Privacy Statement

The Irish Financial Services Appeals Tribunal (“IFSAT” or “the Tribunal”) was established by the Central Bank and Financial Services Authority of Ireland Act 2003.

IFSAT is an independent tribunal which hears and determines appeals from aggrieved parties against certain decisions of the Central Bank of Ireland (the “Central Bank”).

“Personal Data” means data which identifies a person or could identify a person, such as their name, contact details, images and voice recordings.

The purpose of this Privacy Statement is to explain what is done with Personal Data when IFSAT processes it as a data controller under the General Data Protection Regulation (the “GDPR”). This Privacy Statement provides information about the type of Personal Data the Tribunal collects, what it is used for; what the legal basis is; who it may be shared with and how long it may be retained. It also provides information about the rights of individuals in relation to their Personal Data.

This Privacy Statement covers all Personal Data processed by IFSAT in order to deliver its appointed functions including the Personal Data of:

  • parties to an appeal;
  • witnesses;
  • other parties involved in the hearings and determinations of appeals;
  • contractors providing services to IFSAT;
  • officials at the Department of Finance; and
  • visitors to the IFSAT website.
  • The Personal Data of employees (if any) is dealt with under a separate notice.

Any questions about this Privacy Statement or about the Personal Data held can be addressed to the Tribunal by email at registrar@ifsat.ie, or by calling 01 872 7693.

IFSAT

IFSAT is a quasi-judicial body which was established under the Central Bank and Financial Services Authority of Ireland Act 2003 in order to hear appeals against certain decisions of the Central Bank. Examples of decisions that can be appealed to the IFSAT include:

  • a refusal to grant authorisation or a licence to an entity as a bank, insurer or other type of financial service provider;
  • the revocation of an authorisation or a licence;
  • a decision to oppose an acquiring transaction;
  • a decision to refuse the appointment of an individual to perform a senior function in a regulated firm (i.e., a pre-approval controlled function); and
  • the imposition of administrative sanctions.

The purposes of processing

The Tribunal collects Personal Data for the purpose of hearing appeals and making determinations regarding those appeals. For example, Personal Data is collected in order to communicate with appellants, respondents and witnesses; to enable witnesses to give evidence, and to keep an appellant and respondent updated on the status of the appeal. Personal Data is also collected for the purpose of entering into contracts with suppliers of goods and services needed in order to carry out the Tribunal’s functions and activities.

The types of Personal Data collected.

Personal Data of appellants, of witnesses providing evidence to IFSAT and contracted parties is collected and processed. The following is a non-exhaustive list of the categories of Personal Data collected and processed in relation to those activities:

  • identification data such as name, date of birth, personal description, contact details, images and voice recordings;
  • financial data relating to an appeal;
  • health data – this may typically include Personal Data relating to the health of witnesses and other persons; and
  • some limited Personal Data in relation to criminal convictions and offences may be processed.


IFSAT appeal procedures are primarily paper based but the Tribunal also holds hearings. Save for exceptional circumstances, the hearings are held in public and evidence, including appellants’ and witnesses’ Personal Data will become publicly available if referred to at hearings. The Tribunal publishes its decisions on its website

How Personal Data is collected.

Appellants and witnesses provide much of the information that is processed, either directly (or through a legal representative). For example, an appellant or a witness in an appeal may provide Personal Data when the party:

  • provides information or evidence which may be relevant to the appeal;
  • contacts IFSAT by email, telephone or letter;
  • represents an organisation engaging with, or providing services to IFSAT.


The Tribunal may also receive Personal Data in other ways. For example, other individuals or entities may furnish Personal Data when they provide information or evidence to IFSAT.

In many cases, information is provided on a voluntary basis. However, IFSAT may also require the provision of information, including Personal Data, pursuant to its statutory powers under the Irish Financial Services Appeals Tribunal Rules 2008 for the purposes of discharging its statutory functions.

The Legal Basis for Processing

Under the GDPR, IFSAT is required to have a legal basis for processing Personal Data. For Personal Data which does not fall within the definition of special category Personal Data or Personal Data relating to criminal convictions or offences, it will rely on the legal basis described below for processing. When processing Personal Data, the Tribunal will, at all times, consider whether the processing of such Personal Data is necessary for IFSAT’s proceedings and functions.

For the most part, Personal Data is processed on the basis that the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in IFSAT.

For providers of services to IFSAT, the primary legal basis for processing of Personal Data will be that it is necessary for the performance of a contract.

Special Categories of Personal Data

Special category Personal Data includes Personal Data revealing racial or ethnic origin, political opinion, religious or philosophical beliefs, and trade union membership, as well as Personal Data concerning health, or Personal Data concerning a person’s sex life or sexual orientation.

For the most part, when special category Personal Data is processed it is likely to relate to health data. The legal basis for this processing is:

  • where this is necessary for the establishment, exercise or defence of legal claims;
  • for the administration of justice;
  • for the purpose of performance of the function conferred on IFSAT;
  • for reasons of substantial public interest; or
  • on the basis of EU or Member State law.

Personal data relating to criminal conviction and offences

IFSAT carries out the processing of Personal Data relating to criminal convictions and offences under the control of official authority.

Sharing Personal Data.

For the purpose of undertaking its statutory duties, IFSAT may share Personal Data with the following main groups:

  • parties and witnesses in an appeal;
  • recognised legal representatives of individuals and corporate bodies that are appellants or respondents to an appeal;
  • expert witnesses and assessors;
  • third party data processors (such as providers of IT infrastructure or services); and
  • the public proceedings or via its published reports.


IFSAT may also share Personal Data where it is under a legal obligation to do so, or where it is necessary to assist with a criminal investigation.

The safe-keeping of Personal Data.

IFSAT has implemented appropriate physical, technical and organisational safeguards to protect the security of Personal Data and ensure that it is not at risk from unauthorised access.

It does not transfer Personal Data outside the EEA.

The Retention Period of Personal Data.

Personal Data contained in tribunal records shall be retained for the purposes of the proceedings including any appeal and enforcement action and for archiving purposes following the determination of the proceedings to which the Personal Data relate.

IFSAT will retain contracts entered into with persons that supply goods and/or services to the IFSAT for a period of 7 years from the date of the termination of the contract.

Rights

Individuals have a number of rights in relation to the use by IFSAT of Personal Data. These rights are listed below, although certain exemptions or restrictions may apply. In particular the Tribunal cannot give a person access to a copy of his or her Personal Data if this would adversely affect the rights and freedoms of others.

Subject thereto individuals have the rights following:

  • To request information about how Personal Data is processed, and to request a copy of that Personal Data.
  • To request that any inaccuracies in Personal Data are rectified without delay.
  • To request that any incomplete Personal Data is completed, including by means of a supplementary statement.
  • To request that your Personal Data is erased if there is no longer a justification for it to be processed.
  • The right in certain circumstances (for example, where accuracy is contested) to request that the processing of the Personal Data is restricted.
  • Where IFSAT is relying on consent, the right to withdraw consent to the processing of his or her Personal Data at any time.
  • If not relying on consent, the possible right to object to the processing of the relevant Personal Data. Any objections will be considered in the context of IFSAT’s statutory duties and the necessity of processing Personal Data for that purpose.
  • The right to request a copy of any Personal Data the individual has provided, and for this to be provided in a structured, commonly used and machine-readable format.

Complaints.

If a person considers that his or her Personal Data has been misused or mishandled, a complaint may be made to the Data Protection Commission, or the relevant supervisory authority in another EU Member State.

The Data Protection Commissioners contact details are: