Submit an Enquiry

Data Protection Laws provide certain rights in favour of Data Subjects. The rights in question (“Data Subject Rights”) are as follows:

  1. The right to obtain access to Personal Data that we hold about you and certain prescribed information about how we process it. The purpose of this right is to enable you to obtain confirmation that your Personal Data is being processed, to gain access to your Personal Data, and to other supplementary information about how it is processed. This is to ensure you can be aware of and can verify the lawfulness of the processing relating to your Personal Data.
  2. The right to obtain from us without undue delay the rectification of inaccurate Personal Data concerning yourself and to have incomplete Personal Data completed in certain circumstances.
  3. The right to obtain from us the erasure of Personal Data concerning yourself without undue delay in certain circumstances (also known as the “right to be forgotten”). This right is not absolute – it applies only in particular circumstances and where it does not apply any request for erasure will be rejected. Circumstances when it might apply include where the Personal Data is no longer necessary in relation to the purpose for which it was originally collected/processed, when consent is withdrawn (if relevant), when the individual objects to processing and there is no overriding legitimate interest for continuing the processing, if the Personal Data is unlawfully processed, or if the Personal Data has to be erased to comply with a legal obligation. Erasure requests will be refused where it is lawful and permitted under data protection law such as where the Personal Data has to be retained to comply with legal obligations or to exercise or defend legal claims.
  4. The right to obtain the restriction of processing of your Personal Data may be relevant if you contest the accuracy of your Personal Data and its accuracy is being verified; when the processing is unlawful and you request that use of the Personal Data is restricted and where you do not want erasure instead; or when we no longer need to process the Personal Data but you require the Personal Data to be retained in case of future legal claims.
  5. The right to data portability where the Personal Data is Processed by us based on consent or based on a contract and by automated means (as relevant). This right allows individuals to have their Personal Data transferred to another Data Controller where it is technically feasible to do so. This right only applies to Personal Data which the Data Subject has provided to HBFI (and not to data which is received from third parties).
  6. Rights relating to automated decision making about you including profiling (as relevant) if this has a legal or other significant effect on you as an individual – this right allows individuals in certain circumstances to access certain safeguards against the risk that a potentially damaging decision is taken without human intervention.
  7. The right to withdraw consent (in the limited cases where we rely on your consent to process your personal data), without affecting the lawfulness of processing based on consent before its withdrawal.

Some rights will not apply in some cases, and exemptions may apply to the exercise of your rights. For example, Articles 17 and 20 of the GDPR state that the right to be forgotten and the right of data portability do not apply to processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller.

Any Data Subject wishing to exercise their Data Subject Rights should write to the HBFI Data Protection Officer, Treasury Dock, 1 North Wall Quay, Dublin 1, D01 A9T8 or email dpo@HBFI.ie. Your request will be dealt with in accordance with the HBFI’s Data Subject Rights Requests Procedure.