Skip to main content

Hit enter to search or ESC to close

1.General

The Residential Tenancies Board (the ‘RTB’) is committed to protecting all personal and special categories of data (also referred to as sensitive personal data) held about you.

Please take the time to read the RTB Privacy Statement (found in the Download section below) as it explains how we collect, use and store your personal data, and the rights you have in relation to the protection of your personal data.

Please note that this Privacy Statement is kept under regular review and we reserve the right to update this Privacy Statement as required. The most recent version of this document can be found in the download section below. 

1.1      Residential Tenancies Board Information

The RTB is a statutory body responsible for (but not limited to) the operation of a national registration system for all residential tenancies, the operation of a dispute resolution service, the provision of both information and policy advice, and completion of research regarding the private rented sector.

You can find more information on our statutory mandate under Section 151 of the Residential Tenancies Act 2004 (RTA) which can be located on the following website: http://www.irishstatutebook.ie

The RTB is the data controller of personal data we collect, or which is collected on our behalf about you relating to our statutory functions referred to above.

If you wish to locate further information on us, this can be done through our website, which can be accessed using the following link: Home Page

1.2      Legislation

All personal data processed by the RTB is processed in accordance with applicable Irish data protection and privacy laws, the General Data Protection Regulation (‘GDPR’) and the Law Enforcement Directive (‘LED’) (where applicable) to ensure we properly protect your personal data.

The GDPR

The GDPR came into force on 25 May 2018, strengthening the rights of individuals and increasing the obligations of controllers and processors. The GDPR is designed to give individuals more control over their personal data. The key principles relating to the processing of personal data under the GDPR are lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability (Article 5 of the GDPR). In Ireland, the national law, which amongst other things, gives further effect to the GDPR, is the Data Protection Act 2018.

The Law Enforcement Directive

The Law Enforcement Directive (‘LED’) deals with the processing of personal data for ‘law enforcement purposes’ by data controllers which fall within the definition of being a ‘competent authority’ for the purposes of the LED, as transposed into Irish law, mainly by Part 5 of the Data Protection Act 2018. Section 70 of the Data Protection Act 2018 defines the scope of processing of personal data which falls within that part of the Act and which falls outside the scope of the GDPR. It states that Part 5 of the Act applies to the processing of personal data carried out

“for the purposes of (i) the prevention, investigation, detection or prosecution of criminal offences, including the safeguarding against, and the prevention of threats to public security, or (ii) the execution of criminal penalties…”

The term ‘competent authority’ is defined in Section 69 of the Data Protection Act 2018 as being, inter alia,

“A public authority competent for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties in the State, including the safeguarding against, and the prevention of, threats to public security”.

For certain processing activities which it carries out, the RTB is a ‘competent authority’ for the purposes of Part 5 of the Data Protection Act 2018 and therefore these processes are subject to the LED.

1.3      Queries and Complaints

If you have a query, concern or complaint regarding a data protection matter or if you simply require further information about the way your personal data will be used by the RTB, you can engage with the Data Protection Officer:

Data Protection Officer

Residential Tenancies Board

PO Box 12323

Dublin 2

Telephone: 01 702 8100

LoCall Number: 0818 303 037

Email: data.protection@rtb.ie              

You have the right to lodge a complaint with the Data Protection Commission, you can engage with the Data Protection Commission in the following ways:

+353 578 684 800
 +353 761 104 800

1.4      Breaches

We will take all appropriate technical and organisational steps to safeguard your personal data. In the unlikely event of a data breach, we will contact you in line with our legal obligations.

2. How do we collect information?

We collect personal data to provide our services to you. This personal data may be collected directly through RTB staff, the RTB website, any applications used by us, or indirectly through a third-party service provider on our behalf.

The following non-exhaustive methods of data collection are an indication of ways in which we may obtain your information:

It is important that the information you provide to the RTB is up to date and accurate. As outlined in Section 7.2 of this statement, if the personal data we hold on you is inaccurate or incomplete, please contact us and we will endeavour to update the data as required.

Please be aware that it is our aim to collect only personal data which is required to perform a task in relation to you. In this regard, please do not provide us with information that is ancillary to these requirements.

What do we use information for?

3.1      GDPR Processes and Lawful Basis

We use personal data collected to fulfil our mandate under the RTA, 2004 (as amended). However, we may use personal data we gather for any of the following purposes:

Process

Purpose

Lawful Basis for Processing

Identity Verification

To verify your (or your authorised representative’s) identity in any interactions between the RTB and you (or your authorised representative), whether in person, on the telephone, online, or in any other necessary circumstances.

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Date of Birth/ PPSN/CRO Verification via API (application programme interface)

To verify your (or your authorised representative’s) identity in any interactions between the RTB and you (or your authorised representative), whether in person, on the telephone, online, or in any other necessary circumstances.

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Evidence Submissions

To gather information for dispute resolution services, Investigations &Sanctions, and legal proceedings.

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Dispute Assessment

To determine the need for dispute resolution services or legal proceedings.

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Investigations and Sanctions Assessments

To determine the need for investigations or sanctions.

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Transfer of Information for Parties Legal Proceedings (Dispute Resolution, Tribunals, Registration Enforcement, Determination Order Enforcement, Investigations& Sanctions)

To allow parties to commence legal proceedings.

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Suspected Non-Registration Referrals

To determine whether a tenancy is registered.

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Referrals and investigation of a suspected breach under Part 7a of the RTA

To investigate potential breaches of rental law by a landlord

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Correspondence (by phone, email, letter, SMS, etc.)

To resolve any queries, requests or complaints related to your tenancy, case or investigation.

To contact you in relation to your RTB360 account.

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Sector Research, Reports and Publications

To provide sector research, reports, publications, information concerning prevailing rent levels, the Public Register, and the Rent Index.

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Processing is necessary for the performance of a task carried out in the public interest.

Court Decision and Determination Order Publication

To provide information about Court Decision and Determination Order

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Recruitment

To recruit and assess prospective employees.

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

Security of premises and individuals on the RTB

 

For the security, and health and safety, of individuals on RTB premises.

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Processing is necessary for the performance of a task carried out in the public interest.

Regulatory Compliance

To comply with financial regulations and any other relevant laws and regulations.

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

Tenancy Registrations

To register tenancies in the form of the Public Register.

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Back-ups

To store personal data and make back-ups of that data in case of emergencies and for disaster recovery purposes.

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Administer Services

To manage and administer any services offered by us, including contacting you.

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Voluntary Accreditation Schemes / Education and Awareness Programmes

To manage and administer services offered by us, including contacting you.

Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller

Limited testing to verify the accurate transfer of personal data across RTB CRM systems

To verify that historical data has been accurately migrated, and to ensure that the structural integrity of data has been maintained.

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Processing is necessary for the performance of a task carried out in the public interest.

3.2      LED Processes and Lawful Basis

The LED deals with the processing of personal data for ‘law enforcement purposes’ by data controllers which fall within the definition of being a ‘competent authority’ for the purposes of the LED, as transposed into Irish law, mainly by Part 5 of the Data Protection Act 2018. For certain processing activities which it carries out, the RTB is a ‘competent authority’ for the purposes of Part 5 of the Data Protection Act 2018 and therefore these processes are subject to the LED.

The legal basis for the RTB to process personal data as a ‘competent authority’ is Section 71(2) of the Data Protection act 2018 which provides that the processing of personal data (for the purposes of the LED) shall be lawful where, and to the extent that:

  1. The processing is necessary for the performance of a function of a controller for a purpose specified in section 70(1)(a) and the function has a legal basis in the law of the European Union or the law of the State….”

    We use personal data to fulfil our mandate under the RTA, 2004 (as amended). The LED may be applicable to the following processes, where the RTB is processing the personal data for the purposes of the prevention, investigation, detection or prosecution of criminal offences:

Process

Purpose

Lawful Basis for Processing

Suspected Non-Registration Referrals

To determine whether a tenancy is registered.

Necessary for the performance of a task carried out for law enforcement purposes by a competent authority

Investigation and prosecution of certain criminal offences under the RTA (as amended) *

To prevent, investigate, detect or prosecute of criminal offences

Necessary for the performance of a task carried out for law enforcement purposes by a competent authority

*An offence under the following sections of the RTA may be subject to criminal prosecution: Section 6 (5); Sections 19 (6A) (6B) (6C); Section 74 (1-2); Section 105 (5A - 5C); Section 106(3); Section 111 (5); Section 112 (2C) (4); Section 113; Section 126 (1) and (3); Section 135B (1-3); Section 143; Section 144 (3) (4) (6); Section 144A (3) (4); Section 145 (3) (5); Section 148M; Section 148Q (3Cii) (4) (5); Section 148S (16C); Section 171 (3) (4) (5); Section 172 (2) (5); Section 185(2); Section 201.

3.3      Special Categories of Data

Where special category data is processed by us for any of the purposes specified above, we will only use the information in the performance of the following functions:

3.4     Processing of Special Categories fo Data

Where we process special categories of personal data, we will only do so for compliance with a legal obligation to which we are subject or where it is necessary for the performance of a task carried out for law enforcement purposes by a competent authority

3.5 Not Providing Information

If you do not provide us with all the information we require, the resulting action may be that we are not able to fully offer you our services.

Furthermore, some services provided by the RTB require certain categories of information, without which, we may not be able to provide you with our service. For example, when registering a tenancy, we will require specific property details and occupancy details.

3.6      Call Recordings

We may record or monitor telephone calls to quality check and improve our processes and services and to improve client satisfaction.

Who do we share information with?

We may share personal data with other parties in the course of our duties. When this is done, we adhere to the following principles:

While the parties we engage may change occasionally, we believe it is important you are aware of the types of parties we share data with. The categories and types of third parties outlined below is a non-exhaustive list but provides an indication of the parties we share data with.

The RTB, as a data controller, will not sell your personal data to any third party.

4.1      Your Representatives

These may include any party you have provided permission for us to contact (such as next of kin or spouse), representatives associated with your tenancy (such as legal representatives or agents involved in your dispute) or other third parties associated with you (such as letting management companies).

4.2      Our Representatives

These may include RTB representatives such as employees, agents, contractors, legal representatives, Board, Adjudicators, Mediators, Tribunal Members and Decision-makers.

Our representatives may also include companies who provide services in relation to recruitment, customer service, postage, data storage and archiving, IT and IT security, making and receiving payments, finances, data analysis, advertising, query and complaints management, and call quality assurance.

4.3      Other Third Parties

Third parties for the purposes of carrying out our function, i.e. case parties, insurance, internal and external audits, carrying out industry research, third parties who may improve our processes and services (such as consultants).

4.4      Government Departments, Bodies or Agencies

The RTB is legally obligated to share personal data with state actors as outlined under the RTA, 2004 (as amended) and the Data Sharing and Governance Act (2019).

Recipients of this data include Government departments (i.e. Department of Employment Affairs and Social Protection, agencies (i.e. Revenue Commissioners), bodies, investigatory bodies, local authorities, the Gardaí and members of parliament (upon request and on a case by case basis).

4.5      Sharing Between Our Departments

To perform our duties, we may need to share information among our internal departments. The following is a non-exhaustive list of circumstances in which information sharing across internal RTB departments may be required:

4.6      International Transfers

We may transfer your personal data (including special categories of personal data) outside of Ireland and the European Economic Area (EEA) to other companies set out in this Section 4, IT providers and other suppliers. The EEA comprises those countries that are in the European Union (EU) and some other countries that are considered to have adequate laws to ensure personal data is protected.

When transferring your personal data outside of Ireland or the EEA, we will (and will ensure that service providers acting on our behalf agree to) protect it from improper use or disclosure and ensure the same levels of protection are in place as are applied within Ireland and the EEA.

What type of information is collected?

To fulfil our statutory obligations and perform duties as outlined in this Privacy Statement, we will collect and process various types of personal data.

While the type of personal data may change occasionally, we believe it is important you are aware of the types of personal data we gather and use. The following table is a non-exhaustive list and provides an indication of the categories and types of personal data we use to perform our duties.

Please note that information listed under one category may be used for the performance of a task or in relation to activities under another heading or as outlined under Section 3.

Category

Type of Data

Legal Proceedings

(Dispute Resolution, Tribunals, Registration Enforcement, Determination Order Enforcement, Investigation & Sanction)

Name, Address, Phone Number, Personal ID, Email, Rental Amount, Number of Beds, Medical certificates, Letting agreement, Evidence of Payment of Deposit, Rent, Inventory and Condition Report on commencement of tenancy and end of tenancy, Witness Statements, Bank Statements, Photographic Evidence, Outstanding Utility Bills, Cleaning or Redecorating Invoices, Warning Notices for Non-payment of Rent, Notices of Termination & Proof of Service if available, Bank Statements, Receipts, Correspondence, Notices of Rent Increase, Information on rent payable for dwellings (similar in size, type, character and location, Rent index), Notices bringing the matter to the attention of Landlord or Tenant, rental history, land registry data, company registration data, Log of Events, Garda Reports,  For Third Party applications - Evidence that Landlord has been made aware of Anti-Social Behaviour of Tenant, Audio Evidence, Video Evidence.

Verification and Searches

PPSN, Personal ID, Utility Bill, CRO Number, (or appropriate company registration documentation), Evidence of purchase of a property / Transfer of deeds, Address, Date of Birth, Gender, Nationality, Previous Company Directorships, Call Recordings,

Tenancy Registrations

Date of Birth, CRO, Licence Number, Number of Occupants, Local Authority, Number of Bed Spaces, Number of Bedrooms, Tenancy Commencement Date, Rent Amount, Credit Card Details, Debit Card Details, Cheques, Bank drafts, Postal Orders, Cardholder Signature, Online Account Number.

Security

CCTV Footage, Visitor Sign in/out.

Sector Research

Age, Employment Status, Country of Origin, Marital Status, Nationality (if non-Irish – length of time in country), Dependents, Living Arrangements, Household Income & Costs, Rental Assistance, Financial Details (renting as source of income, mortgage and whether income covers repayments), Landlord Experience, Property Intentions, Tenant Experience, Notices of Termination, Presentations as Homeless, Awareness and understanding of the RTB services

How long do we retain information?

We will keep your personal data for as long as it is necessary to fulfil the purposes for which it was collected as described above and in accordance with our legal and regulatory obligations. This may mean that some information is held for longer than other information. The criteria we use to determine data retention periods for personal data includes the following:

What are your rights?

As a data subject, you will have the following rights, as outlined in this section. However, restrictions may apply in certain situations, i.e. documentary evidence submissions. Please note that certain data subject rights do not apply under the LED (including the right to object and the right to data portability). There are also further exemptions and restrictions that can be applied to data subjects’ rights. These include avoiding obstruction to official or legal inquiries, investigations or procedures, or avoiding prejudice to the prevention, detection, investigation or prosecution of criminal offences. Requests are dealt with on a case-by-case basis.

7.1      Right of Access (GDPR Article 15 and section 91 Data Protection Act for LED)

You have the right to:

You can request copies of paper and electronic records (including recorded calls, where applicable) about you that we hold, share or use. To deal with your request, we can ask for proof of your identity and enough personal data about you to enable us to locate the personal data you have requested.

When requesting this information, we would be grateful if you could please complete a Subject Access Request Form which can be found here.

When submitting your request, please provide us with information to help us verify your identity, such as a photocopy of your passport and utility bill and as much detail as possible to help us identify the information you wish to access (i.e. date range, subject of the request).

Please note that an access request is free of charge, however, where we determine a request to be unjustified or excessive, we may charge you a reasonable fee.

7.2      Right to Rectification (GDPR Article 16 and section 92 Data Protection Act for LED)

You have a right to request that the personal data held in relation to you is up to date and accurate.

Where information is inaccurate or incomplete, you may contact us to request for the information to be rectified. Upon receipt of request, we will endeavour to ensure that the personal data is rectified and as up to date as is reasonably possible. Please note, in some circumstances requests may not be granted and if this occurs, we will let you know.

As the RTB is both a regulatory and quasi-judicial body, the right to rectification of documentary evidence submissions does not apply.

7.3      Right to be Forgotten (GDPR Article 17 and section 92 Data Protection Act for LED)

You have the right to seek the erasure of personal data relating to you in the following circumstances:

However, we will be unable to fulfil an erasure request if the processing of personal data is necessary for the following:

Please note that the primary legal basis for our processing of personal data is on the basis of a legal obligation, as outlined under the RTA, 2004 (as amended), while additional processing activities are primarily carried out for dispute resolution, investigation under part 7A of the RTA or legal proceedings . In this regard, some processing in relation to your data may not be subject to the right to erasure.

To determine the validity of your request for erasure in line with the associated RTB processing activity, we will carry out an assessment of the justification for retaining your personal data where a legal requirement applies and contact you if we are unable to fulfil your request.

Please be aware that in certain circumstances we may need to retain some information to ensure your preferences are respected in the completion of our duties.

7.4      Right to Restriction (GDPR Article 18)

You have the right to restrict the extent of personal data processed by us in circumstances where:

When processing is restricted, your personal data will only be processed:

We will contact you to confirm where the request for restriction is fulfilled and will only lift the restriction after we have informed you that we are doing so. Please note, in some circumstances requests may not be granted, i.e. processing of personal data for enforcement proceedings cannot be restricted as it is necessary for compliance with the RTA 2004 (as amended).

7.5      Right to Data Portability (GDPR Article 20)

The right to data portability only applies:

Please be aware that our primary legal basis for the processing of personal data is on the basis of a legal obligation, as outlined under the RTA, 2004 (as amended). As such, we carry out minimal processing of personal data on the basis of a contract or on the provision of consent by the data subject and do not currently carry out any fully automated processing of personal data. The right to data portability will most likely apply in very limited circumstances.

7.6      Right to Object (GDPR Article 21)

You have the right to object at any time to the processing of your personal data concerning you which is undertaken on the basis of public interest or legitimate interest by us.

Please be aware that the primary legal basis for our processing of personal data is on the basis of a legal obligation as outlined under the RTA, 2004 (as amended). We have minimal reliance on Public Interest and no reliance on Legitimate Interest as a lawful basis for the processing of your data. The right to object will most likely apply in very limited circumstances.

If you wish to object to the processing of data, please contact us with your request. We will then stop the processing of personal data unless it is required for legal proceedings.

Please note that if you request that the RTB stop processing your personal data, we may be unable to provide you with our services.

7.7      Right not to be subject to Automated Decision Making, including Profiling (Article 22)

You have a right not to be subject to a decision based solely on automated processing or profiling, where such decisions would have a legal effect or significant impact on you. Please be aware that we do not currently carry out any fully automated decision making or profiling using personal data

7.8      Where do I send requests?

Please send all your requests to the contact details provided in Section 1, with as much detail as possible about your requirements to allow us to deal with your request efficiently. To answer your request, we may ask you to provide identification for verification purposes.

7.9      How long will a request take to complete?

Upon receipt of a request, we will comply with the request within the statutory timeframe provided for in the GDPR or the LED as applicable. If we require more time to deal with your request, we will notify you of the delay, and the factors resulting in the delay. If we refuse your request, we will notify you within the relevant statutory timeframe accompanied by the reason for refusal.

We will not charge a fee for any requests, provided we do not consider them to be unjustified or excessive. If we do consider these to be unjustified or excessive, we may charge a reasonable fee (also applicable for multiple copies) or refuse the request.

You are entitled to contact the Data Protection Commission if you have any complaints in relation to the enforcement of your rights.

Our Communications

We may contact you occasionally for information regarding certain aspects of your dealings with the RTB.

This contact will relate to the purposes referred to in this Privacy Statement and may include the following:

 The RTB will endeavour not to contact you outside of usual business working hours.