Privacy and Data Protection

Privacy

Privacy Notice

Cookies Policy

Data Protection

Data protection is the safeguarding of the privacy rights of individuals in relation to the processing of personal data, in both paper and electronic format. In Ireland, data protection law, including the General Data Protection Regulation, lays down strict rules regarding the way in which personal data and sensitive personal data are collected, accessed, used and disclosed. Our Privacy Notice sets out the categories of data that we hold, the rights that you have in relation to your personal data and how you can enforce them.

Subject Access Requests

Under Data Protection law, you have the right to be informed by us whether we hold personal data about you, and if so, how it is used and shared. You also have the right to obtain a copy of the personal data relating to you  that we hold (a Subject Access Request). Please note that you cannot make a Subject Access Request for access to another person’s personal data.

In most cases, we will comply with a Subject Access Request free of charge. However, we can impose reasonable fees based on administrative costs where your request is manifestly unfounded or excessive.

Subject Access Requests should be made to The Data Protection Officer, The National Gallery of Ireland, Merrion Square West, Dublin 2 or by clicking here. You may be asked for evidence of your identity.

Your request should be as specific as is possible to enable us to identify where the particular data is held. For instance, it is very helpful if you:

• give us a time period from which you want to see records (for example, “March 2017”)
• give us an idea of the general nature of your query (for example, “in relation to the Vermeer exhibition”)
• let us know the names of staff members or department you were dealing with (for example, “Education” or “Visitor Experience”)
• let us know which Gallery services you availed of.

A response to your access request will issue to you as soon as possible and, in any event within 30 days. If, due to the complexity and number of requests, more time is needed to process it, this period may be extended by a further two months.

Records which contain your personal data may contain other information which does not relate to you. We are not obliged to release that information as part of a Subject Access Request.

There are certain exemptions that restrict the right of access and allow for a refusal of a request. An appeal against a refusal can be made direct to the Data Protection Commissioner.