GDPR stands for General Data Protection Regulation. It is a European Union legislation and is in place since 25 May 2018.

GDPR matters as it sets out the ways in which the privacy rights of every European Union citizen must be protected and the ways in which a person’s personal data (information) can and cannot be used. The Adoption Authority must follow the GDPR requirements around the personal information that we can and cannot share.

Personal information is any information that can be used to identify a living person. Examples of personal information are:

• A name
• Date of birth
• Address
• Phone number
• Email address
• Personal Public Service (PPS) number
• Photos
• Internet Protocol address

These are all protected by law.

Not necessarily. Data protection requests are part of a very rigid process and must follow a particular format. This means the information you can get from a formal subject access request (SAR or data protection request) can be quite limited in what you are entitled to receive by law.You may be disappointed or surprised because you might not get information you already have through another source. Sometimes a simple informal request can help you more.

Unfortunately, the answer to this is no. The laws governing the Data Protection Act refer to a “Living Individual” only, so information about a deceased person is not covered.

GDPR will only make your personal data available to you. This means information about a person other than you:

• Is not available to you under GDPR, and
• Will not be given to you under GDPR.

By law, you have to give us proof of your identity to protect people’s personal information. We cannot provide information to any individual until they provide proof that they are who they say they are. If we did not ask for proof of your identity, then any member of the public could pretend to be you and could be given your personal information.

We accept most photographic and legal documents as proof of identity. Before we can give you the personal information we might have, we need a copy of one of the following of your personal items:

• Current Irish driving licence
• National Age Card
• Passport
• Public Service Card

Important: The copy of the identification you use should be verified (stamped). This means that before you send us a copy of your identification, you need to get the copy stamped by:

• your local Garda or police station (free), or
• a solicitor or commissioner for oaths if preferred. (There may be a fee in these instances.)

When we get this verified copy of your identity, we can start to work on your specific request for data. We can’t start working on a request without having formally confirmed your identity.

I don’t have any of the above identification

Do not worry if you do not have any of the items above. You can call to your local Garda station with a recent photograph and they will help you complete a form called ML10. We can accept this form as proof of identity when you send it to us.

A birth certificate contains the personal data of people other than you. If provided to you, it would identify another person or people without their prior consent.

Sometimes we have to redact parts of documents. Redact means black them out like this . We do this as these blackened parts are private or cannot be legally shared due to reasons like confidentiality concerns. If a document refers to someone other than you, any information which would identify them, we must legally protect.

Similarly, if another person asked us for documents that mentioned you we would black out (redact) the references to you to protect your personal information.

‘Third parties’ is a term that you might hear when we reply to your request for information. It is important that you know what it means. ‘Third party’ is a term used to refer to individuals other than you personally. We work hard to get you the documents you are legally entitled to. Sometimes, we are not legally allowed to release documents that contains ‘third party information’ to you.

For example, on an adoption file there can often be the marriage certificate of the adoptive parents, or references from doctors, employers or Gardaí on behalf of the adoptive parents. These documents do not have your personal information. They have third-party information, so we cannot share them with you. Third party information is protected by law and we would be breaking the law if we shared such information with you.

By law, once we have stamped (verified) ID for you – we have 30 days to get the information to you. But, if your information is complex, we may extend the timeline for a two further months. We will write to you if this longer time period applies to you so you will know to expect it.

For adoption-related personal information Unfortunately, you cannot get personal information under the Freedom of Information (FOI) Act from the Authority if it relates to the making of an adoption order.

[The Adoption Authority is referred to in the Freedom of Information Act. The Act lists the Authority as a “Partially Included Agency” and this means that adoption-related files are exempt – not covered – as part of FOI requests.]

For other information People can get other information we may hold about them on other types of records under FOI. For example, a person who attended an interview for a job with us may request under FOI feedback on their performance.

Yes, in some situations you can correct information about you that is incorrect. [We can do this, it is called “a right to rectification” under GDPR.] We can advise you as to how to do this if you tell us what has been recorded incorrectly

Correcting some information (like factual information) may mean that documents have to be amended by the organization who gave us the information in the first instance. This may take some time as there are legal procedures to follow. However, we can correct simple mistakes such as misspellings or a typing error.

How to get us to correct incorrect information

To get the correction made, please write to us in with the correction you want. The correction might be to:

• Update an address
• Telephone number
• Correct the spelling of your name

What happens when we can’t correct information?

Sometimes we are not able to make corrections. For example, if the spelling mistake or the date of birth is on an official document which we hold, we may not be able to make the correction for you. If this is the case, we will tell you this and tell you how you can get the official document corrected if necessary.

It depends. While there is a right under GDPR called “the right to be forgotten”, it is not an absolute right as there are some records which cannot be erased because they must be kept by law (that is under The Adoption Act 2010). For example, the record of an adoption order is a legal record and must be kept for that reason.

The Adoption Authority has to keep much of the data we have about you as it is part of a legal process. We will review the data we hold when we receive a request to erase information. We will do this to see if any of the data we hold about you may be erased. One of our staff will write you after this to tell you this has been done or why other data cannot be erased.