My Data Rights aims to assist survivors of Irish Industrial and Reformatory Schools to use the EU General Data Protection Regulation (GDPR) to access their personal information, including records of the testimony that they gave to a previous inquiry or redress process. This website was created by LL.M. students in the Human Rights Law Clinic at the Irish Centre for Human Rights, NUI Galway, in collaboration with Justice for Magdalenes Research and Adoption Rights Alliance, under the supervision of Dr Maeve O’Rourke. None of the information contained on this page is intended as legal advice.
We have created two useful resources for survivors of Irish Industrial or Reformatory Schools:
1. A Guide to help you apply for your personal data using GDPR (as well as Freedom of Information where necessary)
Click here to download the Access to Records Guide in Word format.
Click here to download the Access to Records Guide in PDF format.
2. A Guide to help you make a complaint to the Data Protection Commission (if you are not happy with the result of your application using Guide 1)
Click here to download the Complaints Guide in Word format.
Click here to download the Complaints Guide in PDF format.
Explanation of the Guides
Access to Records Guide
The purpose of the Guide is to help people who were detained in Irish Industrial Schools or Reformatory Schools to apply to the relevant agencies (‘data controllers’) for their records.
These records are your personal data because they are information identifying you or relating to you. Under the General Data Protection Regulation (GDPR) you have a right of access to your personal data which can be exercised through making a personal access request.
This Guide contains information to help you make a personal access request for your records. The Guide also contains information to help relatives apply for the records of deceased family members.
The Guide contains information about the request process, as well as sample letters of requests that you can use. It contains addresses, telephone numbers, emails and website information for the following data controller organisations:
- Department of Education
- Department of Health
- Barnardos
- The Irish Society for the Prevention of Cruelty to Children (ISPCC)
- Residential Institutions Redress Board
- Commission to Inquire into Child Abuse
- National Archives of Ireland
- Some Religious Orders
You might also need to do some additional research to find the relevant postal or email address for a data controller specific to your situation.
The Guide also contains the names of the different industrial and reformatory schools, and their addresses, to help you to identify which school you were in (as this will be needed in your letter of request).
Complaints Guide
By following the process in our Access to Records Guide, we hope that you will receive the information you were seeking. However, if you are unhappy with the result of your request, you can use our Complaints Guide to make a complaint to the Data Protection Commission using the online request form on the Data Protection Commission’s website.
You can complain if you haven’t received a response to your complaint, if your information has been redacted or if the data controller has failed to provide you with your personal data.
The guide also contains some arguments you can use in making your complaint.
My Data Rights was created in 2020 by Senem Renk Gurgen, Mary Harney, Cassie Roddy-Mullineaux and Pedro Cantero. These guides are published under a Creative Commons licence. You are free to copy and redistribute the material as long as you give appropriate credit, you do not use the material for commercial purposes, and you do not change the material.
data access is a right
The Right of Access (also known as subject access) to personal data is enshrined as a fundamental right in Article 8 of the EU Charter of Fundamental Rights. According to the doctrine of ‘primacy of EU law’, EU law takes precedence over any conflicting Irish law. The EU General Data Protection Regulation (GDPR) requires implementation in Ireland of the Right of Access, along with other rights relating to personal data.
The Right of Access under Article 15 GDPR gives individuals, like you, the right to obtain a copy of your personal data (including school records, medical records, transcripts of testimony and redress records, for example). ‘Personal data’ is defined in Article 4 GDPR as:
…any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
According to Article 15 GDPR, any person or institution in control of your personal data also has to provide you with the following relevant information:
- Confirmation of whether or not they have your personal data;
- If they do, to provide you with a copy of your personal data electronically – as well as information on:
- Why they have it;
- What categories of personal data they have;
- Who else within the organisation, or third parties, has accessed it, or may access it in the future;
- How long they plan on keeping your data;
- How they got your data;
- The fact you’re entitled to have your data fixed or deleted as requested; and
- The fact you’re able to raise a concern with the Data Protection Commissioner if you are not happy with their response.
The Right of Access may be subject to exceptions, but only if those exceptions are strictly in compliance with the GDPR, are actually necessary to achieve a legitimate aim, and strike a proportionate balance between competing interests. If a data controller wishes to refuse your access to your own personal data based on the ‘rights and freedoms of others’, for example, they must be able to demonstrate clearly the harm that would be caused to somebody else by the release of your own data to you, and why that outweighs your interests in receiving your personal data. The GDPR does not provide rights to deceased individuals.
Unfortunately, it appears that in recent years, survivors of so-called ‘historical’ abuses in Ireland are finding it increasingly difficult to access their own information, including the records of testimony that they contributed to State inquiries or redress processes.
Several agencies and individuals that control survivors’ files seem to be redacting more information than previously: for example, redacting any information relating to another person whether the other person is a state official, a member of a religious congregation or otherwise in a position of authority, or a parent or other family member of the person requesting their data, whether deceased or alive.
Furthermore, in 2019 the Department of Education published draft legislation (the Retention of Records Bill 2019) which – if passed – would prohibit all access to every document contained in the archives of the Commission to Inquire into Child Abuse and the Residential Institutions Redress Board and its Review Committee for at least the next 75 years. The written submissions of numerous survivors, practitioners and academics resisting this proposed legislation are available online.
The GDPR enshrines strong data access rights for individuals. It can be a powerful tool in helping people gain access to their personal data by making a ‘data subject access request’ and a follow-up complaint to the Data Protection Commission if necessary.
If you have been thinking about searching for your information, or if you have been experiencing difficulties obtaining your information: now is the time to start using the GDPR.