Privacy Notice

(Transparency Notice)

We are the Aquaculture Licences Appeals Board (ALAB).

ALAB’s contact details are: Aquaculture Licences Appeals Board, Kilminchy Court, Dublin Road, Portlaoise, Co Laois, R32 DTW5; telephone: +353 57 863 1912 or info@alab.ie.

ALAB is the statutory body established to provide an independent authority for the determination of appeals against decisions of the Minister for Agriculture, Food, and the Marine on aquaculture licence applications. A person aggrieved by a decision of the Minister on an aquaculture licence application, or by the revocation or amendment of an aquaculture licence, may make an appeal to ALAB.

ALAB has appointed a Data Protection Officer (DPO) to oversee our compliance with data protection rules. ALAB’s DPO can be contacted at:

Data Protection Officer
Aquaculture Licences Appeals Board
Kilminchy Court, Portlaoise
Co Laois
R32 DTW5

Tel: +353 57 868 1912 or info@alab.ie.

What is the purpose of this Privacy Notice?

ALAB collects and uses personal data (i.e., personal information) about customers and other individuals it engages with in the course of discharging its statutory functions (hereinafter referred to as “data subjects”), for a variety of purposes.

In circumstances where ALAB is responsible for deciding how ALAB holds and uses personal data about data subjects, ALAB is a “data controller”.

This Privacy Notice outlines what personal data ALAB collects and uses about data subjects in connection with the services and functions of ALAB, where ALAB obtains the personal data from, what ALAB does with that personal data, how ALAB complies with data protection legislation, who receives personal data from ALAB, and how ALAB deals with data subjects’ rights in relation to their personal data.

This Privacy Notice outlines how ALAB collects and uses personal data relating to three categories of data subjects: (i) data subjects who submit appeals to ALAB, (ii) data subjects with whom ALAB engages in the course of performing its statutory functions, and (iii) other external data subjects. For clarity, ALAB interacts with the following external entities:

• External technical advisors (appointed through ALAB’s tendering process)
• Department of Agriculture, Food and the Marine
• Prescribed bodies under the Fisheries (Amendment) Act 1997, such as:
  • National Parks and Wildlife Service (NPWS)
  • Local authorities
  • Marine Institute
  • Bord Iascaigh Mhara (BIM)
  • An Taisce
  • Inland Fisheries Ireland
• Accountant(appointed through ALAB’s tendering process)
• Legal team(appointed through ALAB’s tendering process)
• Translation team(appointed through ALAB’s tendering process)
• Internal auditors(appointed through ALAB’s tendering process)

This Privacy Notice also explains what personal data ALAB collects and uses about data subjects who uses ALAB’s website (www.alab.ie ). ALAB uses cookies on the website, and for more information about this, please see the Cookie Notice at accessible via the cookie symbol located at the bottom left corner of the Aquaculture Licences Appeals Board website.

Aquaculture Licences Appeals Board

The primary data protection legislation that applies to ALAB is the EU General Data Protection Regulation (the GDPR) effective from 25 May 2018, supplemented by Irish legislation (primarily the Data Protection Acts 1988 – 2018, as amended, the Data Sharing and Governance Act 2019, and the ePrivacy Regulations 2011). One of ALAB’s obligations under the GDPR is to be transparent with data subjects about ALAB’s collection and use of personal information about data subjects.

What is data protection and why is ALAB concerned about it?

Data protection law provides rights to data subjects with regard to the use of their personal information (personal data) by organisations, including ALAB. Irish and EU laws on data protection govern all activities ALAB engages in with regard to ALAB’s collection, storage, handling, disclosure and other lawful uses of personal data.

Compliance with the data protection legislation is a legal obligation. In addition, ALAB’s compliance with its data protection obligations helps data subjects to have confidence in dealing with ALAB and helps ALAB to maintain a positive reputation in relation to how ALAB handles personal information.

What are ALABs data protection obligations?

 ALABs data protection obligations require that the personal data that ALAB collects and uses must be: -

1. Collected and used lawfully, fairly and in a transparent way.
2. Collected only for valid purposes that ALAB has clearly explained to data subjects and not used in any way that is incompatible with those purposes.
3. Relevant to the purposes ALAB has informed data subjects about, be sufficient (adequate) for those purposes, and be limited only to those purposes.
4. Accurate and kept up to date.
5. Kept only as long as necessary for the purposes ALAB has told data subjects about.
6. Kept securely.

ALAB must also follow certain rules in relation to who receives personal data from ALAB (see further below), transferring personal data outside the European Economic Area (EEA) (see further below) and about data subjects rights in relation to their personal data (see further below).

What information ALAB holds about data subjects and why

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been (permanently and irrevocably) removed (anonymous data).

There are "special categories" of more sensitive personal data which require a higher level of protection, such as information about a person's health or about commission of criminal offences, prosecution for criminal offences, criminal convictions and/or sentencing for criminal convictions.

ALAB collects, stores, and uses the following main categories of personal information about data subjects who are external to ALAB (that is, outside ALAB’s organisation) and for the purposes which are set out below: -

1. About data subjects who complete a notice of appeal: -

• Name, address and Eircode, contact details (including email address and land line or mobile number).
• Application numbers, individual reference numbers, and licence numbers.
• Written statements or reports about the appeal.
• Any other personal information provided by data subjects in support of their appeal.
• Bank details to process payment to ALAB as part of a data subjects appeal.

2. About visitors to the ALAB website/offices and premises: -

• Browsing information about what sections of ALAB’s website were browsed, when, and whether the person was a repeat browser. (This information is collected using “cookies”. For more information, please see the Cookie Notice at accessible via the cookie symbol located at the bottom left corner of the Aquaculture Licences Appeals Board website.

• Name, organisation details, date and time of visit and signature, provided by any external service, maintenance and/or other operational personnel attending the ALAB’s offices and premises.

ALAB also collects, uses and holds the following personal information: -

• Names and contact details of data subjects who submit requests to ALAB under data protection legislation and under freedom of information legislation, and details of these requests.
• Names, contact details, qualifications and experience, dates and details of appointment, and details of meeting attendances of members of the Board.
• Names, contact details, qualifications and experience, dates and details of appointment, and details of meeting attendances of participants in ALAB’s meetings.
• Names, addresses, contact details and other personal information provided by data subjects who make submissions to ALAB in response to consultations ALAB undertakes.
• Names, addresses, contact details, CVs, professional profiles and other personal information provided as part of tenders submitted to ALAB and/or of ALAB’s service providers.
• Names, titles and work contact details of data subjects with whom ALAB liaise as part of ALAB regular organisational activities.
• Names, titles and work contact details of data subjects who work for ALAB service providers.

How is personal information collected? 

ALAB collects and uses personal data (personal information) in a variety of ways. These include: -

• Directly from data subjects themselves (or their nominated representatives) when completing ALAB’s notice of appeal form and written statements or reports in support of an appeal, and through other direct contact with ALAB, including responses to requests for information.
• From third parties who make queries or representations on behalf of data subjects (but who might not be formally representing the individual), e.g. TDs, Government Departments or agencies with which the individual might have raised a complaint or query, and which have referred the complaint or query to ALAB.
• From browsing or using ALAB’s website. (For more information about the browsing information ALAB collects, please see ALAB Cookie Notice at accessible via the cookie symbol located at the bottom left corner of the Aquaculture Licences Appeals Board website).
• From regulators or supervisory regulators, in circumstances where personal data may be provided to ALAB in the course of their regulatory functions.  
• From visiting ALAB’s offices or premises, or from public sources.

Basis of ALAB use of personal information

ALAB will only use personal information when the law allows ALAB to. Most commonly, ALAB will use personal information in the following circumstances: -

• Where it is necessary for ALAB to fulfil ALAB functions and to meet ALAB’s obligations under legislation.
• Where ALAB need to perform a contract, that ALAB has entered into.
• Where is it necessary for the purposes of legal claims or legal proceedings.
• To report suspected criminal offences to other relevant authorities, including the Gardai and other regulators.
• For ALAB legitimate interests, including in relation to security of ALAB’s offices and premises, where these interests are not outweighed by data subjects’ rights and interests.

ALAB may also use personal information in the following situations, which are likely to be unusual: -

• Where ALAB need to protect its data subjects vital interests (or someone else’s vital interests), e.g. in an emergency health situation, building safety emergency (such as a fire) or other life-threatening events, where ALAB are requested to disclose information urgently and with good cause to medical personnel or to the emergency services.

• Where it is needed in the public interest or for official purposes.

Situations in which ALAB will use personal information 

The main situations in which ALAB will use personal information are listed below: -

• To process an appeal and any other legitimate purpose connected to an appeal.
• To carry out ALAB statutory remit to hear and determine an appeal.
• To issue licences and certificates.
• To conduct surveys and perform services for those working in the marine sector.
• For training and education.
• For audit and verification purposes.
• To fulfil ALAB’s obligations under a contract ALAB has entered into.
• To fulfil ALAB’s legal obligations to liaise with other regulators (Revenue), which is provided for by law.
• To otherwise fulfil ALAB legal obligations and conduct ALAB’s functions as a public body and/or employer.
• To help ALAB to take or defend legal claims and/or legal proceedings, including relating to any legal enforcement action or criminal prosecution.
• In relation to use of ALAB website, to enable ALAB to understand how users interact with the website so that ALAB can improve the content, navigation or other features of the website. (For more information, please see ALAB’s Cookie Notice at accessible via the cookie symbol located at the bottom left corner of the Aquaculture Licences Appeals Board website).
• In relation ALAB offices and premises, to ensure security of ALAB offices and premises, and to enable ALAB to investigate incidents that occur at ALAB offices and premises.

Failure to provide personal information

Failure to provide certain information when requested by ALAB, which is necessary to process an appeal, then ALAB may not be able to deal with the appeal.

Does ALAB need consent?

For the majority of uses that ALAB makes of the personal information that is described in this Privacy Notice, ALAB do not require consent. ALAB’s collection and use of personal information is mainly based on ALAB’s legal obligations and to enable ALAB to fulfil ALAB statutory function.

Please also see ALAB Cookie Notice at accessible via the cookie symbol located at the bottom left corner of the Aquaculture Licences Appeals Board website which explains how and why ALAB uses cookies and other information-gathering devices on ALAB website, and how data subjects can prevent cookies being used.

Right to withdraw consent

In the limited circumstances where data subjects may have provided consent to the collection or use of personal information for a specific purpose, data subjects have the right to withdraw this consent for that specific use at any time. To withdraw consent, please contact ALAB’s Data Protection Officer (DPO) using the contact details above. Once ALAB has received notification that consent is being withdrawn, ALAB will no longer process the information for the purpose or purposes it was originally agreed to, unless ALAB has another legitimate basis for doing so in law.

Automated decision-making

Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. ALAB are allowed to use automated decision-making in the following circumstances:

1. Where ALAB have notified data subjects of the decision and given 21 days to request reconsideration.

2. Where it is necessary to perform the contract with data subjects and appropriate measures are in place to safeguard data subject rights.

3. In limited circumstances, with data subjects explicit written consent and where appropriate measures are in place to safeguard data subjects rights.

If ALAB make an automated decision on the basis of any particularly sensitive personal information, ALAB must have the data subjects explicit written consent or it must be justified in the public interest, and ALAB must also put in place appropriate measures to safeguard data subjects rights.

Data subjects will not be subject to decisions that will have a significant impact on them based solely on automated decision-making, unless ALAB have a lawful basis for doing so and have provided advanced notification.

Data sharing: information about ALAB’s data processors and other recipients of personal information from ALAB

ALAB may share data with third parties, including ALAB third-party service providers and other recipients. Some of these recipients are ALAB data processors, that is, they can only take and use the personal information that they receive from ALAB strictly only on ALAB’s instructions and under ALAB’s control.

Then there are other recipients which are not ALAB’s data processors, but which are regarded as separate data controllers, with which ALAB interact and share personal information. This includes: ALAB’s auditors and solicitors (to the extent that they might need to review ALAB records in order to provide professional services to ALAB), ALAB payment services provider (to facilitate payments made to ALAB).

ALAB require all of ALAB’s data processors to respect the security of data subjects personal information and to treat it in accordance with the law.

ALAB will share personal information with these third parties where required by law, or where ALAB have legitimate interest in doing so (for example, to help ALAB to efficiently operate ALAB’s organisation).

ALAB may transfer personal information outside the EU.

If ALAB does this, data subjects can expect a similar degree of protection in respect of their personal information.

Who processes personal information for ALAB and who receives personal information from ALAB?

ALAB set out below descriptions of ALAB’s data processors which process personal information on ALAB’s behalf, and under ALAB’s control: - 

• ALAB’s managed services provider, to which ALAB’s have outsourced office IT functions. This includes management of ALAB’s databases and other electronic files containing personal information. ALAB also uses other external IT services to help ALAB’s to support and maintain ALAB’s website.

• ALAB’s service provider Vimar, which provides for web page graphics for the ALAB website.

• ALAB does not currently engage external IT forensics service providers for litigation support or document discovery. Instead, ALAB relies on its own internal record-keeping practices, with electronic records stored in folders on a shared area of the Department’s server. Where necessary, ALAB may seek assistance from the Department’s IT services to locate or retrieve records. This support may be provided internally by the Department or, where applicable, externally via a third-party processor. ALAB will ensure that any such processing is carried out in accordance with applicable data protection legislation, including the requirement to have appropriate data processing agreements in place where external processors are involved.

• Mid-Freight is used for offsite file storage and confidential document destruction services.

There are other organisations to which ALAB’s disclose personal information or with which ALAB’s share personal information. These include: -

• The Department of Agriculture, Food, and Marine and other third parties for the purposes of processing an appeal and obtaining submissions and observations in relation to an appeal.

• Revenue when disclosing ALAB’s end of year accounts required under the Code of Practice for the Governance of State Bodies (Department of Public Expenditure and Reform 2016).

• The Department of Agriculture, Food and the Marine, external auditors, including translation services and external technical advisers for audit and verification purposes.

• ALAB’s auditors, legal advisers, economic providers and similar professional services providers, where this is required for the purposes of the professional services which they provide to ALAB. Also, where the Comptroller & Auditor General’s Office (C&AG) reviews our expenditure of public funds, the C&AG may require access to files containing personal information in order to conduct this review.

• ALAB’s third-party payment services provider, Allied Irish Bank, which processes payments made to ALAB via bank transfer online.

• The Office of Government Procurement (OGP), which is an agency of the Department of Finance. The OGP sometimes helps ALAB with administering the tender competitions, and they can see the personal information submitted as part of the tender process.

• Third party service provider which provides an external platform for the Board Members of ALAB to view details of appeals, ALAB’s financial data and for corporate governance functions.

All ALAB’s data processors are required to take appropriate security measures to protect personal information. ALAB does not allow data processors to use personal data for their own purposes. ALAB only permits them to process personal data for specified purposes and in accordance with ALAB’s instructions.

Transferring information outside the EEA

As a general rule, ALAB does not transfer personal information contained on ALAB’s IT systems outside the European Economic Area (being the EU plus Norway, Iceland and Liechtenstein). ALAB’s policy is to require any data that is processed on ALAB’s behalf by ALAB’s data processors to be kept on servers located within the EU.

To the extent that any personal information under ALAB’s control might be transferred outside the EU, ALAB ensure that the personal information receives an adequate level of protection. So, for example, ALAB check whether the information recipient is located in a country which the EU Commission has ruled has an adequate level of data protection.

Otherwise, ALAB ensure that appropriate measures are put in place to protect the personal information and that the personal information is treated by the recipients in a way that is consistent with, and which respects data protection legislation. This can include using measures like Standard Contractual Clauses or EU Commission Adequacy Decisions (including the EU-US Data Privacy Framework) to underpin the data transfers. If data subjects require further information about this or about specific protection measures, please contact our Data Protection Officer (DPO) using the contact details above.

Data security

ALAB has implemented measures to protect the security of personal data. Third-party service providers acting as data processors will only process personal data on ALAB’s instructions and where they have agreed to treat the data confidentially and to maintain appropriate security standards.

ALAB has put in place appropriate security measures to prevent personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, ALAB limits access to data subjects personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process data subject personal information on ALAB’s instructions, and they are subject to a duty of confidentiality.

ALAB’s have put in place procedures to deal with any suspected data security breach (including personal data breach) and will notify data subjects and any applicable regulator of a suspected personal data breach where ALAB is legally required to do so.

Data retention: how long will data subjects information be used for? 

ALAB will only retain data subjects personal information for as long as necessary to fulfil the purposes ALAB collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. If legislation requires ALAB to retain personal data for a specified period, then ALAB retains it in accordance with those legislative obligations.

To determine the appropriate retention period for personal data, ALAB considered the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of data subjects personal data, the purposes for which ALAB processes data subjects personal data and whether ALAB can achieve those purposes through other means, and any specific legal obligations that apply to ALAB to retain personal information or records which might contain personal information.

The following are examples of the retention periods ALAB apply: -p

• ALAB keeps information about an appeal for as long as a licence is in operation years after the appeal determination has been issued. Data subjects personal information may be retained for a longer period if ALAB’s decision is appealed to the High Court or if ALAB’s decision is challenged in legal proceedings.

In some circumstances ALAB may anonymise data subjects personal information so that it can no longer be associated with data subjects, in which case ALAB may use such information without further notice to data subjects.

ALAB may retain data subjects personal information longer than ALAB’s nominated retention period where ALAB needs it in order to make or defend legal claims, and if this happens, ALAB will retain the personal information for as long as it takes to resolve the legal claim or have it finally determined by a court.

Please help ALAB to keep data subjects information accurate and up to date

It is important that the personal information ALAB holds about data subjects is accurate and current. Please keep ALAB informed if any personal information changes during the relationship with ALAB. This can be done by contacting ALAB’s Data Protection Officer (DPO) using the contact details above.

Data subjects rights in connection with personal information

Under certain circumstances, by law data subjects have the right to:

• Request access to personal data. Data subjects have the right to obtain confirmation as to whether ALAB processes personal data concerning them, and where that is the case, to access a copy of such data. This enables data subjects to verify the lawfulness of the processing in accordance with Article 15 of the GDPR. 

• Request erasure of personal data. Data subjects may request that ALAB erase personal data where there is no lawful basis for its continued processing. This right also applies where a data subject has exercised their right to object to processing and there are no overriding legitimate grounds for ALAB to retain the data. 

• Object to the processing of personal data. Data subjects have the right to object to the processing of their personal data where ALAB relies on the legal basis of legitimate interests (whether ALAB’s or a third party’s), and the objection is based on grounds relating to the data subject’s particular situation. 

• Request restriction of processing. Data subjects may request that ALAB restrict the processing of their personal data in certain circumstances, for example, where the accuracy of the data is contested or where the lawfulness of the processing is under review. 

• Request data portability. Data subjects have the right to request that their personal data be transferred to another controller, where technically feasible, in accordance with Article 20 of the GDPR. This applies to data provided to ALAB and processed based on consent or contract, by automated means. 

How to make a request to exercise data protection rights 

To exercise any of the rights under data protection law, including requesting access, rectification, erasure, restriction of processing, objection to processing, or data portability, data subjects should contact ALAB’s Data Protection Officer using the contact details provided above. Requests should include sufficient information to allow ALAB to verify the identity of the requester and to understand the nature of the request.

No fee usually required 

There is no fee for data subjects to access their personal data or to exercise any of their rights under data protection law. However, ALAB may charge a reasonable fee where a request is clearly unfounded or excessive. In such cases, ALAB may alternatively refuse to comply with the request.

What ALAB may need from data subjects 

ALAB may request specific information from a data subject to confirm their identity and to ensure they have the right to access the personal data or exercise any other rights under data protection law. This is an appropriate security measure to ensure that personal data is not disclosed to any person who does not have the right to receive it. ALAB may also contact the data subject to request further information in relation to the request, in order to facilitate a timely response.

Time limit for ALAB to respond to requests 

ALAB aims to respond to all legitimate requests within one month of receipt. In certain cases, such as where a request is particularly complex or where multiple requests have been made, it may take longer than one month to respond. In such circumstances, ALAB will notify the requester and provide updates on the progress and expected timeframe for a response.

ALAB’s Data Protection Officer 

ALAB has appointed a Data Protection Officer (DPO) to oversee compliance with this Privacy Notice and generally with ALAB’s obligations under the data protection legislation. Any questions about this Privacy Notice or how ALAB handle personal information, please contact the DPO using the contact details above.

Right to complain to the Data Protection Commission 

If there are concerns about ALAB’s handling of personal data or its compliance with data protection legislation, data subjects have the right to lodge a complaint with the Data Protection Commission (“DPC”), which is the Irish supervisory authority for data protection matters, including under the GDPR.

Changes to this Privacy Notice 

ALAB reserves the right to update this Privacy Notice at any time. Where substantial updates are made, ALAB will provide a revised version of the notice. ALAB may also issue additional notifications from time to time regarding the processing of personal data.