Data Protection Policy
The European Professional Drivers Association Management Services Limited (hereinafter referred to as EPDA) has a clear mission statement.
“To promote and support a professional driving culture.”
To achieve this aim the EPDA engages with all stakeholders to ensure that the objective it delivered and supported.
It is up to every individual to choose how they conduct themselves in relation to their position in work. The EPDA sets standards for professional drivers. It is for each individual driver to choose to be a commercial vehicle driver or choose to be a professional driver.
Assisting stakeholders understand the actual diversity and complexity of the role of today’s professional driver will benefit all of those involved in the transport industry. The importance of education and recognition for achievement cannot be overstated. The EPDA places education as a key component in the development of the professional driver. Experience and competence in the role of the professional driver make a major contribution to operational efficiencies, cost-effective operation, a reduction in Co2 emissions and a safer road network.
EPDA necessarily collects, processes and stores personal data from our customers, staff and service providers.
In accordance with the EU General Data Protection Regulation, 2016/679 (GDPR), EPDA is a ‘Data Controller’ and, as such, has responsibilities for ensuring the privacy of data subjects and the protection of personal data processed.
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
‘restriction of processing’ means the marking of stored personal data with the aim of limiting their processing in the future;
‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;
‘filing system’ means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;
‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
‘recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. 2However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;
‘third party’ means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;
‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;
‘biometric data’ means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data;
‘data concerning health’ means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status;
‘main establishment’ means:
as regards a controller with establishments in more than one Member State, the place of its central administration in the Union, unless the decisions on the purposes and means of the processing of personal data are taken in another establishment of the controller in the Union and the latter establishment has the power to have such decisions implemented, in which case the establishment having taken such decisions is to be considered to be the main establishment;
as regards a processor with establishments in more than one Member State, the place of its central administration in the Union, or, if the processor has no central administration in the Union, the establishment of the processor in the Union where the main processing activities in the context of the activities of an establishment of the processor take place to the extent that the processor is subject to specific obligations under this Regulation;
‘representative’ means a natural or legal person established in the Union who, designated by the controller or processor in writing pursuant to Article 27, represents the controller or processor with regard to their respective obligations under this Regulation;
‘enterprise’ means a natural or legal person engaged in an economic activity, irrespective of its legal form, including partnerships or associations regularly engaged in an economic activity;
‘group of undertakings’ means a controlling undertaking and its controlled undertakings;
‘supervisory authority’ means an independent public authority which is established by a Member
‘cross-border processing’ means either:
processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or
processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.
This policy applies to EPDA and is available to all staff of the EPDA to apply to data processing for which they act as ‘Data Controller’.
This policy applies to all personal data collected, processed and stored by EPDA in respect of all individuals, (i.e. staff, customers and service providers) by whatever means including paper and electronic records.
Data Protection Principles
The six principles of the General Data Protection Regulation (GDPR) require that personal data is:
- Processed in a way that is lawful, fair and transparent
- Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes
- Adequate, relevant and limited to what is necessary
- Accurate and kept up to date
- Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; and
- Processed in a manner that ensures appropriate security of the data.
Article 5(2) of the GDPR also obliges EPDA to “be responsible for, and be able to demonstrate, compliance with the principles”.
Application of Data Protection Principles in the GDPR requires that the processing of personal data is conducted in accordance with the data protection principles set out above.
Personal data must be processed in a way that is lawful, fair and transparent
Article 6 of the GDPR sets grounds on which personal data processing is lawful. These grounds include:
‘processing is necessary for compliance with a legal obligation …….. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller …….
Section 38(1) of the Data Protection Act, 2018 further states that processing is lawful where it is required for:
‘……… the performance of a function of a controller conferred by or under an enactment or by the Constitution…….’
Much of the personal data processing by EPDA is carried out for the performance of our duties to represent the professional driver or in the public interest. The functions of the EPDA are set out in our mission statement. Public interest activities carried out by the EPDA for which we may process personal data are as follows:
Publications on the status, work, roles and environment of the professional driver
Publications on the health and wellness of the professional driver
EPDA may also process personal data in accordance with contracts it has put in place and, in limited circumstances, where it has a legitimate interest in processing specified personal data.
In certain circumstances, we may seek consent to process personal data. In such cases, we will ensure that the consent was ‘freely given’. In such cases, consent will be sought at the time that the data is collected and the data subject will be advised that they can withdraw their consent at any stage during processing.
EPDA will be fully transparent in relation to how personal data collected is used, in particular ensuring that it is not used in a way that a data subject would not expect. EPDA will provide the required information to data subjects when the personal data are collected. E
Personal data can only be collected for specific, explicit and legitimate purposes
EPDA processes personal data only for the purposes for which it is collected. Where it processes personal data for archiving purposes in the public interest; scientific or historical research purposes or statistical purposes we will put measures in place to ensure the principle of minimisation. Data subjects will not be identifiable and appropriate safeguards will be put in place with regard to information requirements and rights to rectification, to erasure, to be forgotten, to restriction
of processing, to data portability and to object when processing personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.
Personal data must be adequate, relevant and limited to what is necessary for processing
EPDA will ensure that the data collected and held is the minimum amount required for the specified purpose. EPDA will not collect personal data not necessary to the purpose for which personal data is being collected.
Personal data must be accurate and kept up to date
EPDA will ensure that, where possible, that all personal data held is kept accurate and up to date. All staff in EPDA that access or hold personal data are responsible for ensuring that all manual / computer procedures are adequately maintained and that, where notified of inaccuracies, the personal data will be corrected in a timely manner.
Personal data is only held for as long as is necessary
EPDA will establish the length of time that personal data is required to be retained and the purpose of its retention. EPDA will ensure that the personal data is properly destroyed/deleted when the retention period expires. Where personal data must be retained in to comply with legal requirements, EPDA will ensure that the data is held securely and inaccessible for normal processing.
Personal data is processed in a manner that ensures appropriate security of the data
Security systems, measures and policies pertaining to the storage and processing of personal data are constantly reviewed and, where necessary, updated. EPDA staff avail of ongoing training in relation to their personal responsibilities for the protection of personal data.
Rights of ‘data subjects’
GDPR specifies the following rights for data subjects:
- right to be informed/right of access
- right to rectification
- right to erasure
- right to restrict processing
- right to data portability
- right to object to processing
- rights in relation to automated decision making and profiling.
Data Subjects may contact the EPDA Data Protection Officer with regard to all issues related to processing of their personal data and to the exercise of their rights. firstname.lastname@example.org
Right to be informed and right of access
Data subjects have the right to be informed by EPDA about the collection and use of their personal data. In addition, they have the right to access their personal data and other supplementary information, as appropriate.
Right to rectification
Data subjects have the right to have inaccurate personal data held by EPDA rectified and to have incomplete personal data updated so that it is complete. On receipt of a request from a data subject for rectification of their personal data, EPDA will take reasonable steps to ensure that the data held are accurate and will ensure that data are rectified, where necessary and appropriate.
Right to erasure
Article 17 of the GDPR provides for the right of data subjects in certain circumstances to have their personal data erased (‘right to be forgotten’). These circumstances include:
- the personal data are no longer necessary in relation to the purposes for which they were collected or processed;
- the data subject withdraws consent on which the processing is based and where there is no other legal ground for the processing;
- the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
- the personal data have been unlawfully processed;
- the personal data have to be erased for compliance with a legal obligation.
EPDA will notify the recipients of that particular data so that it can be erased unless this requires disproportionate effort.
The right to erasure is not an absolute right and does not apply in circumstances where EPDA’s processing of personal data is necessary in particular:
- for the performance of a function of our duties carried out in the public interest
- for archiving purposes in the public interest, scientific research, historical research or statistical purposes; or
- where the data are required for the establishment, exercise or defense of legal claims.
Where a data subject is of the opinion that elements of personal data held by EPDA are incorrect, they may make a request in writing to have such data permanently erased. EPDA will review all such requests and, where appropriate, will erase the data in question.
Right to restriction of processing
A data subject has the right to obtain a restriction in relation to the processing of their personal data where any one of the following applies:
- the data subject contests the accuracy of their data. The restriction will apply for a period enabling EPDA to verify the accuracy of the personal data;
- the processing is unlawful and the data subject does not wish to have the data erased, but rather wishes to restrict its’ use;
- EPDA no longer requires the data in question but the data subject seeks its’ retention in order to establish, exercise or defend a legal claim; or
- the data subject has objected to the processing of their data by EPDA. The restriction will apply pending verification on whether EPDA’s legitimate grounds for processing overrides the data subjects concerns.
As a matter of good practice, EPDA will restrict the processing of personal data to ‘strictly necessary processing’ whilst a review of the accuracy of the data and/or the legitimate grounds for processing the data is carried out.
Right to data portability
The collection of a significant proportion of personal data by EPDA is lawful in accordance with Article 6.1(c) or 6.1(e) of the GDPR i.e. ‘necessary for compliance with a legal obligation’ or ‘necessary for a task carried out in the public interest’.
In cases where EPDA has collected personal data from a data subject by consent (in exceptional circumstances) or by contract, that data subject can request EPDA to provide the data in electronic format in order to provide it to another Data Controller. EPDA will comply with all such legitimate requests.
It should be noted that this right does not apply to processing necessary for the performance of a task carried out in the public interest.
Right to object to processing
Under Article 21 of the GDPR, data subjects have a right to object to the processing of their personal data in specific circumstances. Where such an objection is received, EPDA will assess each case on its’ individual merits.
Right not to be subjected to automated decision making
Data subjects have the right not to be subjected to a decision based solely on automatic processing, including profiling, that have a legal or similarly significant effect on them.
EPDA will ensure that no decision issued to a data subject is based on automatic processing alone.
Data subjects who may be concerned that their rights under the GDPR are not upheld by EPDA can contact the EPDA’s Data Protection Officer (DPO). The DPO will engage with the data subject in order to bring their complaint to a satisfactory conclusion.
The DPO can be contacted at email@example.com.
Where the complaint to the DPO cannot be resolved, the data subject will be informed in writing and will be further informed of their right to bring their complaint to the Data Protection Commission.
Responsibilities of EPDA
EPDA is responsible for the following:
Implementing and maintaining appropriate technical and organisational measures for the protection of personal data.
EPDA has implemented appropriate technical and organisational measures to ensure that all data held under its control is secure and is not at risk from unauthorised access, either internal or external. Measures for the protection of personal data are reviewed and upgraded, where appropriate, on an ongoing basis.
Maintaining a record of data processing activities
EPDA maintains a written record of all categories of processing activities for which it is responsible in accordance with GDPR Article 30 and the Data Protection Act 2018 section 81.
Data Protection agreements with personal data recipients
On an ongoing basis, EPDA puts in place appropriate contracts with third parties where personal data are shared. This includes state agencies, industry bodies and companies that share similar aims to ours.
The contracts specify the purpose of sharing the data, the manner in which data subject rights are upheld, the requirements for security of the data, the requirements for termination of the agreement and the steps necessary for the return/deletion of the data shared.
Data Protection by design and default
In accordance with Article 25 of the GDPR, EPDA implements technical and organisational measures to give effect to the principles of the protection of personal data and to ensure that, by default, only personal data necessary for each specific purpose of the processing are processed.
Such measures include the introduction of organisational policies and procedures such as Acceptable Usage Policy and Digital Communications Policy and the implementation of security measures to secure the data.
Data Protection Impact Assessment (DPIA)
Where EPDA considers that proposed processing (in particular processing that involves new technology), poses a high risk to the rights and freedoms of the data subjects involved, EPDA will carry out a DPIA.
EPDA’s Data Protection Officer will be consulted in relation to each DPIA completed.
Where technical and/or organisational measures proposed will not mitigate the high risks previously identified, the Data Protection Commission will be consulted as appropriate.
Transfer of personal data outside of the European Union
EPDA will ensure that appropriate safeguards are in place prior to transferring any personal data outside of the European Union.
Personal data breaches
The GDPR defines a personal data breach as
‘a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed’.
Staff in the EPDA will notify the EPDA’s Data Protection Officer where they identify or suspect a breach of personal data. The DPO will notify the Data Protection Commission without undue delay where a breach is likely to result in a risk to the rights and freedoms of the data subject(s) involved.
The DPO will also assess if the breach is likely to result in a high risk to the data subject(s) involved. Where a high risk is identified, the DPO will arrange for the data subjects to be notified.
Data Protection Governance
Compliance with the GDPR is a key requirement for EPDA. EPDA’s Member Committee will detail the arrangements in place to oversee, monitor and ensure compliance with data protection legislation.
Data Protection Officer
In compliance with Article 37.1(a) of GDPR and Data Protection Act (section 88), EPDA has a designated Data Protection Officer (DPO). EPDA will involve the DPO in a timely manner in all issues which relate to the protection of personal data and will support the DPO in performing their tasks as set out in the legislation. The tasks assigned to EPDA’s Data Protection Officer include the following:
- Informing and advising EPDA and staff who process personal data, of their obligations under data protection legislation;
- Monitoring compliance with the GDPR and the Data Protection Act, 2018 and the policies of EPDA in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff and the related audits;
- Providing advice where requested as regards the data protection impact assessment and monitoring its performance;
- Cooperating with the Data Protection Commission;
- Acting as a contact point for the Data Protection Commission on issues relating
- to processing and prior consultation.
Data Protection Contacts
Data Protection Officer
Mr Kevin Hurley
Data Protection Officer
European Professional Drivers Association
Unit 5 Glasnevin Business Centre
The contact information for EPDA’s Data Protection Officer has been notified to the Data Protection Commission.
If you have a query, concern or complaint regarding a data protection matter, you can also engage with the Data Protection Commission in the following ways:
DPC Website: https://www.dataprotection.ie/en/contact/how-contact-us
Data Protection Commission
21 Fitzwilliam Square South