Data Protection Laws provide certain rights in favour of Data Subjects. The rights in question (“Data Subject Rights”) are as follows:

1. The right to obtain access to Personal Data that we hold about an individual and certain prescribed information about how we process it. The purpose of this right is to enable individuals to obtain confirmation that their Personal Data is being processed, to gain access to their Personal Data, and to other supplementary information about how it is processed. This is to ensure the person concerned can be aware of and can verify the lawfulness of the processing relating to their Personal Data.
2. The right to obtain from us without undue delay the rectification of inaccurate Personal Data concerning the person and to have incomplete Personal Data completed in certain circumstances.
3. The right to obtain from us the erasure of Personal Data concerning the person concerned without undue delay in certain circumstances (also known as the “right to be forgotten”). This right is not absolute – it applies only in particular circumstances and where it does not apply any request for erasure will be rejected. Circumstances when it might apply include where the Personal Data is no longer necessary in relation to the purpose for which it was originally collected/processed, when consent is withdrawn (if relevant), when the individual objects to processing and there is no overriding legitimate interest for continuing the processing, if the Personal Data is unlawfully processed, or if the Personal Data has to be erased to comply with a legal obligation. Erasure requests will be refused where it is lawful and permitted under data protection law such as where the Personal Data has to be retained to comply with legal obligations or to exercise or defend legal claims.
4. The right to obtain the restriction of processing of Personal Data may be relevant if a person contests the accuracy of their Personal Data and its accuracy is being verified; when the processing is unlawful and a person requests that use of the Personal Data is restricted and where they do not want erasure instead; or when we no longer need to process the Personal Data but the person concerned requires the Personal Data to be retained in case of future legal claims.
5. The right to data portability where the Personal Data is Processed by us based on consent or based on a contract and by automated means (as relevant). This right allows individuals to have their Personal Data transferred to another Data Controller where it is technically feasible to do so.
6. Rights relating to automated decision making including profiling (as relevant) if this has a legal or other significant effect on the individual – this right allows individuals in certain circumstances to access certain safeguards against the risk that a potentially damaging decision is taken without human intervention.

Any Data Subject wishing to exercise their Data Subject Rights should write to the HBFI Data Protection Officer, Treasury Building, Grand Canal Street, Dublin or email dpo@HBFI.ie