Privacy and Cookies

Our Role

The Ombudsman for Children’s Office (OCO) is an independent statutory body, which was established in 2004 under the Ombudsman for Children Act 2002. Under the 2002 Act (as amended), the Ombudsman for Children has two core statutory functions:

• to examine and investigate complaints made by or for children about the administrative actions, or inactions, of public bodies
• to promote the rights and welfare of children up to the age of 18.

Purpose of the OCO’s Privacy Statement

The OCO needs personal data to fulfil its roles and to meet its legal obligations. The OCO processes (including collecting, storing and sharing) personal data about staff and about individuals who contact the OCO, take part in the OCO’s work to promote children’s rights and welfare or are involved in the OCO’s examination or investigation of complaints.

This privacy statement sets out how the OCO uses and protects your personal data, including data collected by us from your use of our website.

Information about the OCO as Data Controller

The OCO is the Data Controller for personal data. The OCO has divided our data processing into categories so that we can give you more information about our processing. The categories are:

 

• children
• individuals involved in the examination or investigation of complaints
• promoting children’s rights and welfare
• promoting the work of the OCO
  • website visitors
  • social media
  • press/media and OCO contacts list
  • events and workshops
  • photographs, video and audio recordings
• CCTV
• job applicants and staff

More information about our data processing for each category is available below.

We do not trade personal data for commercial purposes and will only disclose personal data if required by law, if it is necessary to arrange your attendance at an OCO event, or if it is with your consent. OCO uses providers based in the European Economic Area to process data.

This privacy statement has regard to the General Data Protection Regulation (GDPR), which came into force on 25 May 2018.

If you have any queries about how we process your personal data, you can contact us by:

• emailing us at oco@xpertdpo.com
• phoning us on (01) 8656800
• writing to us at Ombudsman for Children’s Office, Millennium House, 52-56 Great Strand Street, Dublin 1, D01 F5P8

Children

Under a law called the Ombudsman for Children Act 2002, the OCO has two jobs:

• to investigate complaints made by or for children about public organisations, schools and hospitals
• to promote the rights and welfare of children up to 18 years old.

We may need to know personal information about you to do these jobs. Examples of personal information we might need are your name, date of birth, address, and who your parents or guardians are. If we would like to take photos of you (for example, photos to use for raising awareness of children’s rights or our work), we will ask permission from your parents and you. More information about this is in the ‘Photographs, Video and Audio Recording’ section below.

We use personal information about you to help us understand how we can help you and to do our jobs. We keep this information safe in our office and only share it with the people who need to know. If we don’t get all the information we need, then we may not be able to do our jobs.

We keep your personal information for no more than three years after we finish the work that we need this information for. Where you are involved in a complaint we are dealing with, we keep a short record of what happened until you are 23 years old. This is so you can understand what happened as you may not remember when you are older. If your brother, sister or another child is involved, then we keep the shorter record until the youngest child is 23 years old.

You have rights over your personal information. You have the right to:

• make sure the personal information we have about you is correct
• ask us to delete your personal information
• object to how we use your personal information
• get a copy of your personal information from us
• complain to the Data Protection Commission if you think we have not kept and used your personal information correctly.

Individuals involved in the OCO’s examination and investigation of complaints

The OCO has a statutory obligation to examine and investigate complaints made by or on behalf of children in relation to the administrative actions of reviewable agencies. These agencies are mainly public bodies such as Government departments, state agencies, schools and voluntary hospitals. We can also investigate other bodies, such as voluntary and charitable organisations, depending on their funding relationship with the Government.

The OCO collects personal data about the complainant (the person who makes the complaint), the children involved, the family and guardians of the children involved and the people who work at the agencies involved in the matter.

The OCO has statutory powers to request relevant information from relevant agencies and this information may contain personal data.

The OCO may also request information, including personal information, from parents, guardians and children. Failure to provide the information or personal data may mean that we are unable to examine or investigate a complaint.

The types of personal data collected may include: names, addresses, contact details, dates of birth, gender, medical information and other special categories of personal data. We may also request personal records held by the public bodies concerned if we need these to examine or investigate a complaint. Examples of these records can include school records, housing records, detention records, medical information, statutory care plans and child protection records.

The OCO attempts at all times to minimise the information we request from members of the public and public bodies. We only request the personal data we need to examine or investigate a complaint. The OCO is sometimes sent personal data that we have not requested. Where we identify such circumstances, we return the personal data to the sender.

We keep all personal data obtained for the purposes of examining or investigating a complaint in a file for three years after we have completed our work on the complaint. If there is no indication that we need to keep the original personal data, then we will produce a shorter record of what happened with relevant anonymised evidence. We keep a shorter record of what happened until the child who the complaint concerned is 23 years old. This is so the child can understand what happened as they may not remember. If there is more than one child involved, then we keep the shorter record until the youngest child concerned is 23 years old.

There are lawful restrictions to the right of access to information where this information relates to the examination or investigation of a complaint. You may have a right of access to your personal data from the public body who supplied personal data to us.

Promoting Children’s rights and welfare

The OCO has a statutory obligation to promote the rights and welfare of children up to 18 years old. The OCO’s duties to promote children’s rights and welfare include:

• finding out what children and young people are concerned about and highlighting their views to the Government and other people who make decisions that affect children and young people
• supporting people, including children and young people, to find out about children’s rights and how children’s rights can be respected, protected and fulfilled
• giving advice to Ministers of Government and others on laws and public policies relating to children’s rights and welfare
• encouraging public organisations to work in ways that promote children’s rights and welfare
• carrying out research about issues to do with children’s rights and welfare.

The OCO engages with children, young people, professionals and members of the public to implement these duties. We collect personal data about people as necessary and appropriate. The personal data may include: name, address, age, and personal circumstances, including special categories of personal data such as health, sexual orientation, religion and relevant medical information (for example, information about dietary requirements if we provide food at OCO events). We aim to minimise the personal data we collect and to anonymise it shortly after it has been collected where necessary and possible. Where the personal data is not anonymised, we retain it for a maximum of 3 years before destroying or deleting it.

We may contract a research body to do research for us about issues relating to children’s lives and children’s rights that we want to learn more about. Usually, the research body is the data controller and they are responsible for how they process any personal data involved. The OCO receives an anonymised report at the end of the research.

Promoting the work of the OCO

We promote awareness of our work in a number of ways. These include through our website, social media, publications (including our Annual Report), press/media and OCO contacts list, public speaking, events and workshops at our offices and other locations.

Website visitors

We use Google Analytics (GA) to track site user interaction on our website. We have a GA code installed on our site which creates one or more text files on your computer (called a “cookie”). The cookies contain an ID number, which is used to uniquely identify your browser and track each site you visit that has GA enabled.

We use this data to find out the number of people using our site and to better understand how they find and use our web pages. With this information, we can continually improve the information that we provide on our website and the processes for actions such as contacting us. We can also use it to increase the number of new people finding our site.

Google analytics stores the following data:

• Time of visit, pages visited, and time spent on each page of the website
• Interactions with site-specific widgets
• Referring site details (such as the URL a user came through to arrive at our site)
• Type of web browser
• Type of operating system (OS)
• Flash version, JavaScript support, screen resolution, and screen color processing ability
• Network location and IP address
• Document downloads
• Clicks on links leading to external websites
• Errors when users fill out forms
• Clicks on videos
• Scroll depth

Google also collects information about you from its Doubleclick tracking and profiling service, from ad-supported apps on your Android or iOS device, from your YouTube and Gmail activity and from your Google account. This data is put together and used to make inferences about your age, gender, interests, hobbies, shopping habits and living circumstances.

Your rights

If you already have GA cookies, they will be updated with the latest information about your visit to our site.

As we cannot access any personal data about you ourselves, we are not the Data Controller for your Google Analytics or Doubleclick profile data. You would need to contact Google directly for this information.

You have the right to object to this tracking and to stop it happening. See the next section.

If you would like more information about the methods used by us, please contact us at oco@oco.ie.

How do I prevent being tracked by Google Analytics?
If you are uncomfortable with this tracking, you can take the following actions:

• use a tracking-blocker
• clear cookies after every browsing session
• install the Google Analytics opt-out extension

Website Contact Form Users

We have two different online contact forms on our website:

Online Workshop Booking Form

If you wish to use our website to book a workshop on children’s rights, please use our Online workshop booking form. We need the personal data you provide on this form to follow up with you about your booking and to help us make workshop arrangements that meet your needs and the needs of workshop participants. The OCO will retain this information for a maximum of 3 years after the workshop

Online Complaint Form

If you wish to use our website to make a complaint, please use our Online Complaint Form. We save the details you share with us on our database. We use the data that you give us to work out how we can answer the complaint you have raised with us. We also use the data to follow up with you about your complaint.

For more information on how we use personal data provided in relation to complaints, please see the section above on ‘Individuals involved in the OCO’s examination and investigation of complaints’.

More information on our role to examine and investigate complaints is on our website. If you have any questions about making a complaint, you can also phone us on Freephone 1800 20 20 40 or email us at ococomplaint@oco.ie.

 

Social Media

You may come across the OCO on Facebook, Twitter, Instagram, YouTube, Vimeo and AudioBoom through your own networks or by linking to them from the OCO website. We use these platforms to inform, educate and engage people about the rights of children and our work.

The OCO does not process personal data from social media platforms.

We use social media platforms because they are a valuable tool for us to raise awareness of the work we do with different audiences. The companies who own these social media platforms are commercial entities. We want to remind you that information shared by you on our timelines, on pages or in private messages on our social media may be used or sold by these companies for commercial purposes.

Press/Media and OCO Followers Mailing Lists

OCO uses a media partner, MediaHQ, to publish news and information about the OCO. Our media partner builds its contact list from registrations to their website. We are not responsible for their activities and you should contact our media partner directly for further information and to invoke your data rights.

OCO maintains a contacts list of stakeholders who we share news about the OCO with. This is done in our legitimate interests of promoting the rights and welfare of children. If you are on our contacts list, you can click ‘unsubscribe’ at any time.

OCO Events and Workshops

When you attend an OCO event or workshop, we may need your name and contact details so that we can contact you about the event or workshop. We also collect dietary information where we are providing food. We process this information in our legitimate interests. Where we collect special categories of data, then we will require your consent.

When you book a workshop through our website, we ask you to provide certain information so that we can follow up with you and make arrangements that meet your needs and the needs of workshop participants (see ‘Online Workshop Book Form’ above for more information).

For OCO events and workshops, we request consent for group and individual photographs to be taken so that the OCO can raise awareness of the work we do – please see the section on ‘Photographs, Video and Audio Recordings’ below. If you and/or members of your group do not consent to having pictures, video or audio recordings made at an OCO event or workshop, then that’s your right. You and members of your group are still welcome to come to the event or workshop.

The OCO will retain this information for a maximum of 3 years after the event or workshop.

If you are a speaker at an OCO event, we will publicly promote your involvement through social media platforms and communication with press/media. This data may continue to be processed by those platform providers after the event has ended. We will only do this if we have obtained your consent for this processing. If you are under the age of 18, then we will need the consent of your parent/guardian as well as your permission to use your personal data for promotion of the event.

If you wish to book a room in our offices for a private event by an organisation you work with or are involved with, we just need your contact details so we can follow up with you in relation to your request.

 

Consent and Assent 

OCO captures your consent or assent to attend our workshops using a webform. You will be invited to sign your consent via an email that will bring you to a DocuSign webform. The webform will use your and your child’s name, email address, electronic signatures, IP address and consent timestamps. You can sign the OCO document online and there is no obligation to create a DocuSign account or accept their cookies. Where children under 18 use DocuSign, it is important that the parent/guardian is made aware of this feature so that the child can be encouraged to ignore this system invitation. The data captured will be downloaded to our own network and reduced to the data that we need, namely, event, name, consent/assent & timestamps. The original data will be removed from DocuSign after 3 months. The remaining data will be retained for 3 years within our network.

Photographs and Audio Recordings

When you attend an OCO event, please be aware that we may use group or crowd images from the event in our annual report, other OCO publications, on our website and in social media. This is done in our legitimate interests to promote the OCO’s work.

We may also take photographs, video or audio recordings that identify individuals. We will process photographs, video and audio recordings that identify you only where you have given your consent for the use of such photographs, video and audio recordings. If you are under 18, we will process photographs, video and audio recordings that identify you only where we have the consent of your parent/guardian and your permission.

Where we have consent, then names, photos/images, video and audio may be disclosed to printers, website design/management partners, and social media platforms and through corresponding OCO publications, websites and social media accounts.

The OCO will retain these photographs/images, video and audio recordings for 3 years.

CCTV

The OCO has a CCTV system operating in our offices. This personal data is processed in our legitimate interests for crime prevention, the prevention of anti-social behaviour, for the safety of our staff and for the protection of the OCO and its property. We keep the images for 30 days.

The landlord of our building also maintains a CCTV system. The OCO has no responsibility for the landlord’s CCTV system.

Job Applicants and Staff

The OCO uses Sigmar Recruitment to recruit people for jobs with the OCO. Information about how Sigmar Recruitment uses and retains personal data is available in its privacy statement. If you are applying for a job with the OCO through Sigmar Recruitment and have any queries about how Sigmar Recruitment processes your personal data, you should contact Sigmar Recruitment directly.

Where the OCO establishes a panel for a permanent position of employment with the OCO, the personal data of candidates placed on the panel will be retained by Sigmar Recruitment for the duration of the panel (maximum 2 years). Once a given panel expires, the personal data of candidates on the panel will be destroyed or deleted.

If you begin employment with the OCO, we will put together a file about your employment. We keep the information in this file securely, and will only use it for matters that apply directly to your employment. This may include name, contact details, date of birth, next of kin name and contact details, attendance records, leave, salary records, bank account information and taxation data.

Selected personnel records of staff may be disclosed to other Government Departments for mobility / promotion / statistical purposes. Personal details of staff are disclosed to and retained by the OCO’s accountants for payroll and auditing purposes and with our banks and Revenue.

Once you stop working for us, we will keep your personnel file according to our record retention guidelines. You can contact us to find out more about this.

Your Data Rights

As an individual, you have the following rights:

• the right to be informed (which is what this privacy statement is for)
• the right to access the personal data held about you, subject to lawful restrictions
• the right to object to direct marketing
• the right to object to processing carried out on the basis of legitimate interests
• the right to erasure (in some circumstances)
• the right of data portability
• the right to have your personal data rectified if it is inaccurate
• the right to have your personal data restricted or blocked from processing

If your personal data is processed based on your consent, you have the right to withdraw your consent at any time.

To exercise any of these rights, please contact us using any of the options in the ‘How to contact the OCO’ section below.

If you are not happy with the way the OCO has handled your personal data, and are unable to resolve the issue with us personally, you have a right to complain to the Data Protection Commission.

How to contact the OCO

If you have any queries relating to OCO’s processing of your personal data or if you wish to exercise any of your rights as a data subject, you can contact our Data Protection Officer (XpertDPO) by:

• emailing oco@xpertdpo.com
• phoning (01) 8656800
• writing to Ombudsman for Children’s Office, Millennium House, 52-56 Great Strand Street, Dublin 1, D01 F5P8.