Members students affiliates privacy statement

Obligations of the Institute as Data Controller

Data Controllers processing personal data must comply with the following Data Protection principles of good practice. These provide that personal data must be:

1. Obtained and processed lawfully and fairly.
2. Collected and kept only for specified, explicit and legitimate purposes and not be used or disclosed in a manner incompatible with those purposes for which it was given initially
3. Protected against unauthorised access, alteration, disclosure or destruction, or unlawful processing.
4. Accurate, complete and where necessary, kept up to date.
5. Adequate, relevant and not excessive in relation to the purpose for which they were collected.
6. Not kept for longer than is necessary.

Types of information the Institute collect

The Institute collect information, which includes:

• Personal data, about its members (including affiliate and reciprocal members)
• Students and prospective students
• Non-member customers
• Members of its council and committees
• Prospective employees, and the directors, officers, employees, agents and/or authorised signatories of other regulatory and oversight bodies
• The Institute's suppliers, service providers, vendors and other commercial entities with which the Institute deals
• Member's firms
• Law enforcement
• Members of the public with whom the Institute interacts

Collectively “data subjects”.

This processing occurs for the purposes of and in connection with the Institute's dealings with those individuals and/or relevant commercial entities.

How the Institute obtains data subjects personal data 

The Institute will obtain some of data subject’s personal data where the Institute interact directly with the data subject in the course of its business. The Institute may also obtain personal data directly from data subjects through the website, including:

1. when making an enquiry about Institute services or professional courses and seminars
2. when data subjects sign up to the Institute mailing list, or
3. when applying for a position with the Institute.

Our cookie notice also sets out details of the targeting or advertising cookies, which will collect and use data subjects’ personal data, which are used by or via the Institute website.

This information may be collected indirectly from a variety of sources including:

• Regulatory and oversight bodies (including where data subjects request that such bodies provide information directly to the Institute)
• The data subject’s employer
• The commercial entity represented
• Publicly available sources including media reports and social media, such as LinkedIn.

Legitimate Interest Assessment

The Institute carries out a Legitimate Interests Assessment ("LIA") to determine if we can process personal data on the legal basis of our legitimate interests (Article 6(1)(f) of the GDPR).

A Legitimate Interests Assessment requires us to:

1. identify our legitimate interests in processing personal data;
2. demonstrate that the processing is necessary to achieve the legitimate interests; and
3. consider carefully the Institute's right to process personal data in the context of the members, students or affiliates right as a Data Subject to privacy.

Where data is processed for the purposes of the Institute’s legitimate interests, the Institute will prepare a Legitimate Interest Assessment (LIA) to ensure that the Institute’s interest does not override the interests or fundamental rights and freedoms of the data subject.

If RPA technology is used to process any data, the Institute will prepare a Data Protection Impact Assessment (DPIA) to identify, assess and mitigate risks to individuals’ privacy when processing personal data. When using RPA technology that involves automated decision making, we will ensure there is a ‘human in the loop’ during this processing activity.

International transfers

Personal data may be transferred outside Ireland in connection with the uses described above and/or as otherwise required or permitted by law.

Many of the countries will be within the European Economic Area (the “EEA”) or the United Kingdom (“UK”) or will be ones which the European Commission has approved and will have data protection laws which are the same as or broadly equivalent to those in the European Union. Personal data can transfer freely to these countries in accordance with the GDPR. However, some transfers may be to countries which do not have equivalent protections, and in that case, the Institute will implement contractual protections for the personal data in the form of EU Commission approved standard contractual clauses or other appropriate safeguards as provided for under the GDPR.

Further information in relation to international data transfers can be obtained by contacting the Institute at the details specified below.

Third party personal data

This statement also applies to personal data relating to third parties that the Institute are required to process to facilitate our relationship with data subjects. An example of third-party personal data processed for this purpose are the name(s) and contact details of individuals at the member’s or student’s training firm.  

Third party providers of information

The Institute may obtain personal data relating to data subjects indirectly, such as where the data subject’s employer provides contact details to us in connection with Institute business. The person providing the information will in the ordinary course be asked to warrant that it will only do so in accordance with applicable data protection laws, and that it will ensure that before doing so, the data subject is made aware of the fact that the Institute will hold information relating about them and that the Institute may use it for any of the purposes set out in this statement, and where necessary that it will obtain consent to the Institute’s use of the information.

In certain circumstances, such as where a complaint is made against a member, the Institute has an obligation to act based on the information which is provided.

Recipients of personal data

In any case where the Institute share personal data with a third-party data controller (including, as appropriate, other regulatory and oversight bodies), the use by that third party of the personal data will be subject to the third party’s own privacy policies.

Updates to personal data

The Institute will use reasonable efforts to keep personal data up to date. However, the data subject will need to notify the Institute without delay in the event of any change in personal or business circumstances, so that personal data is kept up to date.

Retention of personal data

The Institute is obliged to retain certain information to ensure accuracy, to help maintain quality of service, for legal and regulatory purposes, and for legitimate business purposes.

Information will be retained for no longer than is necessary for the purpose for which it was obtained by the Institute, or as required or permitted for legal and regulatory purposes (including disciplinary procedures), and for legitimate business purposes. In general, the Institute (or our service providers on our behalf) will hold this information for a period of seven years after a data subject ceases to interact with the Institute, unless obliged to hold it for a longer period under law or applicable regulations. In certain circumstances, where required by law or applicable regulations or where the Institute deems it necessary for our legitimate business, regulatory and/or disciplinary purposes, the Institute may hold the data for a longer or shorter period.

Exam scripts will only be retained for the period during which an appeal may be lodged plus one month, or if an appeal is lodged, for a month after the end of the appeal process. There is no appeal period for interim assessments therefore the interim assessment scripts are retained for one month after the relevant results are published.

Data security

Appropriate physical, organisational and technical security measures are in place to protect the individual’s personal data from accidental loss, unauthorised access, use, alteration or disclosure. Strict internal guidelines are in place to ensure that privacy is safeguarded at every level in the Institute. We limit access to personal data to only those employees and processors who have a legitimate business need to access such data. We will continue to revise our policies and implement additional security features as new technologies become available.

Data Subject Rights in relation to personal data

Data subjects have the following rights, in certain circumstances, under Articles 12-22 of the GDPR: 

• The right to be informed about what personal data is collected and how it is used.
• The right of access to the personal data controlled by the Institute.
• The right to correct any inaccuracies in the personal data.
• In some instances, subject to the Examinations and Appeals Regulations and in accordance with the need to provide fair examinations to all Institute candidates, there is the right to erasure of personal data (also known as the “Right to be Forgotten”).
• The right to restrict the processing of the personal data.
• The right to object to the processing of your personal data in certain circumstances, this includes the right to opt-out of receiving marketing communications from the Institute.
• The right not to be subject to automated decision making and profiling in certain circumstances. This right does not apply if the processing is based on explicit consent.
• There is the right to data portability of the personal data that data subjects provide to the Institute and where it is processed based on the data subjects consent or for the performance of a contract.

In any case where the Institute are relying on the data subject’s consent to process their personal data, the data subject has the right to change their mind and withdraw consent by writing to the address specified below, without affecting the lawfulness of processing based on consent before its withdrawal.

Where the Institute are relying on a legitimate purpose of the Institute or a third party recipient of the personal data, in order to use and disclose personal data, the data subject is entitled to object to such use or disclosure of their personal data, and if they do object, the Institute will cease to use and process the personal data for that purpose unless the Institute can show there are compelling legitimate reasons to continue or need to use the personal data for the purposes of legal claims.

How to exercise privacy rights under GDPR

A data subject can exercise any of the listed rights above by contacting the Institute’s Privacy Manager at the details listed below.

Data Subjects also have the right to lodge a complaint about the Institute processing of personal data with the relevant supervisory authority in accordance with Article 77 GDPR, details as follows:

Details on how to lodge a complaint are available on our Data Privacy Complaints Procedures page. All questions in relation to this privacy statement can be directed to the Privacy Manager at the details below.

Updates to this statement

The Institute reserves the right in its sole discretion to amend this statement at any time (for example, to comply with changes in laws or regulations, our practices, procedures and organisational structures, requirements imposed or recommended by supervisory authorities or otherwise). Changes to this statement will be communicated by the Institute where legally required to do so.

Contacting the Institute

Any queries or complaints regarding the use of data subjects’ personal data and/or the exercise of individual rights, please contact the Privacy Manager whose contact details are as follows:

Email: privacy@charteredaccountants.ie

Address:
Privacy Manager,
Chartered Accountants Ireland,
Chartered Accountants House,
47-49 Pearse Street,
Dublin 2
D02 YN40