT staff in the Oireachtas on occasion may have access to the content of our computers for the purposes of rendering IT assistance. There is a data processing agreement between me and the Oireachtas ICT. Our IT system has the Oireachtas level of security which means it is password protected and only authorised persons have access to the data. All Oireachtas staff of Public Representatives are Garda Vetted and have been reference checked.

Sources of Information:

Most of the personal information I deal with, I get from the person, such as you, that the information relates to. However, I will from time to time get personal information about other people. This might happen where one person legitimately makes a representation on someone else’s behalf, or requests me to ask a parliamentary question/raise a commencement matter.

It could occur if someone gives me what they say is a whistleblower’s disclosure. In principle, I must tell you promptly if I get personal information about you from someone else, but there are exceptions.

Two significant exceptions arise where it would involve disproportionate effort to tell you, or telling you would be inconsistent with a legitimate reason why the information was given to me.

This website only uses essential cookies for security and functionality of the website. We do not use third party cookies or pixels.

Data Minimisation Principle:

I will only collect the information I need so that I can ensure adequate processing of information relevant to your enquiry. I do not sell or broker your data. I do not transfer it to any centralised database, nor outside of the country.

Data Transfers

Data may inadvertently cross borders in the operation of certain software applications where the operation of the software is controlled from the US. These transfers are provided for in the standard contractual clauses within GDPR.

Legal basis for processing any personal data

I rely on the following grounds to process data:

Consent

Information is gathered from you as a data subject with your express and explicit consent. Through agreeing to this privacy notice you are consenting to us processing your personal data for the purposes outlined. You can withdraw consent at any time by emailing John.cummins@oireachtas.ie and I'll delete your data immediately.

Performance of a Statutory or Legal Obligation

I may come into possession of data that has a mandatory reporting obligation, that might include sensitive data. In such instances I will notify the relevant Body and share whatever data I am obliged to. This, for example, may arise where data is sent to me that discloses a child in danger, in such instance I may be obliged to contact Tusla, depending on the content of that email.

Disclosure

A necessity of my making a representation on your behalf is that I share your name and as much detail as I am obliged to give with the party to whom I am making the representation on your behalf. I will not contact any third party before engaging with you and being in possession of your consent.

You may ask me to make a representation on your behalf to a Department or State agency or raise a commencement matter in the Seanad (Senate) where the subject matter includes personal information about you. If the representation or request you make to me is on behalf of a third person, you will need to show me that you have that third person’s consent. This does not apply if you show to me that the third person is, because of physical or mental incapacity, or because (s)he is too young, incapable of giving the consent.

Making representations or raising a commencement matter means that personal information will have to be shared with other people. For example, if I make a representation to a State body or a Department, a limited number of people there will have to consider and deal with the information to give me an answer.

My office staff have access to that data and conduct aspects of representations on your behalf. When you first make contact with me, you will be required to confirm that you agree to the processing of your information, this is carried out via a separate form that will be sent to you by return. A copy of this form is kept on the constituency database also.

Retention Policy

Data will be retained until I am no longer a public representative, when it is deleted and certified as so by the Houses of the Oireachtas IT or until you instruct me to delete it.

Data storage

All of our data is all held on the Oireachtas server on the Leinster House Campus. No data is held at my Constituency Office. Everything is online via the Oireachtas ICT system.

Your rights as a data subject

For the entirety of the time that I am in possession of personal data, data subjects have the following rights:

Right of access – you have the right to request a copy of the information that we hold about you.
Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
Right to be forgotten – in certain circumstances, you can ask for the data we hold about you to be erased from our records.
Right to restriction of processing – where certain conditions apply you have a right to restrict the processing.
Right of portability – you have the right to have the data we hold about you transferred to another organisation.
Right to object – you have the right to object to certain types of processing such as direct marketing.
Right to object to automated processing, including profiling – you also have the right not to be subject to the legal effects of automated processing or profiling.

These rights may on occasion need to be modified/curtailed by statutory or competing obligations. In such an instance we will give a very clear reason as to why this has occurred.

You can request the following information:

Identity and the contact details of the person or organisation that has determined how and why to process your data.
Contact details of the data protection officer, where applicable.
The purpose of the processing as well as the legal basis for processing.
If the processing is based on the legitimate interests of our company or a third party such as one of its clients, information about those interests.
The categories of personal data collected, stored and processed.
Recipient(s) or categories of recipients that the data is/will be disclosed to.
How long the data will be stored.
Details of your rights to correct, erase, restrict or object to such processing.
Information about your right to withdraw consent at any time.
How to lodge a complaint with the supervisory authority (Data Protection Regulator).
Whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether you are obliged to provide the personal data and the possible consequences of failing to provide such data.
The source of personal data if it wasn’t collected directly from you.
Any details and information of automated decision making, such as profiling, and any meaningful information about the logic involved, as well as the significance and expected consequences of such processing.

To access what personal data is held, identification will be required

My office will accept the following forms of ID when information on your personal data is requested: a copy of your public services card, driving license or passport – photo ID; and a utility bill not older than three months. A minimum of one piece of photographic ID listed above and a supporting document is required. If we are dissatisfied with the quality, further information may be sought before personal data can be released.
All requests should be made to john.cummins@oireachtas.ie or by writing to me office at Senator John Cummins, 31 Parnell Street, Waterford City or Seanad Eireann, Leinster House, Dublin 2. Or telephone (01 6183304)

Complaints

In the event that you wish to make a complaint about how your personal data is being processed by my office you have the right to make a complaint to me or to the offices of the Data Protection Commission at www.datacommission.ie