1. Introduction

1.1 Raidió Teilifís Éireann (RTÉ) is a statutory body and Ireland’s National public service media organisation governed by the Broadcasting Act 2009 (the “Broadcasting Act”). In this role RTÉ processes Personal Data which is necessary for the performance of RTÉ’s public interest role as set out in this Privacy Policy and in accordance with section 114 of the Broadcasting Act.

1.2 This is the Privacy Policy of Raidió Teilifís Éireann, RTÉ Commercial Enterprises DAC, and any of their affiliates, including RTÉ Transmission Network DAC trading as 2rn (together “RTÉ”) and replaces previous iterations of this policy. The purpose of this Privacy Policy is to outline RTÉ’s policy concerning the collection, use, retention, disclosure and transfer of Personal Data which is gathered and processed by RTÉ. This Privacy Policy also sets out RTÉ’s information management practices.

1.3 RTÉ respects the privacy of all those individuals whose Personal Data it comes into contact with, which in particular includes the following:

(a) all users of the RTÉ website (i.e. the RTÉ desktop and mobile sites), RTÉ social media pages and apps and other RTÉ services (whether on-air or online);

(b) RTÉ employees and contractors (including applicants for employment with RTÉ);

(c) all members (including former employees) of RTÉ sponsored pension schemes;

(d) RTÉ business contacts and suppliers; and

(e) individuals whose Personal Data is provided to RTÉ in the form of content for editorial, content creation, journalistic purposes (including those who contribute content for live discussion or other purposes including audience participation).

1.4 For each of these categories of individuals, this Privacy Policy will explain why RTÉ collects and how RTÉ uses the Personal Data it collects. RTÉ will ensure that it keeps all Personal Data provided to it in accordance with RTÉ’s obligations under applicable data protection laws. RTÉ will update this Privacy Policy from time to time to reflect any material changes in technology, legislation or RTÉ’s data use practices which may materially affect the way in which RTÉ processes Personal Data.

1.5 This is not an exhaustive statement of all of RTÉ’s data protection practices and RTÉ may apply specific policies within certain environments. For example, a separate policy exists for Saorview (which, while broadly consistent with this Policy, may contain certain variations). The GAAGO service also has its own separate privacy policy which you should refer to if using GAAGO. In addition, RTÉ might include a separate privacy notice at the point of capturing data on a new service and any specific consents obtained or information provided in this way will apply specifically to that service and will supplement this Policy. RTÉ may also introduce additional user choices on our online platforms which will be clearly explained to users as required by data protection law. This Policy should also be read in conjunction with other relevant RTÉ policies, e.g. the RTÉ Public Service Statement which is available <here>. RTÉ, as a broadcaster, is also subject to the codes and standards of the Broadcasting Authority of Ireland, which are available <here>, and will process Personal Data in accordance with those codes and standards. RTÉ is also subject to the rules of ComReg.

2.What is Personal Data?

2.1 Personal Data is any information relating to a living individual that allows for the identification of that individual. Personal Data can include a name, address, contact details, an identification number, IP address, CCTV footage, access cards/co-tags, audio-visual or audio recordings of a person, details about an individual’s location or any other detail(s) specific to that individual.

2.2 In circumstances where an RTÉ entity controls Personal Data by deciding why and how that Personal Data is processed, RTÉ will be a “Data Controller”. Any entity that processes Personal Data controlled by RTÉ and does so on behalf of RTÉ, is a “Data Processor”. Data Processors may include third party service providers engaged by RTÉ (for example communications providers, payroll and marketing or recruitment agencies). As required by applicable data protection law, when RTÉ appoints a Data Processor, RTÉ will ensure that appropriate contractual protections are in place.

2.3 In some circumstances RTÉ will engage with third parties in circumstances where RTÉ and the third party are ‘Joint Controllers’ of personal data, that is, RTÉ and the third party will jointly decide why and how personal data is collected. In many of these circumstances, RTÉ and the third party will also be ‘Independent Controllers’ of personal data, that is, both RTÉ and a third party will independently decide why and how certain personal data is processed for their own purposes. For example, where content is produced independently of RTÉ, the third party producer shall usually be an Independent Data Controller of much if not most of the personal data it processes, and as such, it is the privacy policy of such third party producers that will govern the collection and processing of Personal Data prior to broadcast. Where content is co-produced, RTÉ and the third party producer may be both Independent and Joint Controllers of personal data collected for that project. In such situations, it may be necessary for RTÉ to share Personal Data with the third party producer and vice versa. Similarly, when content on RTÉ online is shared or posted by users on social media platforms, then those platforms will independently decide what to do with the data collected from such activity, subject to their own platform terms and conditions and the privacy settings placed by users on their social media accounts.

3. RTÉ Website, Social Media and Apps (RTÉ Online)

3.1 This section of the Privacy Policy sets out the type of Personal Data collected by RTÉ, the purposes for which such Personal Data is collected and processed and the lawful justifications for such processing in the context of the RTÉ website (www.RTÉ.ie) and apps (including, without limitation, RTÉ Player). Please see the section titled ‘RTÉ Account’ at paragraph 3.3(a)(iv) below in relation to when a user subscribes to an RTÉ Account.

3.2 RTÉ is not responsible for the privacy practices of any external websites, device manufacturers or platforms which may be accessed or used in connection with a person’s use of the RTÉ website, RTÉ social media pages or apps. They are subject to their own privacy statements which may materially differ from those of RTÉ so users should review them for further information.

3.3 What Personal Data does RTÉ collect and use online?

(a)  RTÉ collects various types of Personal Data when a person uses RTÉ Online. The following are examples of Personal Data collected by RTÉ:

(i)   Competitions: When a person enters a competition, RTÉ may collect and use the entrant’s name and contact details (including postal address, email address, telephone number) in connection with the competition (including mobile competitions). Where RTÉ operates competitions in conjunction with a third party commercial partner, subject to the competition rules and notices, that partner may collect and use the data.

(ii) Programme Participation, Audience Participation and Ticketing: When a person engages with RTÉ to participate in a RTÉ programme (as an audience member or as a contributor) or to obtain tickets for a RTÉ programme or event, RTÉ may use the individual’s name, contact details (including postal address, email address, telephone number) and such Personal Data (which may include special category data) disclosed by the individual in order to process applications for tickets or applications to participate in such programmes.

(iii) Social media pages: Content such as messages, video footage and photographs, that is posted on social media pages operated and managed by RTÉ or on which RTÉ has a presence may be made publicly available and may be used in connection with the operation and promotion of RTÉ, including RTÉ Online and television and radio programmes. If content is posted that is deemed to be in breach of this Privacy Policy (or the RTÉ Notice and Take Down Policy), or the policies operated by such websites, social media platforms or apps, such content may be removed by or at the request of RTÉ or the operators of those social media websites. If such inappropriate content is posted to a social media page that RTÉ controls it can be reported at the following address info@rte.ie and RTÉ will endeavour to ensure that appropriate action is taken in accordance with the RTÉ Social Media Guidelines and/or policies of the relevant social media platforms. RTÉ and the relevant social media company are joint controllers of the Personal Data that you make available on RTÉ controlled social media pages.

(iv)  Website (www.rte.ie): When a person engages with RTÉ.ie many of the RTÉ.ie pages include embedded content and products from social media companies, such as Facebook, Instagram, Twitter, LinkedIn, YouTube etc. Your Personal Data may be collected by and/or shared with the relevant social media companies and used in accordance with (a). the policies of the relevant social media platforms, which you should familiarise yourself with and (b). this policy and RTÉ’s Cookies Policy. That personal data is collected or otherwise processed when you either consent to the use of relevant tracking cookies pursuant to RTÉ’s cookies policy or where you engage with such social media content on RTÉ’s website. For example, most of the web pages on www.rte.ie have social plug-ins enabled whereby you can share RTÉ content on those platforms (Facebook, Instagram, Twitter, LinkedIn, YouTube etc). When you do so, those social media companies can collect information about you including, for example, the fact that you have shared that content, online identifiers such as your IP address etc. RTÉ engages with such providers in order to engage with audiences, capture aggregated, analytical information about our audiences and users of our products and, where consent has been obtained, to serve targeted advertising and to improve ad delivery, personalise features and content for users.

(v)  RTÉ Account: To access certain features and functions across the range of RTÉ’s websites and mobile services users are required to register an RTÉ Account. This enhanced service is known as RTÉ Account and allows registered users to have a more personalised experience when accessing and interacting with RTÉ’s online services and content. By registering and signing in to RTÉ Account, users can easily access all available features and functions across the range of online services with a single Account. Further details of the benefits of an RTÉ Account can be accessed here (https://www.rte.ie/id/about/).When users register an account with RTÉ, they will be required to provide certain information including their year of birth. This is required in order to ensure that RTÉ is engaging in a contract with an individual who aged 18 years or more.

When users create an RTÉ Account , RTÉ may also collect and use your name, contact details, gender, IP address, browser, operating system and the device used (including its location) and details regarding the particular RTÉ website accessed, RTÉ social media pages and app usage (e.g. pages visited and time and date of pages visited together with the actions taken by the user). This information is collected and processed to provide users with extra benefits (including seamless viewing of the RTÉ Player across multiple devices, email updates on content relevant to you and access to exclusive competitions). RTÉ may also record which users opened and clicked the embedded links in the communications sent by RTÉ in order to measure a campaign’s effectiveness.

 

There are certain services which require the collection and processing of a greater amount of Personal Data (including special categories of Personal Data), and in such cases, separate additional rules may apply. If a user has signed up to an RTÉ Account, RTÉ may combine your account information with other information that RTÉ has collected about you using cookies, web beacons, device identifiers, social plug-ins, tracking pixels, etc., further to RTÉ’s Cookies Policy (for further information on RTÉ’s use of cookies and other similar technologies please refer to the RTÉ Cookie Policy). For users who want to control the use of cookies etc. see the section titled ‘Changing Your Preferences’ at paragraph 4.4 below.

 

Users can also register an RTÉ Account using their Facebook, Google or email login details. When you do this, your Personal Data will be shared with these companies for their own purposes in accordance with their privacy policies and the privacy settings you have set on that platform .

 

(vi) RTÉ Apps: RTÉ Accounts will also be used by RTÉ to collect and use details regarding the app usage of users of RTÉ apps, including the RTÉ Player app and RTÉ News. Such details may include the time and date that the app is opened and closed, what content was viewed and the duration of the app session. Using this information enables RTÉ to generate statistical reports, such as to measure the popularity of content or to look at ways to improve service. When users choose to receive in-app push notifications, RTÉ may also use this information to send such users customised in-app messages regarding RTÉ services. For further detail on marketing communications, please refer to section 4: Advertising and Marketing. Subject to user consent, RTÉ may use the data for users to receive communications about commercial partners. RTÉ may also verify the location of a user’s device while using the RTÉ Player. This is because there are territorial restrictions on the use of certain RTÉ content. All of this information is linked through the relevant user accounts (such as Apple App Store or Google Play Store). Users may be able to use their device settings to prevent RTÉ from verifying their device’s location. However, in that case, use of that specific app may be impaired or discontinued.

3.4 The purposes and lawful justifications for RTÉ’s data processing

(a)  RTÉ collects and processes the Personal Data described above for a variety of purposes. As required by data protection law, below is a summary of these purposes and the lawful justifications that support them:

Purpose	Lawful Justification
Service delivery, management and improvement e.g. to identify content which is most popular among users of RTÉ services, to promote such content to RTÉ users in a customised manner and to restrict the use of RTÉ services in territories where restrictions apply to its use.	Such processing is necessary for RTÉ to meet its statutory obligations and to provide the relevant services.
To evaluate users’ interests and viewing preferences, and to promote tailored offerings and content that reflect user preferences and interests.	RTÉ has a statutory function under the Broadcasting Act in providing comprehensive content reflecting the diversity of interests of the whole island of Ireland.
To evaluate users’ interests and to deliver tailored advertising based on user preferences and interests.	RTÉ has a statutory function under the Broadcasting Act to exploit commercial opportunities arising out of statutory obligations.
Using content provided by individuals on RTÉ social media pages.	RTÉ rely on individuals’ consent for these uses. If a user wishes to withdraw consent to the processing of any content posted by them on RTÉ social media pages, they can contact RTÉ’s Data Protection Officer (see paragraph 16 below).
Competitions, surveys, polls or draws.	It is necessary to process data to operate the relevant competitions, surveys, polls or draws. Additional uses of the data may arise where consent has been provided under the relevant competition rules.
Purchases from RTÉ or its commercial partners (for example, the RTÉ Guide).	RTÉ needs to process Personal Data to perform the relevant purchasing contract between RTÉ and the user.
Service administration e.g. providing individual users with password reminders or providing notifications of a change in services.	Such processing is necessary for the provision of the service to which the user has signed up and to support performance of RTÉ’s statutory function in managing the delivery of its services; and as necessary for the contractual performance of contract between RTÉ and the user. RTÉ has a statutory function under the Broadcasting Act in providing personalised services and customised content, including for example, tailored content to RTÉ Account users. In performance of this function, RTÉ balances such interests against the rights of individual users through the use of the measures described in this Policy.
Maintenance of RTÉ Archives.	RTÉ has statutory archiving obligations under the Broadcasting Act as well as a public interest in maintaining its archives and records for public interest, historical or research purposes.
Communicating with and maintaining contact details of business contacts and suppliers.	As necessary for the performance of the relevant contract with such business contacts and/or suppliers and otherwise in order to enable RTÉ to perform its statutory public interest objectives, which necessarily requires that RTÉ engage external service providers.
General correspondence with members of public (by post or RTÉ email address) for example where an individual sends correspondence to RTÉ to comment on content of broadcast or for other miscellaneous reasons.	For the particular purpose for which the correspondence is sent to RTÉ. Depending on the particular context of such correspondence the relevant lawful basis will likely be either the individual’s consent or performance of RTÉ’s public interest objectives.
For audience ticketing and audience participation purposes, which may from time to time include special categories of Personal Data including but not limited to data revealing individual’s religious or philosophical beliefs, health data, trade union membership or data revealing sexual orientation or details of sex life.	Such data will be processed for the purpose of meeting RTÉ’s public interest objects under section 114 of the Broadcasting Act, which in particular refers to RTÉ’s object to provide a comprehensive range of programmes that “reflect the cultural diversity of the whole island of Ireland”, that “inform and educate” and to “provide programmes of news and current affairs”. Having regard to the importance of the right of freedom of expression and information in a democratic society, such processing is therefore necessary and proportionate in relation to RTÉ’s journalistic expression in performing its express public interest objects under the Broadcasting Act 2009.

 

4. Advertising and Marketing

This section of the RTÉ Privacy Policy sets out how RTÉ may use Personal Data for marketing and online advertising purposes.

4.1 Marketing communications

If a person provides consent for marketing communications RTÉ may use their name, address, email address, postal address and/or telephone number for marketing communications. For example, you may sign up to receive email communications at the end of an article on www.rte.ie/news or with your RTÉ Account. Users who have chosen to receive in-app push notifications will also receive marketing communications in that way. RTÉ will not contact users by post, email, phone or SMS for direct marketing purposes unless the users have consented to be contacted for such purposes as required by data protection laws. Users can opt-out of receiving direct marketing communications from RTÉ by following the unsubscribe link in the relevant marketing message.

If you signed up to marketing communications with your RTÉ Account, RTÉ may combine this data with information (including your device’s location) collected through cookies, web beacons, your device identifier etc. This is so that RTÉ can provide you with marketing communications that are relevant to you based on your preferences. We collect this information for internal purposes only to allow RTÉ to glean insights into users marketing consumption e.g. for email engagement, open rates, click through rates, unsubscribe, type of content that is most popular etc., in order to help RTÉ better serve users in the future based on the content that interests RTÉ’s users. For further information on RTÉ’s use of cookies and other similar technologies please refer to the RTÉ Cookie Policy.

If users sign up to receive marketing communications from RTÉ’s partners and provide their contact details to RTÉ for such purposes, RTÉ may provide their name and contact details (e.g. email or mobile number) to RTÉ’s commercial partners (such as organisations that are partnering with RTÉ in relation to the provision or sponsorship of TV programmes) so that they can send you marketing communications. RTÉ will not provide such information to third parties for direct marketing purposes unless the users have consented to RTÉ giving their Personal Data to third parties for that purpose. If a user opts-out from receiving communications from our partners, RTÉ will no longer share that user’s contact details with our partners. However, users will still need to directly opt-out from communications from the partners to whom we have already given their information. For further detail see 4.3 below.

 

RTÉ uses third party service providers to help deliver its marketing communications. Those third party data processors are subject to contractual and legal restrictions in relation to any unauthorised use of your information.

 

4.2 Re-Marketing

Re-marketing is a form of online targeted advertising by which online marketing is targeted to consumers based on their previous browsing actions. RTÉ uses site-based re-targeting techniques to provide advertising for RTÉ content to visitors to the RTÉ website once they have left the RTÉ website. Such advertisements may appear on other websites and social media sites to keep you informed about relevant RTÉ programmes, services and events. RTÉ may also work with technology partners to generate “look-a-like” audiences for promotion of RTÉ programmes, services and events.

For example, RTÉ may integrate social media pixels or Google pixels across its online services and target: (i) all website visitors; (ii) visitors who have watched specific shows; and (iii) visitors who have visited specific content on the RTÉ.ie website via social networks (for example, such as Facebook). RTÉ carries out such activities on the basis of user consent pursuant to its Cookie Policy which can be viewed here..

 

4.3 RTÉ Account

If you have signed up to RTÉ Account, RTÉ may combine information (including your device’s location) collected through cookies/web beacons such as your device identifier with your RTÉ registered account and profile. This is so that RTÉ can provide you with extra feature benefits on RTÉ services. RTÉ collects information for internal purposes only to allow RTÉ to glean insights into your usage behaviour (e.g. what webpages viewed, time spent on articles, the type and number of videos watched in order for RTÉ to better serve users in the future with more relevant content via the website and through marketing).

 

4.4 Online advertising

By using RTÉ online services and apps RTÉ may use information gathered from you, and information gathered from third parties, to provide RTÉ’s users with certain tailored advertising offerings through the RTÉ website and other services. RTÉ gathers web viewing Personal Data from users across its various services, which may then be used by RTÉ and its service providers to deliver advertising to particular groups of users based on the preferences or interests inferred from the data collected and processed by RTÉ’s (or a third party service provider’s) technology. For example, RTÉ uses cookies, web beacons and similar technologies to collect information from a mobile or other device further to RTÉ’s Cookies Policy (for further information on RTÉ’s use of cookies and other similar technologies please refer to the RTÉ Cookie Policy). Should a user register for an RTÉ Account and consent to receive communications about RTÉ’s commercial partners, RTÉ may then combine a user’s account information with this information collected by RTÉ, or third parties, about the user to assist RTÉ and its partners to provide advertising based on your preferences and viewing patterns. RTÉ may also measure what users opened and whether users clicked the links embedded in advertising communications to measure a campaign’s success. This may also be used to ensure effectiveness in delivery and to permit RTÉ to control the frequency of delivery of advertisements.

 

4.5 Content recommendations and promotion

Where users have created an RTÉ Account, RTÉ will collect certain information by using cookies, social plug-ins, tracking pixels, web beacons and other similar technology about your viewing patterns, IP address, browser, operating system and the device used (including its location) and details regarding the particular RTÉ website accessed, RTÉ social media pages and app usage (e.g. pages visited and time and date of pages visited together with the actions taken by the user). This information is then used by RTÉ (and its third party service providers) to enable RTÉ to provide RTÉ Account users with extra benefits tailored to their particular preferences and interests. These features include seamless viewing of the RTÉ Player across multiple devices, content relevant to you, and access to exclusive competitions, additional services and events. RTÉ may also record which users opened and clicked the embedded links in the communications sent by RTÉ in order to measure a campaign’s effectiveness. For further information on RTÉ’s use of cookies and other similar technologies please refer to the RTÉ Cookie Policy.

When users visit the RTÉ website, apps and social media sites without an RTÉ Account, RTÉ will also use cookies, social plug-ins, tracking pixels, web beacons and other similar technology to collect certain information about your viewing patterns, IP address, browser, operating system and the device used (including its location) and details regarding the particular RTÉ website accessed. RTÉ uses this information to promote relevant content to you.

 

4.6 Changing your preferences

Users can also switch off marketing notifications through their device settings. RTÉ’s policy concerning the use of cookies and other similar technology across RTÉ platforms and services is set out in the RTÉ Cookie Policy. The Cookie Policy also explains how the use of cookies can be controlled when accessing and using RTÉ services.

 

Please note that if you choose to turn off your cookies, you may lose some features and/or functionality including instructions within a cookie not to deploy an advertisement/survey once it has been sent to you.

 

5. RTÉ Staff Data and Data of Students, Trainees, Interns and those on Work Experience in RTÉ

5.1 As an employer, RTÉ collects and processes Personal Data in relation to its staff, applicants for employment with RTÉ, pension scheme membership, as well as independent contractors, students, trainees, interns, those on work experience engaged by RTÉ. Such Personal Data includes:

(a)  Personal details: name, date of birth, PPS number, bank account details, next of kin, details of social media accounts;

(b)  Contact details: address and phone number(s);

(c)  Employment history/application details: educational history, employment history, work permit (if applicable); work authorisation details (if applicable);

(d)  Education details: educational establishments (including contact details), course/programme and relevant course/programme co-ordinator;

(e)  Editorial or journalistic content: links to work e.g. links to show-reels or audio files;

(f)   Medical information: medical certificates, sick notes, health and safety data;

(g)  Family details: names and dates of birth of children (if a person is applying for parental leave, work experience, internship etc.) names of parent/guardian/next of kin and relationship to staff member;

(h)  Details required for pension purposes: passport details, birth certificates, marriage certificates and details of prior pension scheme membership;

(i)   Car registration and vehicle insurance details for the purpose of expense claims;

(j)   Details regarding trade union membership (for the purposes of payment of trade union membership fees only);

(k)  Performance-related data: performance management ratings for managers and annual incremental salary reviews of employees;

(l)   Details required for insurance purposes: contact details; details related to any insurance claims;

(m)  Co-tag details and access card related data: for the purpose of the security and the health and safety of RTÉ staff and the security of RTÉ;

(n)  Details associated with driver behaviour and location where RTÉ staff have access to an RTÉ fleet vehicle.

RTÉ also engage a number of third parties for the collection and processing of Personal Data of its staff and contractors to assist in the normal course of personnel and benefits administration.

5.2 The purposes and lawful justifications for RTÉ’s data processing

(a)  RTÉ collects and processes the employment-related Personal Data described above for the purposes and with the lawful justifications described below:

Purpose	Lawful Justification
Payroll, including payment of salaries and expenses of staff and independent contractors, making income tax returns, processing of voluntary payroll deductions and for the purposes of internal budgeting and projection of payroll costs.	Such processing is necessary for the performance of the employment contract and contracts for services between RTÉ and each employee or contractor.
For the purposes of budget compilation, reporting, analysis of variances against budget, engagement with statutory and other reviews of RTÉ’s performance, planning and restructuring, scheduling and resource planning, costing, or responses to information requests other than Freedom of Information (FOI) (e.g. Parliamentary Questions).	To comply with statutory obligations under the Broadcasting Act 2009.
For maintaining human resources records.	For the performance of the employment contract between RTÉ and each employee and to meet legal obligations in relation to employment records.
For health and safety of RTÉ staff and visitors and security of RTÉ and RTÉ staff and visitors.	To comply with RTÉ’s obligations under employment law with particular regard to health, safety and security and public health law. Vital interests of RTÉ staff and visitors.
For recruitment purposes.	Such processing is based on the consent of the individual applicant.
For training purposes.	To comply with RTÉ’s statutory obligations or obligations under employment law. In some cases, necessary for the performance of the employment/services contract.
Performance appraisal including for conducting salary reviews.	Necessary for the performance of the employment/services contract.
IT security and maintenance e.g. IT helpdesk, device encryption, the provision of secure remote access to RTÉ networks and systems.	This is necessary for compliance with RTÉ legal obligations in relation to data security and to protect RTÉ’s legal obligations for ensuring that workplace policies are adhered to.
As Data Processor (Data Controllers in this case are Trustees of the RTÉ Superannuation Scheme (RTÉSA) RTÉ as Registered Administrator of the RTESA : Manages and administers members’ participation in the RTÉSA on an ongoing basis in order to · Provide proper benefits for members and their dependents and any other beneficiaries, · Communicate with members and calculate and pay benefits Provide information in the context of disputes or legal claims.	Necessary to comply with the Trustees’ legal obligations (per Art 6(1)(c)) Necessary for the purposes of the Trustees’ legitimate interests or those of a third party, where such interests are not overridden by the fundamental rights of the Data Subject which require protection (per Art(6)(1)(f)); and Necessary for the purpose of establishing, exercising or defending a legal claim (Article 9(2)(f) in respect of Special Categories of Personal Data).
For provision of information relating to pension scheme membership of non-RTÉSA pension schemes to: · pensions administrators to enable them to manage and administer these pension schemes · insurance brokers insuring death benefits provided under the non-RTÉSA pension schemes	To enable the Trustees of the pension schemes to comply with their obligations under the Pensions Act.
Maintenance of the RTÉ archives.	To meet RTÉ’s statutory archiving obligations under the Broadcasting Act.
Freedom of Information or regulatory requests.	To comply with statutory obligations.
To assess the working capacity of employees and for related reasons (such as insurance), in limited circumstances RTÉ may process employee’s health data and disclose it to third party service providers for these specific purposes.	For purposes connected with RTÉ obligations under employment law with particular regard to the health and safety and working capacity of its employees. Where such data is processed it shall be subject to suitable and specific measures.
For the provision of internships and work experience programmes (including the assessment of applications, payment of expenses, communication with applicants, obtaining consent for processing Personal Data of those under 18 years of age, obtaining work authorisation details (if applicable).	With the consent of applicants and/or parents /or guardians. Necessary for the performance of the contracts issued with successful applicants.
For business and human resource management purposes.	To meet RTÉ’s statutory obligations under the Broadcasting Act 2009.
Details associated with driver behaviour and location where RTÉ staff have access to an RTÉ fleet vehicle.	To comply with RTÉ’s contractual obligations. To Comply with RTÉ’s legal obligations under employment and health and safety law. The Vital interests of employees, contractors and/or the public.

 

6. Personal Data Obtained by RTÉ for Programming Purposes

6.1 Journalistic and editorial purposes

In performing its role as a public service media organisation, and in the course of researching and preparing content for potential broadcast or publication by RTÉ for journalistic or programme content and programme-making purposes, RTÉ, gathers and records in a variety of forms, news, information, data, opinions, on and off-record quotes or views from people and sources. These activities will frequently involve the collection and processing of Personal Data. Data protection law permits RTÉ to process such Personal Data in pursuit of the rights of freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression and provides for exemptions from certain data protection obligations where such obligations would be incompatible with RTÉ’s exercise of the rights of freedom of expression. In exercising such rights, RTÉ will not unreasonably encroach on the privacy of an individual. This Policy is not intended to limit or restrict RTÉ’s ability to rely on such interests in the course of its journalistic activity, which under law is to be interpreted broadly.

6.2 Programme content purposes

(a)  In performing its role as a public service media organisation, RTÉ will also generate and broadcast original programme content (including live content) including for cultural, creative, news and current affairs, educational, sporting, artistic, dramatic, literary and other purposes and will process certain Personal Data in connection with such purposes in accordance with its statutory objects and obligations.

(b)  For editorial purposes RTÉ must retain and process certain Personal Data (including special categories of data such as political opinions) to ensure that editorial decision making practices are appropriate so as to ensure that certain content is presented in an objective and impartial manner. This helps to ensure political balance in the context of political reporting, particularly in election cycles, and also in preventing and defending defamation claims made against RTÉ.

6.3 The purposes and lawful justifications for RTÉ’s data processing for programming purposes

Purpose	Lawful Justification
Journalistic and editorial purposes.	To comply with statutory obligations under the Broadcasting Act and/or in performance of RTÉ’s public interest objectives and pursuant to its Freedom of Expression rights.
Programmes content purposes.	To comply with statutory obligations under the Broadcasting Act and in performance of RTÉ’s public interest objectives and pursuant to its Freedom of Expression rights.
Maintenance of RTÉ Archives.	RTÉ has statutory obligations under the Broadcasting Act as well as a public interest in maintaining its archives and records for public interest, historical or research purposes.
To be able to seek consent from a parent or guardian for gathering and storing of data of those under 18 years of age.	To comply with RTÉ’s statutory obligations.

 

7. Contributions To, Participation In, and Communications With RTÉ From RTÉ’s Audience, Users and The General Public

7.1 When a person contributes to, participates in or communicates with RTÉ, by any means including without limitation through RTÉ’s website, social media, apps, by phone or by post, RTÉ may collect and use contact details (that you provide).

(a)  Personal Data provided through RTÉ’s website, social media and/or Apps is processed in accordance with paragraph 3 of this privacy policy and where applicable, the Terms and Condition for RTÉ Online.

(b)  Personal Data provided in principal format through means such as post or hand delivery: RTÉ may collect and use the sender’s name and contact details in connection with the purpose for when the sender sent it to RTÉ. Where RTÉ is carrying out such a purpose (by way of example only: a programme is made by an independent producer) in conjunction with a third party, subject to the contract between RTÉ and the third party, that third party may collect and use the data.

7.2 The purposes and lawful justification for RTÉ’s data processing

(a)  RTÉ collects and processes the Personal Data of its contributors, audience and/or the general public discussed above for the purposes and with the lawful justifications described below:

Purpose	Lawful Justification
Using content provided by individuals on RTÉ’s online media and/or in RTÉ programmes.	Depending on the purpose for which the content was provided to RTÉ; the relevant lawful basis will likely be either individual’s consent for these uses, or performance of RTÉ’s public service objectives and further to its freedom of expression rights. If a user wishes to withdraw consent to the processing of content provided by them to RTÉ, they can contact RTÉ’s Data Protection Officer (see paragraph 16 below).
Maintenance of RTÉ Archives.	RTÉ has statutory obligations under the Broadcasting Act as well as a public interest in maintaining its archives and records for public interest, historical or research purposes.
To be able to seek consent from a parent or guardian for gathering and storing of data of those under 18 years of age.	To comply with RTÉ’s statutory obligations.

 

8. Children

8.1 A cornerstone of RTÉ’s mandate is to empower RTÉ’s young viewers by encouraging digital literacy, inclusion and creativity while providing engaging and accessible content. RTÉ’s childrens’ online services include the RTÉjr app and the RTÉjr website (together the “RTÉ Childrens’ Online Services”). Having regard to the specific protections attaching to the use of children’s Personal Data, RTÉ takes children’s privacy very seriously and for this reason RTÉ doesn’t use cookies for targeted advertising in connection with RTÉ Childrens’ Online Services.

8.2 Children and RTÉ programming

RTÉ may process children’s Personal Data when carrying out its statutory obligations or exercising its freedom of expression rights, which include, without limitation, making programmes in the public interest.

8.3 Children as audience members, cast or as participants in RTÉ programming

Parents or guardians can apply on behalf of their child/children to appear as a member of the audience, cast or as a participant in RTÉ programming through www.RTÉjr.ie. Any Personal Data will be processed in accordance with this Privacy Policy, having regard to the specific protections attaching to the use of childrens’ Personal Data.

 

8.4 RTÉjr and young peoples’ programming

However, at present RTÉ does not produce childrens’ programming itself and all RTÉjr/young peoples’ programming is currently independently produced by third party independent production companies, which are subject to their own privacy statements which may differ from those of RTÉ. Accordingly, parents/guardians on behalf of their children should review the notices/statements of such third party production companies for further information.

 

8.5 Cookies and RTÉ Childrens’ online services

While RTÉ doesn’t use cookies for advertising in connection with RTÉ Childrens’ Online Services, RTÉ do use cookies and other technologies (such as pixels, tags and/or SDKs) for other reasons connected with RTÉ Childrens’ Online Services. This enables RTÉ to ensure that users have the best possible experience and to provide the most appropriate content (e.g. videos, cartoons and games) through RTÉ Childrens’ online services and childrens’ TV programmes to match childrens’ interests. It is important to recognise that cookies serve a key purpose in enabling RTÉ systems to recognise your device either for the duration of your visit or for repeat visits, letting you navigate between pages efficiently, storing log-in information, and generally improving your and/or your child’s experience of RTÉ Childrens’ online services. It can also enable RTÉ to identify your device’s location. For further information on RTÉ’s use of cookies and other similar technologies please refer to the RTÉ Cookie Policy.

 

Purpose	Lawful Justification
Children and RTÉ Programming.	Statutory Obligation, Freedom of Expression, Archives, Consent.
Children as audience members, cast or as participants in RTÉ programming.	Statutory Obligation, Consent, Freedom of expression, Archives.
RTÉjr and young peoples’ programming	Statutory Obligation, Freedom of Expression, Archives, Consent.

 

9. Processing for Security Purposes

9.1 CCTV

RTÉ has closed circuit television cameras (“CCTV”) located throughout its various premises covering outside and inside buildings, internal spaces, car parks, roads, pathways and grounds and the parameters of the premises controlled by RTÉ. RTÉ’s CCTV system is implemented in a proportionate manner as necessary to protect RTÉ property against theft or pilferage and for the security of employees and visitors to the RTÉ premises (to protect their vital interests). Whilst CCTV footage is monitored by RTÉ security staff, access to recorded footage is strictly limited to authorised personnel. Footage is retained for 28 days, except where incidents or accidents have been identified in which case such footage is retained specifically in the context of an investigation of that issue. CCTV footage may be used in the context of disciplinary proceedings involving RTÉ employees and to detect, establish and/or defend legal proceedings (to protect the vital interests of RTÉ, staff, students and affected individuals). CCTV footage is not disclosed to third parties except where disclosure is required by law (such as for the purpose of preventing, detecting or investigating alleged offences) and in such instances disclosure is based on a valid request. Signage indicating that CCTV is in use is displayed throughout the RTÉ premises. To request a copy of CCTV footage, contact both the RTÉ Security Manager at Kieron.Hogan@rte.ie and the Data Protection Officer at dpo@rte.ie. Your request will be considered in light of data protection law.

 

9.2 Licence Plate Recognition

RTÉ operates licence plate recognition software for security purposes and to facilitate authorised vehicular access to RTÉ premises. This involves the Processing of vehicles’ licence plate details on entry and exit to RTÉ premises.

Purpose	Lawful Justification
CCTV.	Vital Interests of staff and visitors to the RTÉ sites and licensed premises. Compliance with legal obligations and contractual obligations.
Licence Plate Recognition.	Compliance with legal obligations and contractual obligations.

 

10. Disclosures/Recipients

10.1   RTÉ discloses Personal Data to third parties in certain instances. For example, RTÉ uses third party service providers for the processing of Personal Data for a number of purposes, including, to gauge programme audience numbers, to perform data analytics, to manage its email marketing communications, for the administration of competitions, to fulfil requests made by you or your expectations of RTÉ. These service providers are subject to a contractual obligation to only process Personal Data obtained from RTÉ for purposes for which it was obtained and in accordance with RTÉ’s instructions.

10.2   RTÉ will not provide your Personal Data to third parties who may contact you for direct marketing or promotional purposes unless you have consented to RTÉ disclosing your Personal Data to such third parties for that purpose.

10.3   In certain circumstances RTÉ will disclose Personal Data to other external third parties such as its professional advisors as necessary in the context of the performance of their services. Such recipients may include external legal advisors, auditors, actuaries, pension and tax advisors, pension administrators and other professional advisors. Disclosure of such data will take place for a variety of reasons including in order to ensure that RTÉ meets its tax and other obligations and in order to perform its statutory objectives in the public interest.

10.4   In certain instances where RTÉ is working with a co-producer or a third party production company in producing content, RTÉ may disclose Personal Data to such co-producers/third party production companies. Where appropriate, RTÉ will ensure the necessary contractual provisions are in place with such third parties so that Personal Data is managed and collected in accordance with data protection law.

10.5   RTÉ may also disclose Personal Data to its insurance providers or brokers in connection with obtaining insurance, legal claims and prospective legal claims or proceedings.

10.6   RTÉ is subject to Freedom of Information and broadcasting laws and may disclose information where required to do so in accordance with such legislation.

10.7   Your personal data may also be provided to social media companies in the manner described at 3.3 (a) (iv) above. The privacy policies of the most frequently engaged social media companies are set out below for your ease of reference. These policies will explain to you how and why and on what legal basis they process your personal data and explain how you may exercise your data protection rights against them.

Facebook privacy policy – https://www.facebook.com/about/privacy

Instagram privacy policy – https://help.instagram.com/519522125107875

YouTube, incorporating Google – https://policies.google.com/privacy

LinkedIn privacy policy – https://www.linkedin.com/legal/privacy-policy

Twitter privacy policy – https://twitter.com/en/privacy

Furthermore, when RTÉ engages Facebook products for the purposes set out in sections 3.3(a)(iii)-(vi) and section 4, then RTÉ and Facebook are Joint Controllers of the personal data for those purposes. To that end, RTÉ have entered a supplementary agreement with regard to that processing which sets out each organisations’ respective responsibilities, including in respect of how you may exercise your data protection rights. That agreement can be found here (https://www.facebook.com/legal/controller_addendum).

 

11. Archiving

11.1   RTÉ Archives is Ireland’s largest collection of audio-visual content. As well as keeping audio-visual records, RTÉ Archives make content available on an increasing number of platforms and devices for both the public and for its staff. RTÉ Archives provide content for radio and television programmes, both internally and for content partners.

11.2   Such records are retained for journalistic purposes, as outlined in paragraph 6 above. The RTÉ Privacy Policy should be read in conjunction with the RTÉ Records Management Policy. RTÉ Archives are comprised of both: (i) Working Archives, which are retained for operational purposes and (ii) Heritage Archives, which are retained for historical and public interest reasons.

11.3   RTÉ’s retention of archive records is in accordance with its statutory objectives under section 114 of the Broadcasting Act which requires it to “establish and maintain archives and libraries containing materials relevant to the objects of RTÉ”. In relation to RTÉ’s archiving activities, suitable and specific measures shall be adopted and the principle of data minimisation observed.

12. Data Retention

RTÉ endeavours to retain Personal Data for no longer than is necessary for the purpose for which it was obtained by us or as required or permitted for legal, regulatory, fraud prevention and legitimate business purposes.

 

RTÉ is obliged to retain certain information to ensure accuracy, to help maintain quality of service and for legal, regulatory, fraud prevention and legitimate business purposes.

 

In general, RTÉ (or our service providers on RTÉ’s behalf) will hold this information for a period of seven years, unless RTÉ is obliged to hold it for a longer period under law or applicable regulations. For example, as set out in Section 11, RTÉ has statutory archiving obligations under the Broadcasting Act as well as a public interest in maintaining its archives and records for public interest, historical or research purposes. Any Personal Data retained in the context or RTÉ’s archives will be held indefinitely. Similarly, Personal Data provided when users set up an RTÉ Account will be held until such time as the account is terminated by the user, at which time all Personal Data will be destroyed by RTÉ.

 

In other circumstances, RTÉ will retain Personal Data for a shorter period of time. For example, if Personal Data is disclosed to us by you in connection with a competition entry, that Personal Data will be retained for a period of 24 months. Personal data collected pursuant to RTÉ’s cookies policy will generally be retained for no more than 6months. 

13. Data Transfers Outside The European Economic Area

13.1   RTÉ does not generally transfer any Personal Data outside the European Economic Area (“EEA”). However, in some cases RTÉ may use carefully selected service providers, including Facebook and including certain cloud storage service providers, to perform certain functions which involves data transfers outside the EEA. Certain RTÉ service providers may also store Personal Data in data centres located outside the EEA. These service providers are subject to a contractual obligation to comply with applicable data protection law and to ensure that appropriate measures are put in place to ensure the protection of any Personal Data that is transferred outside the EEA. Following recent decisions in the Court of Justice of the EU and the impending departure of the UK from the EU, RTÉ is reviewing its arrangements with regard to data processing occurring in the United States and Britain and is awaiting further guidance and advice from relevant data protection regulators.

14. Your Data Protection Rights

In certain circumstances, you have the following rights under data protection law in relation to your Personal Data:

14.1   A right to access Personal Data held by RTÉ

(a)  Any individual has a right to make an access request under data protection law for a copy of their Personal Data held by RTÉ. In response to a request, RTÉ will clarify the RTÉ entity that is the Data Controller in respect of the relevant Personal Data. RTÉ may ask for further identification details to confirm identity before the relevant information is released.

(b)  It should be noted that there are specific exemptions relating to accessing Personal Data held for journalistic, artistic and literary purposes, which may be relevant to RTÉ.

14.2   Other data protection rights

(a)  Rectification of inaccurate Personal Data;

(b)  Erasure of Personal Data (also known as the “Right to be Forgotten”);

(c)  Restriction of processing of Personal Data;

(d)  Right to data portability;

(e)  Right to object to processing of Personal Data where such processing is based on RTÉ’s statutory functions and or public interest objectives.

14.3   However, under data protection law, these rights are available only in certain circumstances. If you wish to exercise any of your data protection rights please contact the Data Protection Officer at dpo@rte.ie or write to: Data Protection Officer, RTÉ, Donnybrook, Dublin 4. Please provide as much detail as possible to enable us to respond to your request and to locate relevant Personal Data about you.

15. Information Security

15.1   In accordance with applicable laws, RTÉ ensures that all Personal Data controlled by RTÉ is held securely using appropriate security measures including the following:

(a)  Physical measures such as locked filing cabinets in offices containing Personal Data;

(b)  IT security systems;

(c)  Restricted access to Personal Data subject to approvals;

(d)  Time limits on retention of Personal Data;

(e)  Provision of targeted data protection training to employees, contractors and other staff who have access to and process Personal Data;

(f)   Password restrictions on access to Personal Data; and

(g)  Technical measures including:

(i)   encryption on RTÉ laptops; and

(ii) logging mechanisms to record certain access to Personal Data and alteration and other processing of Personal Data.

15.2   In the event of a Personal Data breach, RTÉ will comply with applicable reporting and notification obligations under data protection law.

16. Contact Us/Complaints

16.1   If you wish to make a complaint about RTÉ’s data protection practices, please contact the Data Protection Officer at dpo@rte.ie or write to: Data Protection Officer, RTÉ, Donnybrook, Dublin 4. You may also lodge a complaint to the Office of the Data Protection Commission (see the website of the Office of the Data Protection Commission).

16.2   RTÉ reserves the right to remove content from any RTÉ websites, RTÉ social media pages and apps that is in breach of this Privacy Policy, or as it sees fit. To report content that you believe to be in breach of this Privacy Policy contact the RTÉ help desk at info@rte.ie or the Data Protection Officer at dpo@rte.ie. You may also report content on the relevant website, social media page or app.

16.3   If you have any questions or queries about this policy please contact our help desk at info@rte.ie, or the Data Protection Office at dpo@rte.ie.

16.4   Please visit the website for the Irish Data Protection Commissioner for further information about your data protection rights (https://dataprotection.ie/).

Last updated: 5 October 2020

Ráiteas Príobháideachais RTÉ
Tá meas ag RTÉ ar phríobháideachas gach cuairteoir ar ár láithreán gréasáin.