Applicant privacy notice
For purposes of CAP1 and CAP2 exemption applications & Robotic Processing Automation
The Institute's commitment to your data privacy
Here at the Institute, we take our data protection obligations to you seriously. We are committed to meeting our obligations and maintaining trust and integrity in our data processing activities.
Please see our data protection policy and general privacy policy for more information.
What is a privacy notice?
This notice is called an Applicant Privacy Notice ("the APN"). It describes how and why Chartered Accountants Ireland (the "Institute", "we", "us" or “our”) collect Personal Data and what we do with it.
This APN applies to all prospective students or candidates participating in the Chartered Accountancy Programmes 1 & 2 ("CAP 1" or "CAP 2") who apply for an exemption from CAP 1 and/ or CAP 2 Examination(s).
In this APN, the Institute explains what personal data it processes in the context of CAP1 and CAP2 exemption applications and in using Robotic Processing Automation ("RPA"). We also explain how we obtain, process, use, retain, store and destroy applicants' personal data day to day and how we use RPA to enhance our exemption review process.
Why is an APN required?
The Institute is required by data protection law, including the General Data Protection Regulation (EU 2016/679) (“GDPR”) and the Data Protection Act 2018, to provide you with information in relation to the collection, holding, use, disclosure and transfer (known as “processing”) of personal information (or “Personal Data”) relating to you. In legal terms, the Institute is known as a Data Controller.
Definitions
"Controller" means the natural or legal person who, alone or jointly with others, determines the purposes and means of processing of personal data. In this instance the Institute is the Controller of your Personal Data.
"Personal data" means any information about an individual from which that person can be identified either directly or indirectly.
"Processing", means any operation which we perform on your Personal Data, such as collecting, using, storing, transferring, disclosing, altering or erasing your Personal Data.
"Processor" means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller.
“Special category data” is personal data which are more sensitive in nature and therefore require a higher level of protection, including health data, genetic data, biometric data obtained for identification purposes, information about sex life or sexual orientation, race or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership. The Institute does not process any Special Category Data in connection with CAP1 or CAP2 exemption applications.
What is Robotic Processing Automation?
Here at the Institute, we use technologies to enhance our examinations processes and services for the benefit of all. We use Robotic Processing Automation ("RPA"), a machine learning technology, to support Institute personnel working in our Education Department, when dealing with the high volume of Applicant exemption applications we receive.
Put simply, applicant exemption application data is inputted to a software process (robot) to assist with assessing if the exemption application data satisfies exemption application requirements or not. The robot provides a yes or no answer. The robot is programmed to deal only with pre authenticated data and it does not have the capacity to make decisions in relation to any applicant or their personal data other than a yes or no answer to an applicant's exemption application.
For the first year of the life time of the use of the technology until July 2024, the outputs of the robot are reviewed at several stages of the process by a member of our Education team to verify the answers provided, so there is no possibility of an automated decision being made in relation to any applicant in the absence of human intervention. It is anticipated that the RPA process dealing with CAP 1& 2 exemption applications will be fully automated by June 2024.
The Institute will continuously validate and test the outputs of the RPA and train personnel on how to appropriately use the RPA for the benefit of students and the Institute. In the event that any applicant would prefer that their exemption application is not processed by means of the RPA process, then the applicant can notify the Institute of their objection by emailing transcripts@charteredaccountants.ie Please note that objecting to the RPA data processing may slow down the processing of any exemption application.
Human checks of RPA activity
As noted above, for the first year ending July 2024, the RPA has three "Human In the Loop" points where the activity of the Robot is verified before it is allowed to progress and prior to communicating the outcome of the exemption application to a student.
Source of the personal data
Personal data for the data processing is collected from applicants via an online application form during the Institute’s student registration process. Personal data is also collected from Applicants’ universities, which may submit transcripts on applicants’ behalf.
For more information on the data processing steps involved in setting up your exemption application
Steps in setting up exemption application, using RPA
- Fill in the online application form during the Institute’s registration process and confirm that your university is aware of the requirement to submit your preauthorised personal data including transcripts on your behalf. Please ensure the information you input (particularly your student number) is accurate to ensure the proper processing of the application and to make sure the information we hold about you is accurate and as up to date as possible.
-
- An internal CRM record is created on receipt of your completed application form. The purpose of the CRM record is to track the progress of each Applicant's exemption application.
- Share your transcript with the Institute via the appropriate channel. You will find instructions on this on our website. On receipt, a member of the Education team creates a folder for the applicant and feeds the transcript to the Robot.
- The Robot confirms that your university transcripts matches the educational achievements inputted by you on your online form by loading the image of the transcript to a Document Understanding Cloud where the details are read and sent back to the Robot as data fields.
- The Robot then applies the Institute's exemption rules to determine whether an applicant meets the Institute’s exemption requirements. See exemption rules for further information.
- The Robot updates the CRM system with the outcome of the review. The Robot has a number of exception handling scenarios where it notifies the Student Admissions Department Team if it cannot make a decision or if any of the steps do not complete satisfactorily (for example, if the degree speciality is not found in the rule database or the student record is not found on CRM. See also 'Human Checks of RPA Activity' in relation to the human intervention that will take place during the first year of the technology.
Where is personal data stored and updating your personal data
The records of personal data are stored on the Institute's CRM database, on the Institute's instance of the UiPath cloud environment and in our offsite storage facilities (operated by our service provider Kefron and used by the Education team to store student and member data records separate to the UiPath cloud environment).
The accuracy of outputs from the RPA depends on the accuracy of the data entered by the student or the university on the student's behalf. It is important that the personal data we hold in relation to you is accurate and up to date. You can update your personal data through the 'My Account' section of the Institute's student portal webpage once you have logged into your personal profile. A member of our Education team will update the Institute's records of personal data accordingly.
If you are experiencing issues, please contact us for assistance at studentqueries@charteredaccountants.ie.
RPA third party service providers: data processors
The RPA is delivered in collaboration with our chosen supplier, Future Work Force Limited ("FWF"). FWF provides various services to implement the software/technology for the RPA. The software and technology used for the RPA is developed by UiPath SRL ("UiPath").
FWF and UiPath are the "Processors", responsible for processing your data using RPA on behalf of the Institute.
Where is the personal data hosted?
The RPA hosts personal data in the UiPath Cloud.
Purposes and legal bases for the data processing
Purposes of processing personal data via the RPA
The Institute processes personal data using the RPA for the high-level purposes of:
- Exemption application processing;
- Enhancing timelines for the delivery of the results of exemption applications to applicants;
- Creating efficiencies in the processing of applicants' personal data to meet with the Institute's legislative mandate to run examinations and accountancy training programmes;
- Ensuring ongoing improvements to the RPA through testing of the technology and its outputs; and
- Any other data processing purposes reasonably and necessarily required to fulfil the above processing purposes.
Please see more information in relation to categories of personal data in scope, purposes and legal bases of processing in the below table.
|
What personal data is processed? |
Purpose for processing |
Legal basis for processing |
| 1. |
- Student ID
- Student name
- Email address
- Date of birth (insofar as this information is contained in your university transcripts)
- Training firm (and in some cases the name(s) and contact details of persons in the Training firm)
- Application status
- Application details
- Route of entry
- University
- Speciality
- End date
- Degree classification
- Subject names
- Subject codes
- Grade
|
Creating an CRM profile for each student when they register with the Institute and submit an exemption application;
Training the Robot to recognise the various formats of university transcripts and to:
- read your name and educational details from the transcript (using an imaging / data extraction tool);
- verify your details against your CRM record (as created during your online application upon registration with the Institute);
- apply the Institute’s rules to ensure your exemption application meets the standards required;
- update the Institute's CRM records to log your educational history; and
- log any exceptions and the outcome of the review (i.e. determine your application for an exemption)
and
Determining any appeals of the application decision. An appeal involves a human review to assess whether a correction is necessary. Regardless of the outcome of the appeal review, the outcome is explained to the Applicant.
|
In order to ensure the Institute's legitimate business interests in promoting the efficient administration of your exemption application in a timely and reliable manner, and in appropriately managing your application details and status in an electronic format (including for internal record keeping purposes).
|
| 2. |
- University
- Speciality
- End date
- Degree classification
- Subject names
- Subject codes
- Grade
- Date of birth (insofar as this information is contained in your university transcripts)
|
Processing your university transcript for the purposes of confirming a match with the corresponding inputs by you in the application process:
- The Robot reads the details on the transcript for the purposes of confirming that they match the details inputted by you in your online application form during registration and when you make your exemption application.
Comparing the Institute's exemption rules to your confirmed university transcript details:
- The Robot conducts this comparison for the purposes of applying the Institute's exemption rules to your confirmed university transcript details to determine whether your details meet the Institute’s exemption requirements.
|
In order to ensure the Institute's legitimate business interests in promoting the efficient administration of your exemption application process in a timely and reliable manner, and in appropriately managing your application details and status in an electronic format (including for internal record keeping purposes).
|
| 3. |
- Student ID
- Application status
|
Updating your CRM profile:
- The Robot updates your CRM profile with its review outcome for the purposes of recording the exemption application decision.
|
In order to ensure the Institute's legitimate business interests in promoting the efficient administration of your exemption application process in a timely and reliable manner, and in appropriately managing your application details and status in an electronic format (including for internal record keeping purposes).
|
Note: You have the right to object to the use of your Personal Data for our legitimate business interests (see below "Right to Object where Processing is on the basis of the Institute's Legitimate Interests"). To make an objection, please contact transcripts@charteredaccountants.ie
If you do object, we will have an opportunity to demonstrate that there are compelling legitimate grounds which override your rights and freedoms or that processing is necessary for the establishment, exercise or defence of legal claims.
The Institute has carried out a "Legitimate Interests Assessment" ("LIA") to determine if we can process your Personal Data on the legal basis of our legitimate interests (Article 6(1)(f) of the GDPR). For more information on the LIA we carried out and the balancing test we engaged in,
A Legitimate Interests Assessment requires us to:
- identify our legitimate interests in processing your Personal Data;
- show that the processing is necessary to achieve the legitimate interests; and
- consider carefully the Institute's right to process your Personal Data for the purposes of your CAP 1 and/or CAP 2 exemption application and to use the RPA machine learning technology in the context of your right as a Data Subject to privacy.
The overarching conclusion of our Legitimate Interests Assessment is that, while each Applicant's right to privacy is significant and important, the Institute's responsibility to process CAP 1 and CAP 2 exemption requests efficiently and in a timely manner outweighs an Applicant's privacy right in these particular circumstances.
This analysis has led us to conclude that we have a legitimate interest in processing your Personal Data in order to make determinations about your exemption application for the Examinations. The processing is necessary because there is not another, less intrusive way of managing the exemption application process, while the automation via the RPA machine learning technology will in turn vastly improve the turnaround time of student eligibility applications to facilitate timely access to the enrolment process and allow students to make earlier decisions on their education pathway. The Personal Data we process is the minimal amount necessary to achieve the purpose of making determinations about your exemption application.
Right to object where processing is on the basis of the Institute's legitimate interests
Every applicant has the right to object to their personal data being processed in this manner on the basis of legitimate interests, including to request that their application be processed manually only (in line with previous procedures).
If you wish to object to the processing or to opt out of the use of automation in processing your transcript, and have your application processed on a manual basis only, please email your objection or RPA opt-out request to transcripts@charteredaccountants.ie.
If you do object, we will have an opportunity to demonstrate that there are compelling legitimate grounds which override your rights and freedoms or that processing is necessary for the establishment, exercise or defence of legal claims.
Where you send us an RPA opt-out request and the Institute facilitates the determination of your application manually, the Institute will take steps to ensure any manual decision will not prejudice the outcome of the relevant exemption application or, to the extent possible, the timeline for the exemption decision. Please note however that due to the high number of exemption applications received every year, processing your application manually may take longer than processing your application via the RPA.
In order for your application to be processed, please note the following:
- If your qualification is accredited by the Institute, you must provide us with transcripts of your results for each year of your studies.
- Digitary Core: If your transcripts are available on Digitary Core please ensure you share them with us through this platform. You will find instructions on our website. Where possible please share the single diploma supplement document which will contain all required information.
- UCD Graduates: Please enable verification of your transcripts before sharing the transcript documents with us.
- All other applicants: If your transcripts are not available through the Digitary Core Platform or you did not graduate from UCD please arrange to have your college/university share your result documentation with us directly to transcripts@charteredaccountants.ie. As only official transcripts will be accepted, we cannot accept emailed transcripts from students, they must be emailed directly from the awarding body.
- Non accredited: If you are seeking exemptions on the basis of a non-accredited qualification we require additional support materials. As well as your original transcripts, please share official course outlines and a sample examination paper for each of the modules relevant to our CAP1 Syllabus. The CAP1 Competency Statement will help you determine the relevance of the modules you completed.
Third party information
This APN also applies to personal data relating to third parties that we are required to process to facilitate our relationship with you. An example of third party personal data processed for this purpose are the name(s) and contact details of persons at your training firm. Students should provide a copy of this APN to any third parties whose personal data they provide to us.
Recipients to whom we will disclose your personal data
The following personal data is shared with our third party service providers (including FWF and UiPath):
- Student ID
- Student name
- Email address
- Training firm (and in some cases the name(s) and contact details of persons in the training firm)
- Application status
- Application details
- Route of entry
- University
- Speciality
- End date
- Degree classification
- Subject names
- Subject codes
- Grade
- Date of birth (insofar as this information is contained in your university transcripts)
For more information on why our third party service providers receive your personal data,
Our third party service providers (each of whom act as a processor) receive your personal data because they, amongst other things, provide and implement the software used for the RPA. This processing activity includes the automated extraction of personal data from your university transcript. The Institute has put in place data processing agreements with its processors, which require the processors to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of the GDPR. The Institute will undertake regular assessments, including periodic audits where deemed necessary, to ensure that the processors are meeting all the standards set out in those agreements and data protection requirements generally.
While the processors do engage sub-processors as part of their businesses, the Institute has received confirmation that the personnel of such sub-processors providing services in connection with the RPA do not access students' personal data.
Data retention
We are obliged to retain certain information for the legitimate business purposes outlined above and to the extent necessary to comply with our legal obligations or for the exercise or defence of legal claims.
The retention periods required by law vary depending on the type of data. We minimise the retention period for the storage of your personal data to the minimum possible in order to achieve the purpose(s) for which the data is processed. Our retention periods are reviewed and updated from time to time in line with legal requirements and best practices. For further information on our current retention schedule for the categories of personal data processed in connection with CAP1 and CAP2 exemption applications
Your personal fata will be held by the Institute for no longer than is necessary to carry out the data processing and in exceptional cases to investigate issues that may arise.
We (or our processors on our behalf) will hold the personal data that you submit or contained in your university transcript throughout the period from 1 July 2023 to 6 November 2023 (the enrolment season) plus one month, on our RPA system, in order to determine your exemption application, unless we are obliged to hold it for a longer period under law or applicable regulations. If an appeal is lodged in respect of the exemption application decision within one month of the decision being communicated to you, your personal data (including the copy of your transcript) will be retained for the duration of and pending the conclusion of the appeal process.
In the event that your exemption application is successful and you are admitted as a member to the Institute, we will retain your Personal Data and store it on your CRM profile for the duration of your membership plus a period of seven years after you cease to be a member or interact with us, unless we are obliged to hold it for a longer period under law or applicable regulations.
In certain circumstances, where required by law or applicable regulations, or where we deem it necessary for our legitimate business, regulatory and/or disciplinary purposes, we may hold Personal Data for a longer or shorter period.
International data transfers
We confirm that we do not transfer personal data to third parties other than necessary educational institutions and our processors. For more information on data transfers,
Our RPA service providers, FWF and UiPath, are located in the United Kingdom and Romania respectively. The United Kingdom is deemed to have adequate protection for personal data by virtue of the adequacy decisions adopted by the European Commission in respect of the United Kingdom dated 28 June 2021. The Personal Data processed by UiPath is hosted in the EU in the UiPath Document Centre within the UiPath cloud environment, subject to the protections under GDPR. In the event that we, or our Processors acting on our behalf, wish to transfer personal data to a country outside the European Economic Area ("EEA") or the United Kingdom, we will ensure that appropriate safeguards are in place under Article 46 GDPR, or an EU Commission adequacy decision under Article 45 GDPR exists in respect of the non-EEA country to which the data is being transferred, or that an Article 49 GDPR derogation can be relied on.
As explained at 'Recipients to whom we will disclose your personal data' above, the processors involved in the RPA have signed agreements to ensure compliance with applicable data protection legislation in their processing of personal data, including with respect to international data transfers. In most cases where the Institute or our processors transfer your personal data outside of the EEA, we will rely on the Standard Contractual Clauses ("SCCs") under Article 46(2)(c) GDPR to ensure your personal data is adequately protected. Prior to authorising the execution of the SCCs and the transfer of your personal data outside of the EEA pursuant to the SCCs, we will ensure that a “transfer impact assessment” (“TIA”) has been carried out to determine that an essentially equivalent level of protection will be provided to the transferred personal data as that afforded by EU data protection laws, and where necessary, ensure that additional technical and/or organisational measures are implemented to safeguard the personal data. Annual assessments of processors are completed by the Institute in order to ensure compliance with the contracted standards and general data protection requirements.
Please contact us if you wish to obtain further information concerning the safeguards we have in place (see ‘Contact us’ below).
Data security
We have put in place appropriate physical, organisational and technical security measures to protect your personal data from accidental loss, unauthorised access, use, alteration or disclosure. We have implemented strict internal guidelines to ensure that your privacy is safeguarded at every level of our organisation. We limit access to your personal data to only those employees and processors who have a legitimate business need to access such data. We will continue to revise our policies and implement additional security features as new technologies become available.
Data subject rights
Your rights in relation to your personal data
You have the right to request access to, rectification, or erasure of your personal data, or restriction of processing or object to processing of your personal data, as well as the right to data portability. In each case, these rights are subject to restrictions as laid down by law. The following is a summary of your rights:
- The right of access enables you to receive a copy of your personal data. Students have a right to make a Data Access Request by emailing the Privacy Manager at Privacy@charteredaccountants.ie with details of the request. A form is available to download on the student portal
- The right to rectification enables you to ask us to correct any inaccurate or incomplete personal data we hold about you.
- The right to erasure enables you to ask us to delete your personal data in certain circumstances.
- The right to restrict processing enables you to ask us to halt the processing of your personal data in certain circumstances.
- The right to object enables you to object to us processing your personal data on the basis of our legitimate interests (or those of a third party). Please contact us at transcripts@charteredaccountants.ie if you want to object to any processing carried out on the basis of legitimate interests including to the use of automation in processing your transcript.
- The right to data portability enables you to request us to transmit personal data that you have provided to us, to a third party without hindrance, or to give you a copy of it so that you can transmit it to a third party, where technically feasible.
In any case where the Institute is relying on your consent to process your personal data (which is not currently the case), you have the right to change your mind and withdraw consent at any time. Such withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
These rights can be exercised by writing to the Institute at the address specified below (see 'Contact us').
If you have any issue, grievance or complaint in respect of our handling of your personal data, you have the right to lodge a complaint with the Data Protection Commission, whose contact details are as follows:
| Telephone: |
01 7650100 / 1800437 737 |
| Postal address: |
Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland. |
| Offices: |
Dublin Office, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland.
Portarlington Office, Canal House, Station Road, Portarlington, R32 AP23 Co. Laois. |
| Online web form: |
https://forms.dataprotection.ie/contact |
Changes to this Data Protection & Privacy Notice
We reserve the right to change this Data Protection & Privacy Notice from time to time at our sole discretion. If we make any changes, we will update the “Last updated” date at the bottom of this Data Protection & Privacy Notice. If we make material changes to this APN, we will notify you prior to the change becoming effective. We may also notify you in other ways from time to time about the data processing.
Contact Us
Data subjects can contact the Institute in relation to the use of their personal data for the data processing or to request assistance in enforcing their rights by contacting the Institute Privacy Manager, whose contact details are as follows:
Please provide as much detail as possible when sending requests to us so that we can deal with your query properly and efficiently.
Last updated: 21 July 2023
LOADING...