Article 15 of the General Data Protection Regulation (GDPR) and section 91 of the Data Protection Act 2018 entitle any living person to copies of data relating to them which is held by Dublin Bus. In order to exercise this legal right, the following steps should be made:
Data Access request section:
- All Data Protection requests need to be made in writing and emailed to Dublin Bus’s Data Protection Officer (DPO), Dublin Bus 59 Upper O’Connell Street, Dublin 1 or emailed [email protected].
- The Data Subject should state that they wish to make a subject access request under the GDPR and the Data Protection Act 2018.
- The request should include the following:
- Sufficient details to expedite the search
- A copy of identification to verify who they are
All data relating to other third parties in the records will be redacted unless, as per Section 41 and 60 of the Data Protection Act 2018, one of the following grounds is met and it is necessary and proportionate:
If in the opinion of a Garda Chief Superintendent or higher or a member of the Permanent Defence Forces who hold rank not below colonel, the data is required for safeguarding the security of the State.
- It is required for the purpose of preventing, detecting or investigating offences, apprehending or prosecuting offenders or assessing or collecting any tax, duty or other monies owed payable to the state, local authority or health board.
- It is required in the interests of protecting the international relations of the State.
- Its disclosure is required urgently to prevent injury or other damage to the health of a person or serious loss or damage to property.
- It is required under a piece of legislation or through a court order.
- All other data subjects whose details are included in the records give their written consent to having their data disclosed.
Data is sought to investigate a crime or collecting monies owed to the State
If un-redacted data is being sought under the grounds of preventing, detecting or investigating offences, apprehending or prosecuting offenders or assessing or collecting any tax, duty or other monies owed payable to the state, local authority or health board, an official email/letter must be sent to the Data Protection Officer confirming this.
Solicitors seeking to make an access request on behalf of their clients should submit the following:
- Sufficient details to expedite the search.
- A letter of authorisation from their client.
- A copy of identification to verify who their client is.
Any customer who claims to be representing themselves in court must first produce a court order before un-redacted data will be released to them. This must be sent to the Data Protection Officer.
CCTV access requests under Data Protection Law
CCTV footage comes within the scope of Data Protection legislation. In compliance with guidelines issued by the Office of Data Protection Commissioner, CCTV records will be released in pixelated video format. All personal data relating to other data subjects will be redacted.
Processing an access request
Dublin Bus must action a subject accesses request within 30 calendar days of receipt of the initial request. Dublin Bus reserves the right to contact a data subject for additional information to help them expedite the process.
Dublin Bus will issue the records to the subject via registered post. Dublin Bus reserves the right not to issue the records until it has received evidence of identity.
Making a complaint to the Data Protection Commissioner
If you are unhappy with how Dublin Bus has handled your access request, you are entitled to make a complaint to the Office of the Data Protection Commissioner. The contact details are as follows
LoCall: 1890 252 231
Tel: 057 868 4800
Fax: 057 868 4757
Email: [email protected]
Website: www.dataprotection.ie