This Privacy Notice provides guidance and information on how the Competition and Consumer Protection Commission (\u201cCCPC\u201d) collects and uses personal data.<\/p>\n
The CCPC (“us”, “we” or “our”) is an independent statutory body with a mandate to enforce competition and consumer protection law in Ireland. In carrying out its statutory functions and activities, the CCPC engages with and may handle personal data relating to various different external parties, both individuals and businesses. In particular, the CCPC obtains data from individual members of the public who make complaints, enquiries or applications for authorisations to the CCPC or otherwise provide data to the CCPC. The CCPC also obtains data from businesses, companies, sole traders, partnerships, Government Departments, State bodies, State-sponsored bodies and other organisations, which may include personal data of individual contacts or officers of such entities.<\/p>\n
This Privacy Notice is intended to apply to personal data connected with the aforementioned individuals and businesses. It applies whether such personal data is obtained by the CCPC on a voluntary basis or as a result of the exercise of the CCPC\u2019s statutory powers.<\/p>\n
The CCPC is committed to protecting and respecting your privacy. This Privacy Notice sets out the basis on which any personal data we collect from or about you in connection with the performance of the CCPC\u2019s statutory functions and activities will be processed by us. Please read this Privacy Notice carefully to understand our treatment and use of personal data.<\/p>\n
In this Privacy Notice, references to \u201cyou\u201d mean the person whose personal information we collect, use and process.<\/p>\n
We will use your personal data only for the purposes and in the manner set forth below, which describes the steps we take to ensure the processing of your personal data is in compliance with the Data Protection Acts 1988 to 2018 and any related or subsequent data protection and privacy legislation and amendments, as well as European Union Law including Regulation (EU) 2016\/679 (known as the General Data Protection Regulation or GDPR), the Law Enforcement Directive (i.e. Directive (EU) 2016\/680) and any subsequent implementing legislation and amendments (collectively referred to in this Privacy Notice as \u201cData Protection Legislation\u201d).<\/p>\n
We seek to maintain the privacy, accuracy, and confidentiality of data (including your personal data) that we collect and use.<\/p>\n
For the purposes of Data Protection Legislation, the Data Controller is the CCPC, which has its address at Bloom House, Railway Street, Dublin 1, D01 C576.<\/p>\n
| \n Source <\/strong>and Purpose\u00a0 of Processing<\/strong><\/p>\n<\/td>\n Information supplied by individuals or businesses who submit a request, query or complaint to the CCPC.<\/p>\n <\/p>\n This is required to enable the CCPC to: (i) deal with and respond to your request, query or complaint, (ii) ensure compliance with the CCPC\u2019s legal obligations and corporate governance requirements, and (iii) perform its statutory functions and activities.<\/td>\n In relation to other personal data (e.g. personal data relating to a third party and\/or personal data which is supplied as a result of the exercise of the CCPC\u2019s statutory powers), processing is necessary for the performance of a task carried out by the CCPC in the public interest or in the exercise of official authority vested in the CCPC and\/or to comply with legal obligations.<\/td>\n Information supplied by or obtained from individuals or businesses who are the subject of enquiries or an investigation conducted by the CCPC on its own behalf or on behalf of another agency.<\/p>\n <\/p>\n This is required to enable the CCPC to perform its statutory functions and activities.<\/td>\n In relation to other personal data (e.g. personal data relating to a third party and\/or personal data which is supplied as a result of the exercise of the CCPC\u2019s statutory powers), processing is necessary for the performance of a task carried out by the CCPC in the public interest or in the exercise of official authority vested in the CCPC and\/or necessary to comply with legal obligations.<\/td>\n Information supplied by individuals or businesses involved in a proposed merger or acquisition which is notified to the CCPC.<\/p>\n <\/p>\n This is required to enable the CCPC to: (i) ensure compliance with the CCPC\u2019s legal obligations, and (ii) perform its statutory functions and activities.<\/td>\n In relation to other personal data (e.g. personal data relating to a third party and\/or personal data which is supplied as a result of the exercise of the CCPC\u2019s statutory powers), processing is necessary for the performance of a task carried out by the CCPC in the public interest or in the exercise of official authority vested in the CCPC and\/or necessary to comply with legal obligations.<\/td>\n Information supplied by individuals or businesses who are, or who are acting on behalf of, a relevant grocery goods undertaking.<\/p>\n <\/p>\n This is required to enable the CCPC to perform its statutory functions and activities.<\/td>\n In relation to other personal data (e.g. personal data relating to a third party and\/or personal data which is supplied as a result of the exercise of the CCPC\u2019s statutory powers), processing is necessary for the performance of a task carried out by the CCPC in the public interest or in the exercise of official authority vested in the CCPC and\/or necessary to comply with legal obligations.<\/td>\n Information supplied by individuals or businesses who respond to consultations, information requests or questionnaires issued by the CCPC.<\/p>\n <\/p>\n This is required to enable the CCPC to perform its statutory functions and activities.<\/td>\n In relation to other personal data (e.g. personal data relating to a third party and\/or personal data which is supplied as a result of the exercise of the CCPC\u2019s statutory powers), processing is necessary for the performance of a task carried out by the CCPC in the public interest or in the exercise of official authority vested in the<\/p>\n CCPC and\/or necessary to comply with legal obligations.<\/td>\n customers, competitors or suppliers).<\/td>\n<\/tr>\n <\/p>\n Details supplied for the purpose of the CCPC processing payments.<\/p>\n This is required to enable the CCPC to: (i) process any payment to be made to or by you; and\/or<\/p>\n (ii) to comply with its legal obligations; or (iii) to perform its statutory functions and activities.<\/td>\n In some limited circumstances, we may request your explicit consent to process (specific types of) personal data. This will be predominantly where you voluntarily provide your personal data to the CCPC. In these circumstances, you are able to withdraw your consent at any time by following the instructions provided when you gave consent or at the contact details below. Consent will rarely be considered to be a basis for processing personal data gathered or obtained by the CCPC on foot of its competition or consumer protection law enforcement functions and activities.<\/p>\n Internally within the CCPC<\/p>\n Your personal data will be held by the Division within the CCPC which originally obtained it. Your personal data will only be shared with the Members of the CCPC and with persons in other Divisions of the CCPC in certain circumstances and where necessary and lawful to do so,<\/p>\n i.e. it may be necessary to share your personal data with persons in other Divisions of the CCPC for the purposes of performing our statutory functions and activities.<\/p>\n Access to your personal data will be granted to persons within the CCPC only on a need to know basis, depending on job functions and roles.<\/p>\n We use third party service providers who provide services to the CCPC, including consumer helpline services, public relations services, and IT and communications services. In providing these services, your personal data will, where applicable, be processed by the service provider on our behalf.<\/p>\n We will check any third party service provider that we use to ensure that they can provide sufficient guarantees regarding the confidentiality and security of your personal data. We will have written contracts with them which provide assurances regarding the protections that they will give to your personal data and their compliance with our data security standards and international transfer restrictions.<\/p>\n Disclosures to Third Parties<\/p>\n In certain circumstances, we share and\/or are obliged to share your personal data with third parties, for the purposes described above and\/or in the course of the exercise of the CCPC\u2019s statutory functions and activities. In particular, the CCPC is permitted to share certain information (which may include your personal data) with bodies with whom it has a cooperation agreement pursuant to section 19 of the Competition and Consumer Protection Act 2014 (referred to in this Privacy Notice as the \u201c2014 Act<\/strong>\u201d) and\/or with the bodies specified in section 24(1) of the 2014 Act. In addition, the CCPC is permitted to share information with other competition and consumer protection authorities in the European Union pursuant to Council Regulation (EC) No 1\/20031<\/sup>\u00a0<\/strong>and Regulation (EC) No 2006\/20042<\/sup>\u00a0<\/strong>(as may be amended or replaced). Any disclosure of personal data by the CCPC to a third party shall be conducted in accordance with Data Protection Legislation.<\/p>\n These third parties may include:<\/p>\n Your personal data may be transferred, stored and processed in one or more countries outside the European Economic Area (\u201cEEA<\/strong>\u201d), for example, when one of our third-party service providers use employees or equipment based outside the EEA. For transfers of your personal data to third parties outside of the EEA, we take additional steps in line with Data Protection Legislation. We will put in place adequate safeguards with respect to the protection of your privacy, fundamental rights and freedoms, and the exercise of your rights, e.g. we will establish an adequate level of data protection through EU Standard Contractual Clauses based on the EU Commission\u2019s model clauses.<\/p>\n If you would like to see a copy of any relevant provisions, please contact our Data Protection Officer (see \u201cContact Us\u201d section below).<\/p>\n We have in particular taken appropriate security measures to protect any personal data held by the CCPC from accidental or unlawful destruction, loss or alteration, and from unauthorised disclosure or access. Access to your personal data is only granted on a need-to-know basis to those people within the CCPC whose roles require them to process your personal data and, in certain circumstances, to third parties (see the \u201cSharing of Personal Data\u201d section above). In addition, our third party service providers are also selected carefully and required to use appropriate protective measures.<\/p>\n If you would like further information about security measures applied to personal data held by the CCPC, please contact the CCPC\u2019s Data Protection Officer (see the \u201cContact Us\u201d section below).<\/p>\n We will keep your personal data for as long as it is necessary to fulfil the purposes for which it was collected as described above and in accordance with our legal and regulatory obligations. This may mean that some information is held for longer than other information. The criteria we use to determine data retention periods for personal data includes the following:<\/p>\n Retention in case of queries and complaints; we will retain it for a reasonable period after the query or complaint has been resolved or, if a formal investigation is opened by the CCPC in respect of the query or complaint, for a reasonable period after the conclusion of such investigation and\/or any subsequent related legal proceedings;<\/p>\n Retention in case of investigations; we will retain it for a reasonable period after the conclusion of the investigation and\/or any subsequent related legal proceedings;<\/p>\n Retention in case of reviews of mergers and acquisitions; we will retain it for a reasonable period after the CCPC issues its determination in relation to the merger or acquisition or, if the CCPC\u2019s decision is challenged, for a reasonable period after the conclusion of any subsequent related legal proceedings; and<\/p>\n Retention in accordance with legal and regulatory requirements; we will consider whether we need to retain it after the periods described in 9.1.1 to 9.1.3 above because of a legal or regulatory requirement (e.g. as set out in the National Archives Act 1986, as amended) or for the purpose of performing our statutory functions and activities.<\/p>\n If you would like further information about our data retention practices, please contact the<\/p>\n CCPC\u2019s Data Protection Officer (see the \u201cContact Us\u201d section below).<\/p>\n You may have various rights under Data Protection Legislation. However, in certain circumstances, these rights may be restricted3<\/strong><\/a>. In particular, your rights may be restricted where this is necessary: (i) for the prevention, detection, investigation and prosecution of criminal offences; (ii) in contemplation of or for the establishment, exercise or defence of a legal claim or legal proceedings (whether before a court, tribunal, statutory body or an administrative or out-of-court procedure); and\/or (iii) for the performance of a task carried out in the public interest or in the exercise of official authority vested in the CCPC. Therefore, the CCPC considers that, in most cases, these rights will not apply in connection with the performance of the CCPC\u2019s competition and consumer protection law enforcement functions and activities.<\/p>\n Subject to the above, your rights under Data Protection Legislation may include (as relevant):<\/p>\n If you are unhappy about any aspect of the way we collect, share or use your personal data, please let us know using the contact details below.<\/p>\n You also have a right to complain to the Data Protection Commission by post to 21 Fitzwilliam Square South, Dublin 2, D02 RD28; and\/or by telephone at 1800 437 737\/01 765 0100; and\/or by using the webform available on the website www.dataprotection.ie<\/a>.<\/p>\n We reserve the right to change this Privacy Notice at any time in our sole discretion. If we make changes to this Privacy Notice, we will publish any relevant changes on the CCPC\u2019s public website (ccpc.inventise.ie)<\/a> so that you can see what information we gather, how we might use that information and in what circumstances we may disclose it. By continuing your relationship with us after we post any such changes on our website, you accept and agree to this Privacy Notice as modified.<\/p>\n |