Privacy Notice

Who we are

The Commission for Regulation of Utilities (CRU) is Ireland’s independent energy & water regulator with a range of economic, customer care and energy safety functions.

The CRU acts as data controller in relation to information held about you for the purposes of data protection law i.e. applicable national and EU data protection laws, regulations and guidelines including the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

Why we collect information about you

In order to carry out its functions, the CRU needs to collect and use personal information about the individuals who come into contact with us.

Most of the personal information we process is provided to us directly by you for one of the following reasons;

• Complaint resolution (utility customers can contact CRU Customer Care to help resolve their complaints with suppliers or network operators);
• Information requests or queries;
• Subscribing to CRU publication updates on our website;
• Public access to information under FOI / AIE / Data Protection legislation;
• Responding to CRU Consultations;
• Attendance at a public hearing which we have conducted,
• Safety–related complaints received in relation to Compressed Natural Gas (CNG);
• Safety Supervisory Body (Safe Electric and RGII^[1]) activities (information queries from the public; appeals; complaints; illegal activity and enforcement; audit and inspection of Safety Supervisory Body (SSB) inspectors);
• Public procurement activities (tenderers, suppliers and service providers);
• Licencing activities (processing applications for Licensing, Consents, Certifications & Registrations); and
• Protected Disclosures to CRU Commissioners.

This information is collected when you contact us with a query or request; through forms you complete, when you give us information verbally or in writing or when you visit the CRU offices.

We also receive personal information indirectly. This information is usually received from the entities that we regulate or designate and may happen in the following scenarios:

• CRU Customer Care contact an energy supplier or network operator on your behalf and it gives us your personal information in its response;
• Retail market monitoring and reporting activities;
• Conducting audits on energy suppliers or Irish Water;
• Assessment of applications for Recognition of EU Professional Qualifications (Gas Installers & Electrical Contractors);
• Energy Safety Supervisory Body (Safe Electric and RGII Scheme) activities. This includes applications, management of registration, certificates of completion, Notices of Hazard and Notices of Potential Hazard, Emergency Notices, audit and inspection of RECs/RGIs, complaints, investigations, changes of contractor or installer, disciplinary proceedings and information queries from the public;
• Gas Safety Framework (Natural Gas and LPG) incidents and investigations; or
• An employee of ours gives your contact details as an emergency contact or a referee.

[1] RGII (Register of Gas Installers of Ireland); Safe Electric - RECI (Register of Electrical Contractors of Ireland).

The information we process about you

[1] Electricity: MRSO (Meter Registration System Operator) - ESBN (ESB Networks)

Gas: GPRO (Gas Point Registration Operator) - GNI (Gas Networks Ireland)

Water: Irish Water

Electricity / Gas Suppliers: For current list of energy suppliers see https://www.cru.ie/home/customer-care/energy/communication/

Please note: The CRU does not request or require personal data relating to children, health status, criminal convictions or any other special category / sensitive information in our engagement with the public, such as for the purposes of energy complaint resolution.

Why we use your information

We fully respect your right to privacy and will only collect or process your personal data, where required, for one or more of the following purposes (lawful basis):

Performing our public task as a regulator including:

1. Contacting you by post, phone and email.
2. Facilitating public input and comment on CRU Consultations.
3. Responding to queries to the CRU Press Office.
4. Responding to customer service quality complaints in accordance with our Customer Charter.
5. Resolving energy & water customer complaints with your energy supplier, network operator and Irish Water (As prescribed for under S.I. No. 463 of 2011 and the Water Services Acts 2013, 2014 & 2017).
6. Providing you with information or responding to an enquiry relating to the services provided by energy suppliers, network operators or Irish Water. (As prescribed for under S.I. No. 463 of 2011 and the Water Services Acts 2013, 2014 & 2017).
7. Processing applications for a Licence to Generate Electricity or Authorisation to Construct or Reconstruct a Generating Station or Electricity Supply Licence (under the Electricity Regulation Act, 1999 Section 14 as amended); Natural Gas Shipping and Supply Licence (Under Section 16 of the Gas (Interim) (Regulation) Act 2002, as amended); Consents pursuant to Section 48 and Section 49 of the Electricity Regulation Act 1999; High Efficiency CHP Certification (as set out in SI 298, 299 and 499 of 2009);  LPG Safety Licences (in accordance with section 9JE (3) of the Electricity Regulation Act 1999, as amended by the Energy (Miscellaneous Provisions) Act 2012); Network Licences under section 14 (1) of the Electricity Regulation Act 1999  & section 16 (1) of the Gas Act 2002; and REMIT (Regulation on Energy Market Integrity and Transparency) Registration (SI 480 of 2014).
8. Retail energy market monitoring measures, in compliance with requirements stemming from the 3^rd Package of European energy legislation which was transposed into Irish law by S.I. No. 450 of 2010 and S.I. No. 630 of 2011 (the S.I.s covering electricity and gas, respectively).
9. Conducting audits on energy suppliers to ensure compliance with the Electricity and Gas Supplier Handbook (the Supplier Handbook), as a Code of Practice prescribed for in S.I. No. 463 of 2011.
10. Conducting investigations to ensure compliance with the conditions of a licence issued under sections (1) (b), (g) or (h) of the Electricity Regulation Act 1999, or sections 16(1)(a) or (b) of the Gas (Interim) (Regulation) Act 2002.
11. Conducting public hearings where the CRU is satisfied that sufficient grounds exist to warrant a public hearing (as prescribed under the Electricity Regulation Act, 1999 Section 20, as amended).
12. Facilitating registration appeals, complaints and disciplinary actions relating to applicants to or members of Safe Electric and RGII Schemes and facilitating the sharing of information in relation to prosecutions against unregistered gas installers and electrical contractors. (As prescribed for by the Electricity Regulation Act 1999, as amended and the Criteria Document(s).)
13. Processing applications for the Recognition of EU Professional Qualifications for Gas Installers & Electrical Contractors as prescribed for by EU Directive 2013/55/EU and S.I. No. 8 of 2017.
14. Facilitating the monitoring and inspection of Safe Electric and RGII Inspectors (As prescribed for under Electricity Regulation Act 1999, as amended and the Criteria Document(s).)
15. Investigating natural gas or Liquefied Petroleum Gas (LPG) incidents to identify the cause and make recommendations on the prevention of future incidents as required by the Gas (Amendment) Act (Section 2) (Distribution) Order 2003 and Energy (Miscellaneous Provisions) Act 2012.
16. Establishing an Appeal Panel as defined in the Electricity Regulation Act 1999 as amended.
17. Responding to safety complaints regarding Compressed Natural Gas (CNG) in accordance with S.I. No. 647/2018 - European Union (Deployment of Alternative Fuels Infrastructure) (No. 2) Regulations 2018.

To fulfil the terms of a contract

1. Engaging service providers and suppliers and for the provision of and payment for goods and services.
2. Filling vacant positions and for the engagement and payment of employees.
3. Monitoring and recording the conversations when you speak on the telephone to our out-sourced customer contact provider (to analyse, assess and improve customer service experience and for quality, training and contract management purposes).

Complying with our legal obligations, such as

1. Preparing returns to relevant authorities including preparing income tax, PSWT, VAT3 and other revenue returns.
2. Complying with your information rights.
3. Complying with binding requests from regulatory bodies, such as the Data Protection Commission and the Office of the Information Commissioner.
4. Facilitating the making of a Protected Disclosure to a Commissioner in the CRU as prescribed by The Protected Disclosures Act 2014.
5. Complying with court orders arising in civil or criminal proceedings.

Where you have given us permission (which you may withdraw at any time)

When we ask for your consent, we will provide you with more information on how we will use your data in reliance on that consent. Please note that the withdrawal of consent does not impact processing based on consent prior to its withdrawal. Consent may be provided by:

1. Subscribing to CRU publication updates.
2. Use of your personal image in CRU publications.
3. Attending a CRU event.
4. Completing a CRU survey.
5. Use of cookies on the CRU website. The CRU uses cookies that are necessary for website functionality, security and accessibility which are set and cannot be deleted or blocked. CRU also uses cookies for statistical purposes to count the numbers of visitors and how they move around our website through anonymous data. This helps us improve the way our website works. Statistical cookies are set when a user clicks "all cookies".
6. In certain limited circumstances, where we use special categories of data, or sensitive data.

To protect your vital interests

Occasionally it may be necessary for the CRU to process personal data in order to protect a vital interest of an individual (such as in a medical emergency).

To run our organisation on a day to day basis including to

• Contact stakeholders: Business contact information relating to stakeholders (personal information typically found on a business card used by you in the conduct of your employment) is processed for legitimate business-related purposes.
• Compile and process your information for audit, statistical, reporting or research purposes (including, in some instances, making your data anonymous) in order to help us understand utility markets trends and to provide information to assist our regulatory functions.
• Protect our business, reputation, resources and equipment and manage the CRU network systems, and information.
• Provide security and prevent and detect crime including using CCTV at our premises.
• Manage and administer our legal and compliance affairs.
• Managing and responding to complaints about us.
• Effectively manage the functionality and usability of the CRU website.

The CRU will only process your personal data for the purposes for which they were originally collected and it will only be processed further for the following closely related business purposes:

• transferring the personal data to an archive;
• conducting internal audits or investigations;
• implementing business controls;
• conducting statistical analysis or research as required;
• preparing for or engaging in dispute resolution;
• using legal or business consulting services; or
• managing insurance issues.

Investigations for law enforcement purposes

As part of our statutory functions, we investigate and prosecute individuals and organisations for alleged criminal offences committed under the legislation we regulate (including prosecutions against unregistered gas installers and electrical contractors as prescribed for under Electricity Regulation Act 1999, as amended and the Criteria Document(s).)

Special category and criminal data

As part of the CRU’s statutory and corporate functions, we process special category data and criminal conviction data in accordance with the requirements of Article 9 and 10 of the General Data Protection Regulation (‘GDPR’) and Part 5 of the Data Protection Act 2018. Our processing of such data respects the rights and interests of the data subjects.

We process special categories of personal data under the following GDPR Articles:

• Article 9(2)(b) – where processing is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on the CRU or the data subject in connection with employment, social security or social protection.
• Article 9(2)(g) - reasons of substantial public interest. This relates to the data we receive or obtain in order to fulfil our statutory function as a regulator. This may be information provided to us as part of a complaint or investigation.
• Article 9(2)(f) – for the establishment, exercise or defence of legal claims.
• Article 9(2)(c) – where processing is necessary to protect the vital interests of the data subject or of another natural person.
• Article 9(2)(a) – explicit consent.

We process criminal offence data in accordance with Part 5 of the Data Protection Act 2018, where necessary, as a ‘competent authority’ with the statutory powers to investigate, prevent, detect or prosecute in the context of criminal offences or criminal penalties.

Who we share your information with

We only share your information where it’s necessary. We will not share your information with any third parties for the purposes of direct marketing. Sharing can occur in the following circumstances and with the following organisations.

Consultation responses published on the CRU website

• Since May 2018,when you respond to a CRU Consultation Paper, your personal details will not be published unless you expressly request us to do so (excluding industry respondents). Where requested, these details will be published on the CRU website as part of the transparent sharing of views informing the CRU decision making process.

 Your authorised representatives

• These include your attorney, your representative (under Power of Attorney) or any other party authorised by you to receive your personal data.

Disclosures to third parties

• We may need to share your personal information with utility suppliers or network operators to aid the efficient processing of your query or compliant.
• Business contact information relating to stakeholders may be shared with a relevant third party if it is reasonably expected that such information will only be used by the third party to contact you for legitimate business purposes related to your job responsibilities.
• Where required, we share details of members of or applicants to Safe Electric or RGII (or of unregistered gas installers and electrical contractors) with Safe Electric or RGII in relation to registration appeals, complaints, illegal activity, disciplinary investigations and enforcement.
• Where required, we share details of Safe Electric or RGII Scheme members with Safe Electric or RGII and with other members of disciplinary hearings.
• Where required, we share details of applicants for the Recognition of EU Professional Qualifications for Gas Installers & Electrical Contractors with Safe Electric or RGII, and organisations whose details have been provided by applicants such as competent authorities and training providers. Where required we will also share these details with members of panels assessing applications.
• Where required, we share your personal information with Garda Síochána and law enforcement agencies in order to assist with the detection, investigation prevention and prosecution of crime.
• We share details of natural gas or LPG Incidents & Investigations with GNI (Gas Networks Ireland), Flogas and Calor Gas (as part of our legal requirements) and with the RGI Scheme, Department of Communications, Climate Action and Communications, the Irish LPG Association, the Fire Services and the HSA to facilitate investigations / share learnings and to help facilitate the safe transmission, distribution and use of natural gas and LPG in Ireland.
• Tenderer or supplier details may be shared with the Northern Irish Authority for Utility Regulation (NIAUR) in cases where the CRU procures services or supplies on behalf of the Single Electricity Market Committee (SEMC) and NIAUR is a joint controller for the data.
• Tenderer details are collected via www.etenders.gov.ie eTenders is the Irish Government’s electronic tendering platform administered by the Office of Government Procurement.

Third Party Service Provides

We use data processors who are third parties who provide services for us. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us unless instructed to do so. They will hold it securely and retain it for the period we instruct.

• Our customer contact service provider is currently A.R.I. Services Europe Ltd., (ARISE). ARISE is the first point of public contact for many queries and complaints regarding utility suppliers and network operators. We share your personal information with them as our data processor so that they can effectively provide this service to you. In providing these services, ARISE may record your call information.
• Safe Electric and RGII Schemes: The CRU has designated these organisations as Electrical Safety Supervisory and Gas Safety Supervisory Body, respectively. Safe Electric & RGII process all relevant personal data in connection with the performance of the role as Safety Supervisory Body on behalf of the CRU. Details of applicants for the Recognition of EU Professional Qualifications for Gas Installers & Electrical Contractors are also processed by Safe Electric and RGII on CRU’s behalf.
• The CRU engages other third-party service provides to provide operational services and systems development, support and maintenance. These include ICT (including CRM and Case Management) systems services, ICT (including CRM) maintenance, software development, electronic signature services, secure file transfer services, document storage and destruction, printing, couriers, auditors and consultants including legal advisors.
• Social media (Twitter, LinkedIn): We may use a third-party provider to manage our social-media interactions. When contacting the CRU through a social media platform, we suggest you also familiarise yourself with the privacy information of that platform. Messages or posts received by the CRU on these social media platforms are viewed by the CRU but the personal data contained in the messages / posts is not logged or stored other than on the relevant social medial platform, and no further processing of such personal data is carried out by the CRU.

• Website Analytics: When you visit cru.ie, we use a third-party service, Google Analytics, to collect standard statistical information and details of visitor behaviour patterns. We do this to find out such things as the number of visitors to the various parts of the site. This information is only processed in a way that does not directly identify anyone.
• Subscribers: If you subscribe to CRU publication updates, your email address will be automatically added to the CRU subscriber database of the email marketing service. If you unsubscribe from our newsletter, your email address is retained by the provider in order to ensure you are not contacted again.

• Website security & performance: We use a third-party web application firewall to help maintain the security and performance of our website. The service checks that traffic to the site is behaving as would be expected and blocks traffic that is not using the site as expected. To provide this service, site visitors’ IP addresses are processed.

Statutory and regulatory bodies (including central and local government) and law enforcement authorities

In certain circumstances, we may share and / or are obliged to share your Data with third party statutory or regulatory bodies in accordance with Data Protection Legislation.

These may include the courts and those appointed by the courts, government departments, statutory and regulatory bodies including: the Data Protection Commission, the Office of the Information Commissioner, Office of the C&AG, An Garda Siochana and Revenue Commissioners.

Organisations who share your information with the CRU

In certain circumstance, energy and water suppliers or network operators are required share certain personal identifiers with the CRU in order to facilitate our roles in utility customer complaint resolution, investigation of Gas Safety Framework incidents, monitoring customer protection issues and supplier compliance in the retail market. CRU is data controller for any such data when received from these organisations.

How long we hold your information and how it’s secured

We will keep your personal data for as long as it is necessary to fulfil the purposes for which it was collected as described above and in accordance with our legal and regulatory obligations. The length of time we hold your personal data depends on a number of factors such as:

• The type of data we hold about you.
• Whether there is a legal obligation to hold the data for a minimum specified period.
• Whether there is a public interest basis to hold the data for a specified period.
• Where there is a sound evidence-based reason to hold the data for a specified period.

As a general rule, we keep your information for a specified period after the date on which your interaction with us has completed. This may mean that some information is held for longer than other information. For example:

• Contact with CRU Customer Care: Records are held for 12 months in the case of general queries / information requests / contacts or regarding the resolution of simple customer complaints and 24 months in the case of complex customer complaints.
• Recordings of calls to CRU Customer Care will be held for 3 months.
• Consultation responses published on the CRU website will remain there indefinitely.
• Personal data processed for the purpose of carrying out activities under the Safe Electric and RGII Schemes is retained for a maximum of two Safety Supervisory Scheme designation periods (currently set at 7 years).

When you contact us with a query or complaint, you may receive a phone call and/or email in relation to that contact. If you would prefer not to receive such communications, please let us know.

The CRU operates and uses appropriate technical and physical security measures to protect your personal data. We have taken appropriate security measures to protect your personal data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Access is only granted on a need-to-know basis on a least privilege basis to staff members whose roles require them to process your personal data and, in certain circumstances, to third party service providers. In addition, our service providers are selected carefully to ensure they have an appropriate level of technical, organisational and security measures in place.

Processing your information outside the EEA

Your information is stored on secure systems within the CRU premises and with providers of secure information storage. We may transfer or allow the transfer of information about you to our service providers and other organisations outside the European Economic Area (EEA), but only if they agree to act solely on our instructions and protect your information to the same standard that applies in the EEA.

For transfers of your personal data to third parties outside of the EEA, we take additional steps in line with Data Protection Law. We will put in place adequate safeguards with respect to the protection of your privacy, fundamental rights and freedoms, and the exercise of your rights, e.g. we will establish an adequate level of data protection through EU Standard Contractual Clauses based on the EU Commission’s model clauses.

Exercising your information rights

Your rights under data protection law may include the following (where applicable):

If you make your request electronically (such as by email), we will, where possible, provide the relevant information electronically unless you ask us otherwise.

We are obliged to respond without undue delay. In most instances, we will respond within one calendar month unless we are unable to deal with your request fully within a calendar month due to the complexity or number of requests You can assist us in responding to your request by including any additional details that would help to locate your information – such as; the type of personal data involved, relevant dates or appropriate reference number or the circumstances in which the CRU obtained your personal data.

Please note: In certain circumstances, your information rights may be restricted in accordance with GDPR Article 23 as transposed by Section 60 of the Data Protection Act 2018.

Completion of this form will assist in responding to your request to access your personal data held by CRU. You may also be asked for evidence of your identity to make sure that personal information is not given to the wrong person.

You have the right to complain to the Data Protection Commission or another supervisory authority.

You can contact the Data Protection Commission at https://www.dataprotection.ie/docs/Contact-us/b/11.html

How to contact us and our Data Protection Officer

If you have any questions about this notice or your personal information in the CRU generally, including questions about accessing your personal information or correcting it, please contact our Data Protection Officer at

Changes to this notice

We will update this Privacy Notice from time to time. Any changes will be made available on this web page and, where appropriate, notified to you by e-mail or when you contact the CRU again.