IGM Privacy Notice

Privacy Notice

This Privacy Notice describes how we use your personal data which is held by the Interim Grievance Manager (IGM).

Your personal data will be treated with the highest standards of security and confidentiality, in accordance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (“Data Protection Legislation”).

This Notice uses certain terms which have a particular meaning under Data Protection Legislation. You have a number of rights in relation to your personal information which are set out in this Notice.

Who we are

The Interim Grievance Manager (IGM) is an independent non-statutory complaints process for interpersonal type complaints for serving members of the Defence Forces (both PDF and RDF) that is completely external to the Defence Forces and civilian led. The process has been established on an interim basis pending amendments to primary legislation.

Your personal data and how we collect it

The personal data we hold and where it comes from will depend on the type of interaction you have with the IGM.

We will process your data when you provide it to us for example during the course of making enquiries or submitting a complaint.

The personal data collected may include: name, address, contact information, (e.g. email address, telephone number), service number, gender, and other details relating to the purpose of your contact with the Office and any other personal data which you provide. It can also include special categories of personal data, for example data concerning health.

A large amount of the personal data which we hold is provided in phone calls, forms, letters, emails or other communications with the IGM.

We ask all visitors to sign in and out at reception for security and safety reasons. Closed-circuit television (CCTV) operates in public areas of the building for security purposes.

What we use your data for

We process your personal data so that the IGM can carry out its functions in relation to an investigation of the complaint submitted. The use of personal data is necessary for the performance by the IGM of its function.

Who we share your information with

The IGM will need to share your information with third parties relevant to your complaint. This may include: the person complained of, the external investigator, witnesses to the incident in question, commanding/higher raking officers, mediation services and other third parties as may be required throughout the investigation.

Your information will not be shared with any third party without your prior consent and the information shared will only ever be to the level of what is required by the third party in question in order to carry out their role in the process.

Third parties

Where personal data is of a third party who did not make the complaint. As a third party, your personal data can be contained in the information provided by the complainant in relation to a complaint. Personal data about you could be contained in other documents which the IGM receives, such as submissions, letters or emails.

Your data protection rights

You have several rights under Data Protection law in relation to how we use your personal information.

Right of access

You have the right to request a copy of your data and to be informed how the data is used. The IGM will ensure that requests from data subjects for access to their personal data will be identified and fulfilled in accordance with relevant legislation.

Right to rectification

You have the right to request that any inaccurate data be corrected and updated.

Right to erasure

You have the right to request erasure of your data. There are certain restrictions on the right to erasure for instance if another legal basis applies to the processing.

Right to restrict processing

You have the right to request restriction of data processing of your information in certain circumstances.

Right to data portability

You have the right to request that personal data be given to you or another person in a transferable or machine readable form, if the legal basis used to process the data is done with your consent or as part of a contract.

Right to object to processing

You have the right to object to the processing of your data. There are restrictions to this right, which include where a legal matter is ongoing. If your personal data is held by us on the basis of your consent, you have the right to withdraw that consent at any time.

Right not to be subject to automated processing or profiling

You have the right not to be subject to automated processing or profiling which produce legal effects concerning you. There are restrictions to this right which include processing as part of a contract or where you have given explicit consent.

Right to withdraw consent

You have the right to withdraw consent to the use of your data where consent was the legal basis to process the data.

You have the right to request a copy of your personal data by making a subject access request. As part of the response the following information is also to be provided:

• the purpose of the processing

• the types of personal data processed

• the recipients or categories of recipient to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organisations

• where possible, the envisaged period for which the personal data will be stored or, if not possible, the criteria used to determine that period

• the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing

• the right to lodge a complaint with a supervisory authority

• where the personal data is not collected from the data subject, any available information as to their source

• the existence of automated decision-making, including profiling and, at least in those cases, meaningful information about the logic involved as well as the significance and the envisaged consequences of such processing for the data subject

The request will be commenced when your identity is verified. We will be unable to commence your request if we are not fully satisfied as to your identity. This is to ensure that personal data is not accidentally disclosed to the wrong person. Responses to “subject access requests” will be issued by registered post.

We are obliged to respond to your request within one calendar month. If however we are unable to respond to your request within this period, we may extend for a further two months. We will send you a written explanation of the reasons for any extension.

Processing data outside the European Economic Area (EEA)

The IGM will not ordinarily transfer personal data outside of the European Economic Area (EEA) or third countries with an adequacy decision unless, for example, we are corresponding with a person related to an enquiry or complaint who resides overseas. In the event that this position changes, the IGM will comply with its obligations under Article 46 of GDPR by adopting one of the appropriate measures approved by the Data Protection Commission and the European Commission to ensure that such transfers are lawful.

How long we keep your personal data

The personal information you have provided will be processed by the IGM for the purposes of its investigation into your grievance. The length of time we hold your personal data for will depend on the type of document or record which contains the personal data however, in general we will not hold your personal data for longer than three years. We may hold this data for a longer period if we are legally required to do so.

Right to make a complaint

You have the right to make a complaint to the Data Protection Commission.

Contact details for the Data Protection Commission are as follows:

Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28

Web forms are available at: www.dataprotection.ie

Email: info@dataprotection.ie

Telephone: +353 578 684 800 or +353 761 104 800

Changes to this Notice

We may update this Privacy Notice from time to time and to ensure compliance with legal requirements.