Print
LinkedIn

Data Protection Statement

31 Mar, 2020

This Data Protection Statement provides information about the ways in which the Mental Health Commission (MHC) processes personal data (see definitions below) relating to individuals (data subjects). This Data Protection Statement relates to personal data processed by the MHC (including the DSS) in carrying out their statutory duties. The Decision Support Service (DSS) is a service of the MHC. 

Who we are and what we do 

The MHC is an independent body established under the Mental Health Acts 2001–2018 (“2001 Act”). The functions of the MHC under the 2001 Act are to promote, encourage and foster the establishment and maintenance of high standards and good practice in the delivery of mental health services and take steps to protect the interests of persons detained under the 2001 Act. This means that the Mental Health Commission may need to process your personal data while you are in receipt of care and treatment at a mental health facility so that it can perform its legal functions.

In December 2015, the MHC's remit was extended to include the establishment of the Director of the Decision Support Service under the provisions of the Assisted Decision-Making (Capacity) Act 2015. The Director commenced performance of her functions on 26 April 2023.  The Directors core functions under the 2015 Act t are to protect and uphold people’s rights to make their own decisions about their personal welfare, property, and affairs. This means that the Director may need to process your personal data so that they can perform their legal functions.

The Director is part of the MHC therefore all references to the MHC in this statement shall apply to the Director unless stated otherwise.

You can contact the MHC in several ways. These are as follows:

Data Protection Officer (DPO)

The MHC has a Data Protection Officer. Should you have questions about how the MHC uses your information, you are concerned about any issue related to your personal data or wish to make a complaint, you can contact the DPO in any of the following ways:

By post

Data Protection Officer, Mental Health Commission, Waterloo Exchange, Waterloo House, Dublin 4, DO4E5W7

By email

dpfoi@mhcirl.ie

For General Queries

By post

For the MHC: Mental Health Commission Waterloo Exchange, Waterloo House, Dublin 4, DO4 E5W7

For the DSS: Decision Support Service, Waterloo Exchange, Waterloo House, Dublin 4, DO4 E5W7.

By email 

For the MHC: info@mhcirl.ie

For the DSS: queries@decisionsupportservice.ie

By Phone

For the MHC: (01) 6362400

For the DSS: (01) 211 9750

Key areas of Data Protection Statement

This Data Protection Statement is designed to cover several key areas. Click on the links below:

Definitions

This is the Data Protection Statement of the MHC, the following definitions apply. 

Personal data is information from which you (or another person) are identifiable, and which relates to you.

Special categories of personal data are categories of personal data which are subject to a higher standard of protection under law due to their sensitivity. This includes personal data which reveals:

  • any racial or ethnic origin
  • political opinions
  • religious or philosophical beliefs
  • trade union membership
  • genetic data
  • biometric data
  • health data
  • data concerning a person’s sex life or sexual orientation

Processing refers to any use of personal data including its collection, disclosure, retention and storage.

Central Authority refers to an authority designated to carry out the functions of the Central Authority pursuant to the 2000 Protection of Adults Convention.

Decision Support Arrangements are legal arrangements set up under the 2015 Act by or on behalf of people who either lack the capacity to make certain decisions currently or who may lose that capacity at some time in the future. Any reference to a Decision Support Arrangement could mean any of the following:

  • A Decision-Making Assistance Agreement
  • A Co-Decision-Making Assistance Agreement
  • A Decision-Making Representation Order
  • An Enduring Power of Attorney (EPA)
  • An Advanced Healthcare Directive

A Data Controller is a natural or legal person, public authority, agency or other body which determines the purposes and means of the processing of personal data.

Data Protection Legislation

The MHC is committed to protecting the rights and privacy of individuals in accordance with national data protection legislation and European Union (EU) Directives and EU Regulations. These include, but are not limited to, the Data Protection Act 2018 and the General Data Protection Regulation (GDPR).

GDPR

The GDPR was introduced on 25 May 2018 . It sets out a series of laws concerning how data can be processed and used by organisations within the EU . According to Article 5 of the GDPR, the key principles which must be considered when an organisation processes personal data are:

  • lawfulness, fairness and transparency
  • purpose limitation
  • data minimisation
  • accuracy
  • storage limitation
  • integrity and confidentiality and
  • accountability

The GDPR is designed to strengthen and standardise data protection laws for all European Union citizens. It places obligations and responsibilities for the MHC as to how it collects, uses and protects personal data. Central to the GDPR are transparency, fairness and accountability. This means that the MHC is required to be fully transparent in how it uses and protects personal data. It also means that it must show accountability for its data processing activities.

Data Protection Act 2018 (“2018 Act”)

The 2018 Act gives effect to the GDPR in Irish law. Collectively, the GDPR and 2018 Act places enhanced accountability and transparency obligations on all organisations using your personal data. Importantly, it gives you greater rights and control over your personal data.

Law Enforcement Directive

The Law Enforcement Directive (EU 2016/680) (“LED”) is a piece of EU legislation, parallel to the GDPR, which also took effect from May 2018. The LED deals with the processing of personal data by Data Controllers where the processing is for ‘law enforcement purposes’ which fall outside the scope of the GDPR.

As a Directive, the LED was transposed into Irish law. Part 5 of the Data Protection Act 2018 sets out the LED in the Irish context. The MHC is a ‘competent authority’ under this statute. Processing of personal data by the MHC The MHC processes personal data and special category personal data. This includes data received by the MHC where data subjects provide information to the MHC directly and personal data received by the MHC indirectly for another source.

Personal data which the MHC processes may include the following:

  • Basic personal information (for example, a data subject’s forename/s and surname, date of birth, approved centre where s/he received treatment or was detained)
  • Contact information (for example, a data subject’s postal address, email address and phone number/s)
  • Any other personal data that is provided to the MHC during the course of the performance of its statutory functions including but not limited to data relating to criminal convictions and offences. 

The MHC processes personal data for a number of different purposes which arise from its statutory powers, functions and duties (see below). We may process personal data provided by you or personal data provided about you from a different source. The MHC is a Data Controller (see definitions above) for all personal data processed for the purpose of carrying out its functions. The MHC decides the minimum amount of personal data it needs to collect from you to allow it to carry out its functions.. The MHC complies with Section 81 of the Data Protection Act 2018 which requires it to document its processing activities (where those processing activities involve the processing of personal data) in a record of processing activities (ROPA). In addition, the MHC has drafted relevant GDPR Policies which it makes available to all staff. The MHC staff, contractors, agents and other third parties are all bound by the rules provided for in the GDPR.

Special Category Personal Data

On occasion, special categories of personal data may also be processed. The MHC takes appropriate measures to protect the confidentiality of your personal data. Service providers that support MHC functions are also required to protect the confidentiality of your personal data and may not use it for any purpose other than carrying out relevant functions pursuant to legislation

Special category personal data which the MHC processes may include the following: 

Data relating to racial or ethnic origin

The MHC is a “public body” under the Irish Human Rights and Equality Commission Act 2014. Section 42 confers duties on the MHC to eliminate discrimination, promote equality of opportunity, treatment and the human rights of its staff members and persons who whom we deliver our services. Accordingly, we may collect data that reveal the ethnicity or race of our services users in the following ways:

  1. The Approved Centres we regulate are required to send us notifications of any restrictive practices that take place in the facility. In particular instances of seclusion and instances of mechanical and physical means of bodily restraint. The notification form contains an “Ethnicity” field which is designed to capture the ethnicity of the patient in receipt of the restrictive practice. The MHC may process this data to see if any ethnic groups are over-represented in the receipt of restrictive practices and, if so, why. This is a non-mandatory field; the selectable options match the ethnicity options available on the national census. As the form does not contain any patient identifiers, it is not attributable to an individual and is processed purely for statistical purposes.
  2. Section 95(1)(a) of the 2015 Act states that one of the functions of the Director of the DSS is to promote public awareness of the Act, to that end, the MHC may process ethnic data to identify under-represented groups who may not have engaged with the DSS. This may inform the Director as to elements of the population where further promotion of the Act is needed. As above this is a non-mandatory field, users will not be required to fill this field to use our services. The selectable options will coincide with the categories of ethnicity in the national census, and it is collected for statistical purposes only.

Data relating to Health

As a regulator of Mental Health Services in the Republic of Ireland the Mental Health Commission will process data relating to health on a daily basis. It may do so in the following contexts:

  1. Quality and Safety Notifications such as child admissions, deaths, incident reports, serious reportable events, overcapacity, operational bed capacity, electro-convulsive therapy (ECT) and restrictive practices. In lieu of names the MHC requests those submitting the forms to input patient identifiers, we discourage the use of initials or the submission of excessive personalised data.
  2. The Inspector of Mental Health Services or any of the Assistant Inspectors may take samples of patient files in order to ensure that their rights are being safeguarded and that the facility being inspected is complaint with the regulations. The names are anonymised before a copy is taken.
  3. The Mental Health Tribunals division will process health related data in the form of admission or renewal papers, reports of the Independent Consultant Psychiatrist 

Data processed by the MHC

  1. Mental Health Acts 2001 -2018.

The MHC carries out the following functions.

  • Inspecting approved centres for the provision of mental health services to ensure they meet the required standards of care for their residents.
  • Establishing panel members for the purposes of the running of a mental health tribunal
  • Arranging mental health tribunals for those involuntarily detained in approved centres.
  • Taking enforcement action against approved centres, where necessary (for example, administrative and legal sanctions).

The following data (which may include personal data and special category data) is processed in the performance of the above functions:

  • Data received from data subjects directly and personal data received from an approved centre which is the subject of an inquiry and/or inspection (this may also include personal data received by the MHC in its role as a ‘competent authority’ under Part 5 of the 2018 Act (‘Processing of Personal Data for Law Enforcement Purposes’)
  • Data received from approved centres, GPs, gardai, and other parties for the purpose of setting up mental health tribunals.
  • Data received from individuals who have raised queries or concerns with the MHC
  • Data obtained from service providers or suppliers engaged by the MHC
  • Job applications, including personal data received from persons applying for panel roles within the MHC.
  • Data received from panel members to ensure compliance with criteria to remain on the panel.
  • Data processed for the purpose of auditing panel legal representative’s files.
  • Data relating to attendees at conferences and events organised by the MHC.
  • Data relating to complaints which have been received as per our Complaints Policy. This includes personal data received from a data subject directly (or through his/her legal representatives) where the data subject makes a complaint to the MHC and any parties referred to within the complaint. 

2. Assisted Decision-Making (Capacity) Act 2015 (as amended)

The MHC carries out the following functions (the Director carries out these functions pursuant to the 2015 Act):

  • Promoting awareness and providing information about the 2015 Act.
  • Regulating and maintaining a register of decision support arrangements.
  • Supervising compliance decision supporters in the performance of the functions.
  • Maintaining panels of suitable persons to act as Decision-Making Representatives and Special and General Visitors.
  • Investigating complaints received under the 2015 Act

The following data (which may include personal data and special category data) is processed in the performance of the above functions:

  • Data received before and during an enquiry and/ or investigation from data subjects directly and personal data received from a third party which is the subject of an inquiry and/or investigation.
  • Data input for the purpose of setting up of a MyDSS account for existing and prospective service users of the DSS. This will include basic contact information and any Decision-Making Arrangements that they are a party to.
  • Data received pursuant to a complaint received under the 2015 Act. This includes personal data received from the complainant and respondent.
  • Data processed for the application and completion of Decision Support Arrangements.
  • Data gathered for the monitoring and supervision of existing Decision Support Arrangements including the receipt of annual reports and accounts from Decision-Making Representatives.

3. The 2000 Protection of Adults Convention (“Convention”) & Part 11 of the 2015 Act.

The MHC carries out the following functions (the Chief Executive as prescribed person, the designated persons and the Inspector carry out their functions under the above Acts):

  • Receipt of a report of an alleged wrongdoing.
  • Carrying out an initial assessment of the report.
  • Request additional information from the reporting person.
  • Communicate with the reporting person by way of acknowledgment of their report, provision of feedback and final outcome of any follow up.
  • Receive reports from and transmit reports to, other prescribed persons and / or the Protected Disclosures Commission.
  • Make enquiries on the report with an internal party for the purpose of carrying out the initial assessment and a decision on what appropriate action to take.
  • Take appropriate action to address the wrongdoing.
  • Provide information to the Workplace Relations Commission, the Labour Court or any court.
  • Publish an annual report and maintain and operate reporting channel

The following data (which may include personal data and special category data) is processed in the performance of the above functions:

  • Data received in a report of an alleged wrongdoing or subsequent information provided by the reporting person or any third party.
  • Data gathered and processed when carrying out any follow-up action.

How does the MHC collect personal data?

Phone calls to the MHC

The MHC does not audio record phone conversations however records / notes may be taken of calls if appropriate.

Emails

All emails sent to the MHC are recorded, forwarded to the relevant section of the MHC and are processed for the purposes of the matter to which the email relates. The sender’s email address will remain visible to all staff dealing with the matter.

Please note: It is the sender’s responsibility to ensure that the content of his/her emails does not infringe the law. Unsolicited unlawful material, together with the details of the sender, may be reported to An Garda Síochána and/or other relevant authorities and further emails from such recipients may be blocked.

Post

Post received by the MHC may be scanned and processed for the purpose of the matter to which the post item relates. Original hard copy versions of post items are retained for a period set out in the MHC’s Data Retention Policy and are then confidentially destroyed thereafter.

Social media

The MHC and the DSS operate separate social media channels. They both receive personal data through its interactions on their social media platforms (for example, X and LinkedIn). The MHC operates accounts on these platforms to promote awareness of its role in the overseeing of mental health services in Ireland and protecting the rights of service users. The DSS operates accounts on these platforms to promote awareness of its roles under the 2015 Act and awareness of options for people who are seeking assistance in making decisions that affect them. Messages and/or posts received by the MHC or the DSS are viewed by MHC staff but personal data contained therein are not logged or stored other than on the relevant social media platform. No further processing of such personal data is carried out by the MHC.

Website 

The MHC website is located at www.mhcirl.ie. The DSS website is located at https://www.decisionsupportservice.ie/ Neither the MHC nor the DSS websites use any third party or persistent cookies. The MHC Cookies Statement can be accessed at the link Cookies Statement | Mental Health Commission . The DSS Cookies Statement can be accessed at the link Cookie Statement | Decision Support Service

MyDSS Portal

The DSS has established an online portal called MyDSS. Any member of the public can set up an account on this platform regardless as to whether or not they are a party to a Decision-Making Arrangement. Through this portal a member of the public can apply to establish a Decision-Making Arrangement, submit an objection to an arrangement application or submit an initial or annual report on an arrangement if they are a party to one. There is an option for users to register and login to their MyDSS account using MyGovID credentials. This is not mandatory. Should you access your MyDSS account in the above manner the MHC will receive basic data relating to you from the Department of Social Protection for the purposes of verifying your identity. For more information on the MyGovID please visit the MyGovID Website .

You may engage with a third party when using your MyDSS platform for the purposes of submitting an application for a Decision-support arrangement. Third parties should only access the MyDSS account of the applicant with their full knowledge and consent. Furthermore, the applicant should be present in person when their account is accessed. 

Microsoft Forms

Data may be submitted on a report of an alleged wrongdoing through Microsoft Forms. Only the prescribed person and designated persons have access to the content of these forms for the purpose of carrying out their functions when dealing with an alleged protected disclosure (see above). 

Legal basis for processing personal data by the MHC

The legal basis for the processing of personal data and special category data, by the MHC will depend on the legislative framework that applies and the purpose for which the processing is being carried out.

GDPR

Article 6 of the GDPR sets out six legal bases on which personal data may be processed. Where the MHC is processing personal data for the purpose of performing its statutory functions, the primary legal bases under the GDPR are as follows:

  • where the processing is necessary for compliance with a legal obligation to which the controller is subject (Article 6.1 (c))
  • where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of an official authority vested in the controller (Article 6.1 (e)).

Legal Enforcement Directive (LED)

The Law Enforcement Directive (LED) deals with the processing of personal data for ‘law enforcement purposes’ by data controllers which fall within the definition of being a ‘competent authority’ for the purposes of the LED, as transposed into Irish law by Part 5 of the Data Protection Act 2018. Section 70 of the 2018 Act defines the scope of processing of personal data which falls within that part of the Act. It states that Part 5 of the Act applies to the processing of personal data carried out ‘for the purposes of (i) the prevention, investigation, detection or prosecution of criminal offences, including the safeguarding against, and the prevention of, threats to public security or (ii) the execution of criminal penalties…’

The term ‘competent authority’ is defined in Section 69 of the 2018 Act as being ‘a public authority, competent for the prevention, investigation, detection or prosecution of criminal offences, including the safeguarding against, and the prevention of, threats to public security.’ For certain processing activities which it carries out, the MHC is a ‘competent authority’ for the purposes of Part 5 of the 2018 Act.

In terms of the legal basis for the processing of personal data by the MHC as a ‘competent authority’, Section 71(2) of the 2018 Act provides that the processing of personal data (for the purpose of the LED) shall be lawful where, and to the extent that:

  • it is necessary for the performance of a function of a controller for one of the purposes specified in Section 70 (as referred to above); or
  • the data subject has, subject to certain requirements set out in Section 71(3), given his or her consent to processing

Who are the recipients of personal data processed by the MHC? 

Disclosure to third parties

Personal data collected by the MHC is held confidentially. It is not shared by the MHC with any third parties with the following exceptions:

Where the sharing of the personal data is necessary for the performance by the MHC of its functions. This may arise, for example, in the context of mental health tribunals where the MHC is required to disclose service user’s identity, health data and related information to the panel members and approved centres. This is required for to ensure the efficient and effective performance of the MHC’s statutory functions. The Decision Support Service is required to maintain a register of certain decision support arrangements. Each register allows certain professionals, organisations and members of the public to confirm whether a decision support arrangement exists, the status of the arrangement and the content of the arrangement.

For the purposes of co-operation with other regulatory authorities. In certain circumstances, the MHC must cooperate with and assist other supervisory authorities in Ireland. In such circumstances, in accordance with the law, the MHC may provide personal data to other authorities such as the Child and Family Agency (Tusla), the Health and Information Quality Authority (HIQA) Safeguarding bodies or any other regulatory body as part of its statutory functions. When this happens, the MHC generally does so on an anonymised basis. If not anonymised, this is in order to protect your rights while you are receiving care and treatment or if you are party to a Decision support arrangement.

In certain circumstances, the MHC may request personal data from an approved centre to carry out an inspection. This is to ensure that the service has appropriate systems and procedures in place to address the care needs of its residents. This data may be used to verify the location of residents who have been transferred to another centre to ensure that appropriate care is taken and to monitor safety and compliance concerns. For the purposes of legal proceedings. Health data or data relating to criminal offences or convictions may be submitted to the MHC in reports prepared by staff and/or independent consultant psychiatrists.

In the event that a matter is brought before the Courts, the materials, including any information, documents or submissions provided by an individual, may be made public in open court.

In the case of service providers or suppliers to the MHC - The MHC uses data processors to provide certain services to the MHC. The MHC requires such processors to abide by certain terms to protect any personal data which is processed by the service provider/supplier during the course of providing the service in accordance with the requirements set out at Article 28(3) of the GDPR

Publication of information

With the exception of the MHC Board and Senior Management names which are published in the MHC’s annual reports and strategic plans and posted on it’s website, the MHC does not publish personal data on its website. Section 8 of the Freedom of Information Act 2014 obliges the MHC, as a freedom of information (“FOI”) body, to establish and maintain an FOI publication scheme. This is updated on a quarterly basis and does not contain personal data other than the above mentioned. The publication scheme is available at the link Freedom of Information Publication Scheme | Mental Health Commission

How long does the MHC retain personal data?

The retention periods for personal data held by the MHC are based on thee purpose for which the personal data is collected and processed. (. The retention periods applied by the MHC are, based on any legal or regulatory requirements to retain information for a specified period, the relevant limitation periods for taking legal action and the data protection legislation (above).

Your data protection rights

Under data protection legislation, data subjects have certain rights. Subject to certain restrictions, which are set out below, you can exercise these rights in relation to your personal data that is processed by the MHC. The data subject’s rights are:

  • The right to be informed about the processing of your personal data
  • The right to access your personal data
  • The right to rectification of your personal data
  • The right to erasure of your personal data
  • The right to data portability
  • The right to object to processing of your personal data
  • The right to restrict processing of your personal data
  • Rights in relation to automated decision making, including profiling

Restriction of data subject rights in certain circumstances

Article 23 of the GDPR allows for data subject rights to be restricted in certain circumstances. In addition, the 2018 Act contains certain provisions dealing with the restriction of the rights of data subjects (in particular, Sections 59, 60 and 61) which give further effect to the provisions of Article 23. General guidance in relation to the application of Article 23 and the related provisions of the 2018 Act have been provided by the Data Protection Commission and are available at the link Your Rights under the GDPR | Data Protection Commission 

Section 60 of the Data Protection Act 2018 provides for restrictions on the obligations of data controllers and on the rights of data subjects for important objectives of general public interest. 

Your right to complain

If you have any concerns in relation to the manner in which the MHC processes your personal data, you may contact the MHC’s Data Protection Officer (details above).

Changes to the MHC Data Protection Statement

This Data Protection Statement is kept under regular review and, consequently, is subject to change. If you have any comments and/or queries in relation to this Data Protection Statement, please contact the MHC’s Data Protection Officer (details above)