Door Access Control System

Identity and contact details of the data controller

Central Statistics Office, Skehard Road, Mahon, Cork T12 X00E

Contact details of the Data Protection Officer

DPO@cso.ie  

Purpose(s) of the processing and the lawful basis for the processing

For the security and personal safety of people on the premises under the Safety, Health and Welfare at Work Act 2005 as outlined in the Article 6 of the GDPR and to monitor on-site attendance in compliance with relevant office requirement on hybrid working arrangements

Where processing is based on the legitimate interests of the controller or a third party, the legitimate interests of the controller

Personal data on the access control system is used by Facilities Management for the following purposes:

• To control the access of authorised and unauthorised personnel or visitors in the CSO buildings and restricted areas within the buildings.
• For the personal safety of people on the premises under the Safety, Health and Welfare at Work Act 2005

Any other recipient(s) of the personal data

A limited number of staff in CSO’s HR Operations section can log into the access control system in order to produce staff id cards.

A limited number of HR staff, on a strictly “need to know” basis are provided with access to daily reports that list the people who attend the three CSO Offices.  

This data is used by HR for the following purposes:

• For COVID-19 Return to Work Safely compliance checking in relation to the Return to Workplace forms, Contact Tracing Logs and COVID-19 Induction compliance. This data is not retained by HR. In addition, if required to assist with contact tracing, these HR staff may request an individual’s time of entering and leaving the CSO building on a particular day. This data is not retained by HR.
• The daily reports are also used by a limited number of HR staff to monitor on-site attendance in compliance with relevant office requirement on hybrid working arrangements.

Details of any intended transfers to a third country (non-EU member state) or international organisation and details of adequacy decisions and safeguards

Not Applicable

The data collected and retention period or the criteria used to determine the retention period

Data collected by FM:

First Name
Surname
Doors Accessed
Time and date of entries and exits of monitored doors
Retention: The system logs are kept for one month

Data collected by HR for Staff ID Cards

First Name
Surname
Photograph
Staff id number
Retention: When a staff member leaves CSO, HR contacts Facilities Management to remove the staff member’s ID from the access control system.

Data collected by HR:

First Name
Surname
Date of Entry
Retention: The daily report that is provided to HR is made available for two months in a private document in Lotus Notes and then deleted. This data is not retained by HR.
Time of Entry and Exit to CSO Building
Provided to HR on an individual case by case basis only when required to assist with contact tracing. This data is not retained by HR.
Backups: The access control system is backed up on a nightly basis as part of the CSO Backup schedule as outlined in Office Notice 16/2019: CSO Data Management Policy, Section 7.5.1.

Data subject rights

The data subject can avail of their rights in relation to access and rectification. Data subject requests may be emailed to DPO@cso.ie.

The data subjects will not have the right to object to the processing of their data, while you have access to CSO premises and/or restricted areas, as the processing is required for the CSO to fulfil its legal obligation under the Health, Safety and Welfare at Work Act 2005

The data subjects will not have the right to erasure of their personal data as the data is being processed under a legal obligation pursuant to the Safety, Health and Welfare at Work Act 2005 so the derogation in Article 17(3)(b) applies.

Consent

N/A

The right to lodge a complaint with the Data Protection Commission

You can contact the Data Protection Commission at:
Telephone: (+353) 01 7650100 / 1800 437 737
E-mail: info@dataprotection.ie

Postal Address:
Data Protection Commission, 21 Fitzwilliam Square South
Dublin 2
D02 RD28
Ireland

Whether the provision of personal data is a statutory or contractual requirement, necessary to enter into a contract, an obligation, and the possible consequences of failing to provide the personal data

The provision of personal data is required as a condition of access to CSO buildings and restricted areas.

The existence of any automated decision making processes that will be applied to the data, including profiling, and meaningful information about how decisions are made, the significance and the consequences of processing

No data will be used for automated decision making or profiling.