Home BER Assessor
Confidentiality and Data Protection
SEAI and each GERBER assessor act as joint data controllers in respect of any personal data collected and processed in connection with the administration of the GERBER Scheme (for the purpose of this Section 10 is referred to as the “Scheme Data).
This Section sets out the framework by which SEAI and each GERBER assessor will process Scheme Data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), in particular Article 26 and the Data Protection Acts 1988 to 2018 (collectively “Data Protection Law”).
10.1Purpose
SEAI and each GERBER assessor will, from time to time, process Scheme Data in connection with their respective roles in the administration of the GERBER Scheme which includes:
a)SEAI determining the manner, including the calculation methods and software, in respect of which BER assessments are to be carried out;
b)GERBER assessors completing a BER assessment (incl. a site visit and initial engagement with the client) and collecting the Scheme Data;
c)GERBER assessors in inputting collected Scheme Data in the relevant system for submission, such as DEAP, SBEM, NAS or NSDAS (“Relevant System”) to complete and/or publish a BER assessment;
d)SEAI in managing and monitoring the quality of published records on the Relevant Systems; and
e)GERBER assessors in publishing a BER assessment.
For the purpose of this Section 10 is referred to as the “Agreed Purpose”.
10.2Responsibilities
SEAI and each GERBER assessor is responsible for complying with all the obligations imposed on it as a Controller under Data Protection Law with respect to its processing of the Scheme Data.
In particular, each GERBER assessor shall be responsible for complying with Data Protection Law in respect of the processing of Scheme Data from the point of collection of such Scheme Data up until the point which it is submitted to a Relevant System.
Following the submission of the Scheme Data to a Relevant System, SEAI shall be responsible for ensuring that any further processing by it of the Scheme Data shall by in accordance with Data Protection Law.
10.3Purpose limitation
SEAI and each GERBER assessor shall process the Scheme Data only for their respective identified purposes within the Agreed Purpose and any other purposes that are compatible with the Agreed Purpose, or as otherwise required by applicable law.
10.4Security Requirements
SEAI and each GERBER assessor shall implement appropriate technical and organisational security measures to provide for the safe and secure storage and transfer of the Scheme Data as part of the BER assessment process.
A GERBER assessor is required to abide by the following confidentiality and data protection requirements:
a)to keep confidential the identity of clients and BER records. GERBER assessors and their Principals, where applicable, shall adopt and maintain appropriate security measures (including technical security measures and organisational measures) in dealing with personal data controlled or jointly controlled by them. These measures must be sufficient to protect against unauthorised or accidental access, loss, alteration, disclosure or destruction of such data, and against all other unlawful forms of processing; and
b)the limited exceptions to these requirements are disclosure of information required by law and disclosure to SEAI or its authorised officers. GERBER assessors are not permitted to make any disclosures to other parties except where required to do so by law.
10.5Transparency
A GERBER assessor shall be primarily responsible for providing information to GERBER clients in respect of their data protection rights in the manner described by SEAI in this Code. In particular, the GERBER assessor shall provide a copy of the BER Privacy Notice and other information as may be necessary or otherwise appropriate for such GERBER clients to understand the operation and administration of the GERBER scheme and the essence of the responsibilities of SEAI and each GERBER assessor in respect of Scheme Data as provided for in this Section 10.
The GERBER assessor shall act as the primary contact point for GERBER clients in respect of data protection matters (including the exercise of their data protection rights) up until such time as the GERBER assessor has uploaded the Scheme Data into the Relevant System.
Once the Scheme Data has been uploaded to the Relevant System, SEAI shall act as the primary contact for GERBER clients in respect of data protection matters (including the exercise of their data protection rights) and each GERBER assessor shall direct any queries received from a GERBER client in respect of the processing of the Scheme Data to SEAI as soon as possible.
10.6Retention & Deletion
GERBER assessors shall ensure that any Scheme Data is retained for 10 years in order to comply with the requirements of this Code, set out in Section 8. This includes retaining Scheme Data for the applicable retention periods, both when registered and after permanently ceasing to be registered as GERBER assessor, in order to;
a)fulfil obligations under Data Protection Law to respond to data subject requests;
b)to respond to monitoring and compliance processes carried out by SEAI in accordance with this Code and the QADP; and
c)where relevant, upon ceasing to be registered as a GERBERassessor, transfer any relevant Scheme
Data to the Principal, who shall retain and maintain by records on behalf of the GERBER assessor.
10.7Data Subject Rights
SEAI and each GERBER assessor agrees to comply with their obligations under Data Protection Law where a GERBER client exercises their rights under Data Protection Law in respect of the Scheme Data (for the purpose of this Section 10 referred to as a “Data Subject Request”).
As between SEAI and each GERBER assessor, the following arrangement shall apply in respect of Data Subject Requests:
a)where a Data Subject Request in respect of Scheme Data is received by a GERBER assessor prior to the data being uploaded to the Relevant System, the GERBER assessor shall be responsible for responding to the relevant Data Subject Request in line with Data Protection Law;
b)where a Data Subject Request in respect of Scheme Data is received after the data has been uploaded to the Relevant System, SEAI shall be responsible for responding to the relevant Data Subject Request in line with Data Protection Law; and
c)where a Data Subject Request in respect of Scheme Data is received by a GERBER assessor after the data has been uploaded to the Relevant System, it shall promptly communicate this request to SEAI and provide all reasonable assistance needed by SEAI to comply with the Data Subject Request.
10.8GERBER Assessor Assistance
Each GERBER assessor shall:
a)provide all reasonable assistance required by SEAI in complying with all applicable requirements of Data Protection Law in respect of the Scheme Data which has been uploaded to the Relevant System;
b)provide data subjects with a copy of the BER Privacy Notice available on SEAI’s website; and
c)notify SEAI without undue delay on becoming aware of any breach of Data Protection Law with respect to the Scheme Data within its possession.
10.9Disclosure of Scheme Data
The Scheme Data provided to SEAI will be used primarily to facilitate the administration of the GERBER Scheme. Scheme Data and/or other information received from GERBER assessors may be shared with certain parties in certain circumstances, as further detailed in the SEAI Building Energy Rating (BER) and Display Energy Certificates (DEC) Programme Privacy Notice.
GERBER assessors should not, without the permission of SEAI, disclose Scheme Data to any third party not directly involved in the administration of the GERBER Scheme. A GERBER assessor may engage processors in connection with the collection, storage or transmission of the Scheme Data into the Relevant System where it determines that it is necessary for the processing of the Scheme Data and it shall ensure that it does so in a manner compliant with Data Protection Law.
BER ASSESSMENT
