Leaving Certificate 2020

Dear [data controller],

This is a subject access request under the General Data Protection Regulation for personal data relating solely to the Leaving Certificate 2020. Please note that it is not legal to require data subjects to use an in-house form.{1}

1. Copies of my personal data

I would like to request, under the right of access (GDPR, Article 15):

• a copy sent to me in electronic format of the personal data listed below. This to include any data derived about me, such as opinions, inferences, settings and preferences.{2}
• Please note that any blanket refusal to provide data which appears in records which also contain the personal data of other data subjects is not an appropriate response.{3}{4}

Personal data to which this access request applies

This is the full list of categories of personal data which the document ‘Privacy Notice for Students Calculated Grades for Leaving Certificate 2020 in light of the postponement of the Leaving Certificate examinations’ (available at https://www.education.ie/en/The-Department/Data-Protection/gdpr/parents-children/privacy-notice-students-calculated-grades-leaving-certificate-2020.pdf) identifies as being processed by you.

I am requesting a copy of each of these, for each subject where applicable.

• Examination Number
• Programme i.e. Leaving Certificate Established, Vocational or Applied.
• PPSN
• Department Pupil Identity Number (DPIN)
• Year
• School Roll Number
• School Type
• Surname
• Forename
• Gender
• Date of Birth
• Subject code
• Module Code
• Subject Irish indicator
• Address
• Eircode
• Telephone Number
• Email address
• Subject
• Subject Level
• Class ID
• Estimated Percentage Mark
• Class Rank Order
• Calculated Mark
• Calculated Grade
• Confirmation of conflict of interest and management (where applicable)

2. Information on controllers, processors, source and transfers

The identity of any and all joint controllers of my personal data.

Any third parties to whom data has been disclosed, named with contact details in accordance with Article 15(1)(c). Please note that the European Data Protection Board has stated that controllers should name precise recipients and not “categories” of recipients. If they do choose to name categories, they must justify why this is fair, and be specific, naming “the type of recipient (i.e. by reference to the activities it carries out), the industry, sector and sub-sector and the location of the recipients.”{5}

If any data was not collected, observed or inferred from me directly, please provide precise information about the source of that data, including the name and contact email of the data controller(s) in question (“from which source the personal data originate”, Article 14(2)(f)/15(1)(g)).

3. Information on purposes and legal basis

Please list all processing purposes and the lawful basis for those purposes by category of personal data. This list must be broken down by purpose, lawful basis aligned to purposes, and categories of data concerned aligned to purposes and lawful bases. Separate lists where these three factors do not correspond are not acceptable.{6} A table may be the best way to display this information.

4. Information on automated decision-making

Please confirm whether or not you make any automated decisions (within the meaning of Article 22, GDPR) using any of the categories of personal data listed above. If the answer is yes, please provide meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for me. (Article 15(1)(h))

5. Information on storage

Please confirm for how long each category of personal data is stored, or the criteria used to make this decision, in accordance with the storage limitation principle and Article 15(1)(d).

To help identify me, I have attached the following personal information:

• Name: [your name]
• Email: [your email]
• Additional Information: [a copy of an identity document, examination number, school roll number if known]

In accordance with the law, I look forward to hearing from you within one month of receipt.

Regards,

[your name]

Footnotes

{1} Data Protection Commission, ‘Access and Portability’ (https://dataprotection.ie/en/organisations/know-your-obligations/access-and-portability): “The GDPR does not set out any particular method for making a valid access or portability request, therefore a request may be made by an individual in writing or verbally.”

{2} Note that opinions, inferences and the like are considered personal data. See Case C‑434/16 Peter Nowak v Data Protection Commissioner [2017] ECLI:EU:C:2017:994, 34.

{3} Data Protection Commission, ‘Access and Portability’ (https://dataprotection.ie/en/organisations/know-your-obligations/access-and-portability): “where a controller does have concerns about the impact of complying with a request, their response should not simply be a refusal to provide all information to the individual, but to endeavour to comply with the request insofar as possible whilst ensuring adequate protection for the rights and freedoms of others.”

{4} Data Protection Act 2018, Section 91(7): “Where information that a controller would otherwise be required to provide to a data subject pursuant to subsection (1) includes personal data relating to another individual that would reveal, or would be capable of revealing, the identity of the individual, the controller — … (b) shall provide the data subject with a summary of the personal data concerned that — (i) in so far as is possible, permits the data subject to exercise his or her rights under this Part, and (ii) does not reveal, or is not capable of revealing, the identity of the other individual.”

{5} Article 29 Working Party, ‘Guidelines on Transparency under Regulation 2016/679’ (WP260 rev.01, 11 April 2018), page 37.

{6} Article 29 Working Party, ‘Guidelines on Transparency under Regulation 2016/679’ (WP260 rev.01, 11 April 2018), page 35.

Dear [data controller],

This is a subject access request under the General Data Protection Regulation for personal data relating solely to the Leaving Certificate 2020. Please note that it is not legal to require data subjects to use an in-house form.{1}

1. Copies of my personal data

I would like to request, under the right of access (GDPR, Article 15):

a copy sent to me in electronic format of the personal data listed below. This to include any data derived about me, such as opinions, inferences, settings and preferences.{2}

Please note that any blanket refusal to provide data which appears in records which also contain the personal data of other data subjects is not an appropriate response.{3}{4}


Personal data to which this access request applies

This is the full list of categories of personal data which the document 'Privacy Notice for Students Calculated Grades for Leaving Certificate 2020 in light of the postponement of the Leaving Certificate examinations' (available at https://www.education.ie/en/The-Department/Data-Protection/gdpr/parents-children/privacy-notice-students-calculated-grades-leaving-certificate-2020.pdf) identifies as being processed by you.

I am requesting a copy of each of these, for each subject where applicable.

Examination Number
Programme i.e. Leaving Certificate Established, Vocational or Applied.
PPSN
Department Pupil Identity Number (DPIN)
Year
School Roll Number
School Type
Surname
Forename
Gender
Date of Birth
Subject code
Module Code
Subject Irish indicator
Address
Eircode
Telephone Number
Email address
Subject
Subject Level
Class ID
Estimated Percentage Mark
Class Rank Order
Calculated Mark
Calculated Grade
Confirmation of conflict of interest and management (where applicable)


2. Information on controllers, processors, source and transfers

The identity of any and all joint controllers of my personal data.

Any third parties to whom data has been disclosed, named with contact details in accordance with Article 15(1)(c). Please note that the European Data Protection Board has stated that controllers should name precise recipients and not "categories" of recipients. If they do choose to name categories, they must justify why this is fair, and be specific, naming "the type of recipient (i.e. by reference to the activities it carries out), the industry, sector and sub-sector and the location of the recipients."{5}

If any data was not collected, observed or inferred from me directly, please provide precise information about the source of that data, including the name and contact email of the data controller(s) in question ("from which source the personal data originate", Article 14(2)(f)/15(1)(g)).



3. Information on purposes and legal basis

Please list all processing purposes and the lawful basis for those purposes by category of personal data. This list must be broken down by purpose, lawful basis aligned to purposes, and categories of data concerned aligned to purposes and lawful bases. Separate lists where these three factors do not correspond are not acceptable.{6} A table may be the best way to display this information.



4. Information on automated decision-making

Please confirm whether or not you make any automated decisions (within the meaning of Article 22, GDPR) using any of the categories of personal data listed above. If the answer is yes, please provide meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for me. (Article 15(1)(h))



5. Information on storage

Please confirm for how long each category of personal data is stored, or the criteria used to make this decision, in accordance with the storage limitation principle and Article 15(1)(d).

To help identify me, I have attached the following personal information:

Name: [your name]
Email: [your email]
Additional Information: [a copy of an identity document, examination number, school roll number if known]

In accordance with the law, I look forward to hearing from you within one month of receipt.

Regards,

[your name]

 

Footnotes

{1} Data Protection Commission, ‘Access and Portability’ (https://dataprotection.ie/en/organisations/know-your-obligations/access-and-portability): "The GDPR does not set out any particular method for making a valid access or portability request, therefore a request may be made by an individual in writing or verbally."

{2} Note that opinions, inferences and the like are considered personal data. See Case C‑434/16 Peter Nowak v Data Protection Commissioner [2017] ECLI:EU:C:2017:994, 34.

{3} Data Protection Commission, ‘Access and Portability’ (https://dataprotection.ie/en/organisations/know-your-obligations/access-and-portability): "where a controller does have concerns about the impact of complying with a request, their response should not simply be a refusal to provide all information to the individual, but to endeavour to comply with the request insofar as possible whilst ensuring adequate protection for the rights and freedoms of others."

{4} Data Protection Act 2018, Section 91(7): "Where information that a controller would otherwise be required to provide to a data subject pursuant to subsection (1) includes personal data relating to another individual that would reveal, or would be capable of revealing, the identity of the individual, the controller — ... (b) shall provide the data subject with a summary of the personal data concerned that — (i) in so far as is possible, permits the data subject to exercise his or her rights under this Part, and (ii) does not reveal, or is not capable of revealing, the identity of the other individual."

{5} Article 29 Working Party, ‘Guidelines on Transparency under Regulation 2016/679’ (WP260 rev.01, 11 April 2018), page 37.

{6} Article 29 Working Party, ‘Guidelines on Transparency under Regulation 2016/679’ (WP260 rev.01, 11 April 2018), page 35.