Residential Tenancies Board Information

The RTB is a statutory body responsible for (but not limited to) the operation of a national registration system for all residential tenancies, the operation of a dispute resolution service, the provision of both information and policy advice, and completion of research regarding the private rented sector.

You can find more information on our statutory mandate under Section 151 of the Residential Tenancies Act 2004 (RTA) which can be located on the following website: http://www.irishstatutebook.ie

The RTB is the data controller of personal data we collect, or which is collected on our behalf about you relating to our statutory functions referred to above. If you wish to locate further information on us, this can be done through our website, which can be accessed using the following link: Home Page

Legislation

All personal data processed by the RTB is processed in accordance with applicable Irish data protection and privacy laws, the General Data Protection Regulation (‘GDPR’) and the Law Enforcement Directive (‘LED’) (where applicable) to ensure we properly protect your personal data.

The GDPR

The GDPR came into force on 25 May 2018, strengthening the rights of individuals and increasing the obligations of controllers and processors. The GDPR is designed to give individuals more control over their personal data. The key principles relating to the processing of personal data under the GDPR are lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability (Article 5 of the GDPR). In Ireland, the national law, which amongst other things, gives further effect to the GDPR, is the Data Protection Act 2018.

The Law Enforcement Directive

The Law Enforcement Directive (‘LED’) deals with the processing of personal data for ‘law enforcement purposes’ by data controllers which fall within the definition of being a ‘competent authority’ for the purposes of the LED, as transposed into Irish law, mainly by Part 5 of the Data Protection Act 2018. Section 70 of the Data Protection Act 2018 defines the scope of processing of personal data which falls within that part of the Act and which falls outside the scope of the GDPR. It states that Part 5 of the Act applies to the processing of personal data carried out

“for the purposes of (i) the prevention, investigation, detection or prosecution of criminal offences, including the safeguarding against, and the prevention of threats to public security, or (ii) the execution of criminal penalties…”

The term ‘competent authority’ is defined in Section 69 of the Data Protection Act 2018 as being, inter alia, “A public authority competent for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties in the State, including the safeguarding against, and the prevention of, threats to public security”.

For certain processing activities which it carries out, the RTB is a ‘competent authority’ for the purposes of Part 5 of the Data Protection Act 2018 and therefore these processes are subject to the LED.

Queries and Complaints

If you have a query, concern or complaint regarding a data protection matter or if you simply require further information about the way your personal data will be used by the RTB, you can engage with the Data Protection Officer:

Data Protection Officer Residential Tenancies Board PO Box 12323 Dublin 2 Telephone: 01 702 8100 LoCall Number: 0818 303 037 Email: data.protection@rtb.ie You have the right to lodge a complaint with the Data Protection Commission, you can engage with the Data Protection Commission in the following ways:

• By webform on www.dataprotection.ie
• By telephone on

+353 578 684 800 +353 761 104 800

• By post: Data Protection Commission, Canal House, Station Road, Portarlington, County Laois

Breaches

We will take all appropriate technical and organisational steps to safeguard your personal data. In the unlikely event of a data breach, we will contact you in line with our legal obligations.

How do we collect information?

We collect personal data to provide our services to you. This personal data may be collected directly through RTB staff, the RTB website, any applications used by us, or indirectly through a third-party service provider on our behalf. The following non-exhaustive methods of data collection are an indication of ways in which we may obtain your information:

• Obtain personal data directly from you, your legal representatives or any other representative on your behalf.
• Obtain personal data from you when you log-in using your PPSN for verification with the Department of Social Protection.
• Obtain information from third parties which may include anyone relevant to legal proceedings such as neighbours, agents, landlords, tenants, witnesses, legal firms, legal representatives, letting management companies, or through third-party service providers such as recruitment consultant agencies, customer service providers, public relations agencies, software service providers.
• Publicly available information obtained through online searches including rental and property websites, media outlets such as newspapers or news websites, and state and/or industry registers.
• Through data sharing [as provided for under the RTA, 2004 (as amended) between Government departments, agencies, bodies, investigatory bodies, local authorities, housing bodies, or the Gardaí.
• Through queries from various stakeholders of the RTB which include members of the Oireachtas, the general public, or the media.
• When entering our premises, you may be recorded on CCTV surveillance and the Visitor log (sign in/out) book for security purposes.
• The RTB website uses certain cookies. Our Website & Cookie Policy can be accessed here.

It is important that the information you provide to the RTB is up to date and accurate. As outlined in Section 7.2 of this statement, if the personal data we hold on you is inaccurate or incomplete, please contact us and we will endeavour to update the data as required.

Please be aware that it is our aim to collect only personal data which is required to perform a task in relation to you. In this regard, please do not provide us with information that is ancillary to these requirements.

What do we use information for?

Processing and lawful basis

We use personal data collected to fulfil our mandate under the RTA, 2004 (as amended). However, we may use personal data we gather for any of the following purposes:

LED processes and lawful basis

The LED deals with the processing of personal data for ‘law enforcement purposes’ by data controllers which fall within the definition of being a ‘competent authority’ for the purposes of the LED, as transposed into Irish law, mainly by Part 5 of the Data Protection Act 2018.

For certain processing activities which it carries out, the RTB is a ‘competent authority’ for the purposes of Part 5 of the Data Protection Act 2018 and therefore these processes are subject to the LED.

The legal basis for the RTB to process personal data as a ‘competent authority’ is Section 71(2) of the Data Protection act 2018 which provides that the processing of personal data (for the purposes of the LED) shall be lawful where, and to the extent that:

• The processing is necessary for the performance of a function of a controller for a purpose specified in section 70(1)(a) and the function has a legal basis in the law of the European Union or the law of the State….”
• We use personal data to fulfil our mandate under the RTA, 2004 (as amended). The LED may be applicable to the following processes, where the RTB is processing the personal data for the purposes of the prevention, investigation, detection or prosecution of criminal offences:

Special Categories of Data

Where special category data is processed by us for any of the purposes specified above, we will only use the information in the performance of the following functions:

• As part of legal, investigation & sanctions or dispute resolution proceedings.
• As part of industry research (data is anonymised).
• To respond to any queries, complaints, or requests received.

Processing of Special Categories for Data

Where we process special categories of personal data, we will only do so for compliance with a legal obligation to which we are subject or where it is necessary for the performance of a task carried out for law enforcement purposes by a competent authority.

Call recordings

We may record or monitor telephone calls to quality check and improve our processes and services and to improve client satisfaction.

RTB webchat – virtual agent

The RTB Virtual Agent delivers information to customers through accessible and efficient engagement sourced from information contained on the RTB website. RTB’s Virtual Agent is a conversational AI automation.

It is designed to engage in conversation and provide human-like responses to questions or requests. The AI used in this web-chat service is utilising machine learning. Matters that cannot be handled by RTB’s Virtual Agent will be transferred to a live agent.The RTB live agent may to seek personal data applicable to a customer’s query to enable the live agent to access the relevant information held by the RTB and provide our customers with a real time response to the issue(s) raised to support customers to fulfil their legal obligations. Customers are informed when they move from the chatbot through to interact with a human.

RTB’s Virtual Agent utilises AI machine learning but on the anonymised data, with an anonymisation process that occurs within 24 hours, removing any personal data that the customer may have imparted during the chat process. The system uses the data from customer queries to continuously learn and improve on responses, however it is critical to note that RTB’s Virtual Agent does not learn from personal data.

All data is anonymised every 24 hours and it is the anonymised data that is retained and used to inform learnings to ensure the RTB understands the needs of our customers and continuously improves our customer service offerings.

Not Providing Information

If you do not provide us with all the information we require, the resulting action may be that we are not able to fully offer you our services. Furthermore, some services provided by the RTB require certain categories of information, without which, we may not be able to provide you with our service. For example, when registering a tenancy, we will require specific property details and occupancy details.

Who do we share information with?

We may share personal data with other parties in the course of our duties. When this is done, we adhere to the following principles:

• The transfer is based on a legal obligation or the performance of a contract.
• Where data is transferred to another party, we ensure appropriate technical and organisational safeguards are in place to protect your personal data.
• Where we engage a third party to provide a service to us, we require them to take appropriate steps to protect your personal data, and only to use the personal data for the purpose of performing those specific services.

While the parties we engage may change occasionally, we believe it is important you are aware of the types of parties we share data with. The categories and types of third parties outlined below is a non-exhaustive list but provides an indication of the parties we share data with. The RTB, as a data controller, will not sell your personal data to any third party.

Your Representatives

These may include any party you have provided permission for us to contact (such as next of kin or spouse), representatives associated with your tenancy (such as legal representatives or agents involved in your dispute) or other third parties associated with you (such as letting management companies).

Our Representatives

These may include RTB representatives such as employees, agents, contractors, legal representatives, Board, Adjudicators, Mediators, Tribunal Members and Decision-makers. Our representatives may also include companies who provide services in relation to recruitment, customer service, postage, data storage and archiving, IT and IT security, making and receiving payments, finances, data analysis, advertising, query and complaints management, and call quality assurance.

Other Third Parties

Third parties for the purposes of carrying out our function, i.e. case parties, insurance, internal and external audits, carrying out industry research, third parties who may improve our processes and services (such as consultants).

Government Departments, Bodies or Agencies

The RTB is legally obligated to share personal data with state actors as outlined under the RTA, 2004 (as amended) and the Data Sharing and Governance Act (2019). Recipients of this data include Government departments (i.e. Department of Employment Affairs and Social Protection, agencies (i.e. Revenue Commissioners), bodies, investigatory bodies, local authorities, the Gardaí and members of parliament (upon request and on a case by case basis).

Sharing Between Our Departments

To perform our duties, we may need to share information among our internal departments. The following is a non-exhaustive list of circumstances in which information sharing across internal RTB departments may be required:

• Corporate Services may share information with any relevant RTB department upon receipt of queries, complaints, or requests.
• Customer Services may share information with any relevant RTB department upon receipt of queries, complaints, or requests.
• Finance may exchange financial details while making or receiving payments.
• Investigations & Sanctions, Registrations Enforcement, Determination Enforcement, and Disputes & Tribunals may exchange information for dispute resolution services and legal proceedings.
• Registrations, Disputes & Tribunals, Communications & Research may exchange information with Investigations & Sanctions, Registrations Enforcement to investigate suspected breaches in landlord obligations.
• Registrations may share data on a case by case basis to verify tenancy registrations and for dispute resolution services, investigations under part 7A of the Residential Tenancies Act and legal proceedings.
• Information may be shared with Communications & Research to develop the Rent Index, the Public Register, and sector research, reports, and publications.
• Various departments may share information to verify the accuracy of information held.
• Various departments may share information to verify the addresses for the purposes of correspondence.

International Transfers

We may transfer your personal data (including special categories of personal data) outside of Ireland and the European Economic Area (EEA) to other companies set out in this Section 4, IT providers and other suppliers.

The EEA comprises those countries that are in the European Union (EU) and some other countries that are considered to have adequate laws to ensure personal data is protected. When transferring your personal data outside of Ireland or the EEA, we will (and will ensure that service providers acting on our behalf agree to) protect it from improper use or disclosure and ensure the same levels of protection are in place as are applied within Ireland and the EEA.

What type of information is collected?

To fulfil our statutory obligations and perform duties as outlined in this Privacy Statement, we will collect and process various types of personal data. While the type of personal data may change occasionally, we believe it is important you are aware of the types of personal data we gather and use.

Individual agents (persons) registering on behalf of landlords are required to provide their Personal Public Service Number (PPSN) and date of birth (DOB) to create a unique verified contact role with the Residential Tenancies Board (RTB).

The RTB collects this information to verify the identity of individual agents (persons) who are registering tenancies on behalf of landlords. The RTB verifies the identity of the individual by matching these details with records from the Department of Social Protection, using an automated process.

The RTB does not share the personal details of individual agents with other agencies. The following table is a non-exhaustive list and provides an indication of the categories and types of personal data we use to perform our duties. Please note that information listed under one category may be used for the performance of a task or in relation to activities under another heading or as outlined under another heading or as outlined under section 3.

How long do we retain information?

We will keep your personal data for as long as it is necessary to fulfil the purposes for which it was collected as described above and in accordance with our legal and regulatory obligations. This may mean that some information is held for longer than other information. The criteria we use to determine data retention periods for personal data includes the following:

• Retention in case of queries; we will retain it for a reasonable period after the relationship between us has ceased;
• Retention in case of claims; we will retain it for the period in which it may be enforced (this means we will retain it for 10 years in some instances); and
• Retention in accordance with legal and regulatory requirements; we will consider whether we need to retain it after the period described above because of a legal or regulatory requirement.
• Retention in accordance with our legal obligation under National Archives Act for historical/archival purposes.

What are your rights?

As a data subject, you will have the following rights, as outlined in this section. However, restrictions may apply in certain situations, i.e. documentary evidence submissions. Please note that certain data subject rights do not apply under the LED (including the right to object and the right to data portability).

There are also further exemptions and restrictions that can be applied to data subjects’ rights. These include avoiding obstruction to official or legal inquiries, investigations or procedures, or avoiding prejudice to the prevention, detection, investigation or prosecution of criminal offences. Requests are dealt with on a case-by-case basis.

Right of Access (GDPR Article 15 and section 91 Data Protection Act for LED)

You have the right to:

• receive confirmation from us that your personal data is being processed;
• access to your personal data; and
• certain other details in relation to how we use your personal data (which is generally included in this Privacy Statement anyway).

You can request copies of paper and electronic records (including recorded calls, where applicable) about you that we hold, share or use. To deal with your request, we can ask for proof of your identity and enough personal data about you to enable us to locate the personal data you have requested. When requesting this information, we would be grateful if you could please complete a Subject Access Request Form which can be found here.

When submitting your request, please provide us with information to help us verify your identity, such as a photocopy of your passport and utility bill and as much detail as possible to help us identify the information you wish to access (i.e. date range, subject of the request). Please note that an access request is free of charge, however, where we determine a request to be unjustified or excessive, we may charge you a reasonable fee.

Right to Rectification (GDPR Article 16 and section 92 Data Protection Act for LED)

You have a right to request that the personal data held in relation to you is up to date and accurate. Where information is inaccurate or incomplete, you may contact us to request for the information to be rectified. Upon receipt of request, we will endeavour to ensure that the personal data is rectified and as up to date as is reasonably possible.

Please note, in some circumstances requests may not be granted and if this occurs, we will let you know. As the RTB is both a regulatory and quasi-judicial body, the right to rectification of documentary evidence submissions does not apply.

Right to be Forgotten (GDPR Article 17 and section 92 Data Protection Act for LED)

You have the right to seek the erasure of personal data relating to you in the following circumstances:

• The personal data is no longer required for the purposes for which is was obtained.
• Where data is being processed on the basis of consent and you withdraw such consent to the processing and no other lawful basis exists.
• The personal data is being unlawfully processed.
• You object to the processing of personal data and there are no overriding legitimate grounds for the processing.
• Your personal data requires deletion in line with legal requirements.

However, we will be unable to fulfil an erasure request if the processing of personal data is necessary for the following:

• Exercising the right of freedom of expression and information.
• Compliance with a legal obligation or for the performance of a task carried out in public interest.
• Reasons of public interest in the area of public health.
• Archiving or statistical purposes in the public interest.
• The establishment, exercise or defence of legal claims.

Please note that the primary legal basis for our processing of personal data is on the basis of a legal obligation, as outlined under the RTA, 2004 (as amended), while additional processing activities are primarily carried out for dispute resolution, investigation under part 7A of the RTA or legal proceedings . In this regard, some processing in relation to your data may not be subject to the right to erasure.

To determine the validity of your request for erasure in line with the associated RTB processing activity, we will carry out an assessment of the justification for retaining your personal data where a legal requirement applies and contact you if we are unable to fulfil your request.

Please be aware that in certain circumstances we may need to retain some information to ensure your preferences are respected in the completion of our duties.

Right to Restriction (GDPR Article 18)

You have the right to restrict the extent of personal data processed by us in circumstances where:

• You believe the personal data is not accurate, in which case we have to restrict any processing while we verify the accuracy of your personal data.
• The processing of the personal data is unlawful, but you wish to restrict the processing of data rather than erase it.
• Where the personal data is no longer required by the RTB, but you require the retention of the data for the establishment, exercise, or defence of a legal claim.
• You have a pending objection to the processing of your personal data.

When processing is restricted, your personal data will only be processed:

• with your consent;
• for the establishment, exercise or defence of legal claims;
• for the protection of the rights of other people; or
• for reasons important to public interest.

We will contact you to confirm where the request for restriction is fulfilled and will only lift the restriction after we have informed you that we are doing so. Please note, in some circumstances requests may not be granted, i.e. processing of personal data for enforcement proceedings cannot be restricted as it is necessary for compliance with the RTA 2004 (as amended).

Right to Data Portability (GDPR Article 20)

The right to data portability only applies:

• to personal data you’ve provided to us (i.e. not any other information),
• where we are processing your personal data because you have provided your consent for us to do so, or under a contract with you; and
• when processing is carried out by automated means.

Please be aware that our primary legal basis for the processing of personal data is on the basis of a legal obligation, as outlined under the RTA, 2004 (as amended). As such, we carry out minimal processing of personal data on the basis of a contract or on the provision of consent by the data subject and do not currently carry out any fully automated processing of personal data.

The right to data portability will most likely apply in very limited circumstances.

Right to Object (GDPR Article 21)

You have the right to object at any time to the processing of your personal data concerning you which is undertaken on the basis of public interest or legitimate interest by us. Please be aware that the primary legal basis for our processing of personal data is on the basis of a legal obligation as outlined under the RTA, 2004 (as amended).

We have minimal reliance on Public Interest and no reliance on Legitimate Interest as a lawful basis for the processing of your data. The right to object will most likely apply in very limited circumstances. If you wish to object to the processing of data, please contact us with your request. We will then stop the processing of personal data unless it is required for legal proceedings.

Please note that if you request that the RTB stop processing your personal data, we may be unable to provide you with our services.

Right not to be subject to Automated Decision Making, including Profiling (Article 22)

You have a right not to be subject to a decision based solely on automated processing or profiling, where such decisions would have a legal effect or significant impact on you. Please be aware that we do not currently carry out any fully automated decision making or profiling using personal data.

Where do I send requests?

Please send all your requests to the contact details provided in Section 1, with as much detail as possible about your requirements to allow us to deal with your request efficiently. To answer your request, we may ask you to provide identification for verification purposes.

How long will a request take to complete?

Upon receipt of a request, we will comply with the request within the statutory timeframe provided for in the GDPR or the LED as applicable. If we require more time to deal with your request, we will notify you of the delay, and the factors resulting in the delay.

If we refuse your request, we will notify you within the relevant statutory timeframe accompanied by the reason for refusal. We will not charge a fee for any requests, provided we do not consider them to be unjustified or excessive. If we do consider these to be unjustified or excessive, we may charge a reasonable fee (also applicable for multiple copies) or refuse the request.

You are entitled to contact the Data Protection Commission if you have any complaints in relation to the enforcement of your rights.