Irish Defence Forces - Website Copyright Notice
© Defence Forces 2011
Material on this website is protected by copyright. Reproduction of material from this website is authorised for personal use. Reproduction for other uses is permitted, provided that the source is acknowledged. The copyright in material reproduced from this website shall be maintained in the Defence Forces.
No liability for any errors or omissions.
The information contained in this website is provided for general information purposes only, in the interests of public service. While every effort has been made to ensure the accuracy of the information contained on the website, the Defence Forces give no guarantees, undertakings or warranties in this regard, and do not accept any liability arising from any errors or omissions. Errors or omissions brought to the notice of the Defence Forces will be corrected as soon as practicable.
Website material is not legal advice
Any views, opinions and guidance set out in this website are provided for general information purposes only, and do not purport to be legal advice or a definitive interpretation of the law. Anyone contemplating legal action in respect of matters set out in this website should obtain advice from a suitably qualified professional adviser.
Website material is not the definitive view of the Defence Forces
Any views, opinions and guidance set out in this website should not be taken as the definitive view of the Defence Forces. Accordingly, the Defence Forces reserves the right to make decisions which are at variance with any views, opinions and guidance that may be set out in this website.
No responsibility for other websites
Any links from this website to external websites, which are not maintained by the Defence Forces, are provided as a matter of convenience only, and should not be taken as an endorsement by the Defence Forces of the contents or practices of those external websites, for which the Defence Forces assumes no responsibility.
The Defence Forces and the Data Protection Acts
What is Data Protection?
It is the means by which the privacy rights of individuals are safeguarded in relation to the processing of their personal data. The Data Protection legislation confers rights on individuals as well as placing responsibilities on those personnel processing personal data.
The Defence Forces, as an organisation, collects, stores and processes data about serving and retired service personnel both electronically and in structured filling systems. Under the Data Protection Acts, this confers certain legal responsibilities on the Defence Forces in relation to the information that is processed. These responsibilities can be summarised in terms of the eight fundamental rules or principles which must be followed:
- Obtain and process the information fairly.
- Keep it only for one or more specified, explicit and lawful purposes.
- Use and disclose it only in ways compatible with these purposes.
- Keep it safe and secure.
- Keep it accurate, complete and up-to-date.
- Ensure that it is adequate, relevant and not excessive.
- Retain it for no longer than is necessary for the purpose or purposes.
- Give a copy of his/her personal data to the individual, on request.
It is important to define certain terms, appointments and language.
Data: information in a form in which it can be processed.
Personal Data: Data relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is likely to come into the possession of the Data Controller.
Automated Data: Information that is being processed by means of equipment operating automatically in response to instructions given for that purpose or is recorded with the intention that it should be processed by means of such equipment.
Manual Data: information that is recorded as part of a relevant filing system or is recorded with the intention that it should form part of a relevant filing system.
Data Breach: occurs when information is accidentally or deliberately published or lost or made available to persons who should not have access to it.
Data Controller: means a person who, either alone or with others, controls the contents and use of personal data.
Data Processor: means a person who processes data on behalf of a data controller.
Data Subject: means an individual who is the subject of personal data.
Relevant Filing System: A system wherein files relate to clearly identifiable living individuals. The PMS and the DFRMS, including the system of personnel files, are relevant filing systems for the purposes of the Data Protection Acts.
Routinely Available Information
The Defence Forces make information routinely available to serving and retired service personnel in relation to its functions and activities. Such information will continue to be available informally through the chain-of-command without the need to use the Data Protection Acts.
The Data Protection Acts are designed to allow access to individuals held by all bodies, public and private, which is not routinely available. Access to information under the Acts is subject to certain exemptions and involves specific procedures and time limits.
Policy on Confidentiality and Data Protection
Section 5 of the Acts sets out a series of related measures to protect personal data in certain circumstances and is exempt from the Data Protection Acts. In these instances, the reason for the non-disclosure of personal data will be clearly explained. Within this context, however, the Defence Forces will try to provide every requester with as much assistance and information as possible.
If, for any reason, it is wished that any information provided to the Defence Forces should not be disclosed due to its sensitive nature, then it is incumbent on the person of body when supplying the information to make clear this wish and to specify the reason for the sensitivity of the information.
How to apply for information under the Data Protection Acts
Under the Data Protection Acts, anyone is entitled to apply for access to information relating to them that is not publicly available. Each person has a right to:
- Access to records held by the Defence Forces relating to that individual.
- Correction or erasure of personal information relating to oneself as held by the Defence Forces where it is inaccurate, incomplete or misleading.
- Access to reasons for decisions made by the Defence Forces directly affecting oneself.
The data subject is entitled to complete and submit a Subject Access Request (SAR) to the Defence Forces. The request must:
- Apply in writing (either in hard copy or by email).
- Give any details which might be needed to help you identify him/her and locate all the information you may keep about him/her (Service Number, dates of service, previous units, previous addresses)
- Pay a fee of €6.35 in the form of a cheque or postal order made payable to the Secretary General, Department of Defence.
- Include as much information as possible in relation to the specific nature of their request (request for medical files, personal files etc).
In response, the Defence Forces will:
- Acknowledge the request and confirm that the SAR contains the necessary details.
- Supply the information to the individual promptly and within 40 days of receiving the request.
- Provide the information in a form which will be clear to the ordinary person e.g. that any codes must be explained.
Subject Access Requests in writing for information under the DP Acts should be addressed to:
Data Protection Officer,
DJ1, Human Resources Branch,
Defence Forces Headquarters,
Office: (045) 492572
Note: Applications for information under the Data Protection Acts in relation to the Department of Defence will be dealt with by the Department’s Data Protection Officer which is a separate organisation under the data protection legislation.
Please give as much detail as possible to enable the staff of the Defence Forces to identify the record. If you have any difficulty in identifying the precise records which you require, the staff will be happy to assist you in preparing your request.
Requesters must include a telephone number or some other contact system such as the local Gardaí in order that the bona fides of the requester can be established when requesting personal information.
If the Defence Forces does not keep any information about the individual making the request then the requester will be informed within the forty days. The Defence Forces will not be obliged to refund any fee that may have been charged with the request should it be the case that the DF does not, in fact, keep any data. However, the fee must be refunded if the request is not complied with or if you have to rectify, supplement or erase the personal data concerned.
If the individual’s right of access is restricted in accordance with one of the very limited restrictions as laid down in the Data Protection Acts, the data subject must be notified in writing within forty days and it must include a statement of the reasons for refusal. The Defence Forces will also inform the individual of his/her entitlement to complain to the Data Protection Commissioner about the refusal.
Further information is available from the Data Protection Commissioner’s website. Brochures and leaflets relating to the Data Protection Acts are also available free of charge, on request from:
The Office of the Data Protection Commissioner,
LoCall 1890 252 231
Tel: 057 868 4800
Fax: 057 868 4757