DATA SHARING AND GOVERNANCE ACT 2019

• (d) advise the Minister in relation to the monitoring of compliance by public bodies with rules, procedures and standards prescribed under section 64 and guidelines issued under section 65,

• (e) review data-sharing agreements in accordance with Chapter 2,

• (f) advise the Minister in relation to the making of an order under section 37(1), and

• (g) advise the Minister, on request, in relation to the performance of the functions of the Minister under this Act.

• (2) The Board may exercise its functions notwithstanding one or more vacancies in its membership.

• (3) The Board may regulate its own procedure.

• (4) The Minister shall provide such administration and support services to the Board as are necessary for the performance of the functions of the Board.

• (5) The Minister may enter into an arrangement for the provision of consultancy, advice or other services to the Board.

47. Membership of Board and related matters

47. (1) The Board shall consist of not less than 6 and not more than 12 members.

• (2) The members of the Board shall be appointed by the Minister.

• (3) The Minister, in appointing the members of the Board, shall ensure that the members are persons who have the necessary knowledge, experience and competence in relation to the functions of the Board, including in relation to the protection of personal data.

• (4) When appointing members of the Board, the Minister shall have regard to—

• (a) the objective that at least 40 per cent of members of the Board shall be women and at least 40 per cent shall be men, and

• (b) the guidelines, if any, prepared by the Minister in relation to appointments to boards of State bodies.

• (5) The Minister may, following consultation with the Minister, if any, in whom functions in relation to the public body are vested, appoint a person who is an employee of, or holds an office or other position in, a public body to be a member of the Board.

• (6) The Minister may appoint not less than 2 persons who are not employees of, or the holders of an office or other position in, a public body to be a member of the Board.

• (7) The Minister shall ensure, where practicable, that not less than one third of the members of the Board are appointed pursuant to subsection (6).

• (8) The Minister may from time to time appoint one member of the Board to act as its Chairperson.

• (9) The Minister shall determine the terms and conditions of appointment of a member of the Board on appointment.

• (10) Subject to subsection (11), each member of the Board shall hold office for 3 years from the date of his or her appointment.

• (11) A person’s appointment under subsection (5) shall be terminated with effect from the earlier of—

• (a) the date on which the person ceases to be employed by, or to hold an office or other position in, the public body concerned, and

• (b) the date that is 3 years from the date of their appointment.

• (12) A member of the Board whose term of office expires by the effluxion of time or whose appointment is terminated in accordance with subsection (11) shall be eligible for reappointment to the Board, but the total period of membership of the Board of a person shall not exceed 9 years.

• (13) A member of the Board who is not employed by, or does not hold an office or position in, a public body may be paid, out of moneys provided by the Oireachtas, such remuneration and allowances for vouched expenses incurred by the member as the Minister may determine.

48. Committees

48. (1) The Board may establish such committees as it considers necessary or desirable to advise it in the performance of its functions and may appoint such members to such a committee as it considers necessary.

• (2) A committee established under subsection (1) may include persons who are not members of the Board, but shall include not less than one member of the Board.

• (3) The Board shall determine the terms of reference and procedures of a committee established under subsection (1).

• (4) A member of a committee established under subsection (1) who is not a member of the Board may be paid, out of moneys provided by the Oireachtas, such remuneration and allowances for vouched expenses incurred by the member as the Minister may determine.

• (5) A committee established under subsection (1) shall prepare and submit a report on its activities to the Board on a regular basis.

• (6) A report prepared and submitted by the Board under section 52 shall include a summary of the activities of the committees, if any—

• (a) established under subsection (1), and

• (b) in existence in the period to which the report relates.

• (7) A committee established under subsection (1) may be dissolved by a resolution of the Board at any time and shall stand dissolved on the date that is 2 years from the date of its establishment, unless the Board resolves that the committee is to continue in existence.

49. Disqualification from membership of Board

49. A person shall cease to be qualified to become a member of, and shall cease to be a member of, the Board if he or she—

• (a) is nominated as a member of Seanad Éireann,

• (b) is elected as a member of either House of the Oireachtas or of the European Parliament,

• (c) is regarded pursuant to Part XIII of the Second Schedule to the European Parliament Elections Act 1997 as having been elected to the European Parliament,

• (d) is a Judge, Advocate General or Registrar of the Court of Justice of the European Union,

• (e) is a member of the Commission of the European Union,

• (f) is a member of the Court of Auditors of the European Union,

• (g) is appointed under the Constitution as a Judge or as the Comptroller and Auditor General,

• (h) becomes a member of a local authority,

• (i) becomes a Commissioner for Data Protection or a member of staff of the Data Protection Commission,

• (j) has not been issued with a tax clearance certificate in accordance with section 1095 of the Act of 1997 or has been issued with a tax clearance certificate under that section which has been rescinded under subsection (3A) of that section,

• (k) is undergoing a sentence of imprisonment for any term exceeding 6 months imposed by a court of competent jurisdiction in the State,

• (l) is disqualified or restricted from being a director of any company, or

• (m) is adjudicated bankrupt.

50. Resignation from membership

50. (1) A member of the Board may resign by notice in writing to the Chairperson or, where that member is the Chairperson, by notice in writing to the Minister.

• (2) A resignation under subsection (1) shall take effect on—

• (a) the date specified in the notice, or

• (b) where no date is specified in the notice, the date on which the Chairperson or Minister, as the case may be, receives the notice.

• (3) A person shall be taken to have resigned as a member of the Board where the person is absent, due to illness, from more than 50 per cent of the meetings of the Board held during a 12 month period commencing on the date of a meeting.

• (4) A resignation under subsection (3) shall take effect on the next day after the end of the 12 month period concerned.

• (5) A person who resigns as a member of the Board under this section also ceases on such resignation to be a member of any body to which he or she was elected, nominated or appointed by the Board.

51. Casual vacancies

51. If a member of the Board—

• (a) dies,

• (b) resigns,

• (c) ceases to be qualified for office and ceases to hold office, or

• (d) is removed from office in accordance with their terms and conditions of appointment,

the Minister may appoint a person to be a member of the Board to fill the casual vacancy so occasioned in the same manner as the member of the Board who occasioned the casual vacancy was appointed.

52. Reporting

52. (1) The Board shall, not later than 30 June in each year, prepare and submit to the Minister a report on—

• (a) the performance by it of its functions under this Act, and

• (b) the matters, if any, on which advices have been provided to it by the committees, if any, established under section 48(1),

in the immediately preceding year, or, in the case of the period from the date the Board is first appointed to the next following 30 June, that period.

• (2) The Minister shall, as soon as may be after receiving a report under subsection (1)—

• (a) cause copies of it to be laid before each House of the Oireachtas, and

• (b) publish a copy of it on a publicly accessible website.

Chapter 2 Review of Data Sharing Agreements

53. Definitions (Chapter 2)

53. In this Chapter—

“designated lead agency”, in relation to a proposed agreement, means the public body specified as the lead agency therein;

“proposed agreement” means—

• (a) a draft data-sharing agreement under which it is proposed that personal data will be disclosed following execution of the draft agreement, or

• (b) an existing data-sharing agreement, as amended by a draft amendment agreement, under which it is proposed that personal data will be, or will continue to be, disclosed following execution of the draft agreement;

“proposed party”, in relation to a proposed agreement, means a public body that is proposed to be a party thereto.

54. Exclusions (Chapter 2)

54. This Chapter shall not apply to an amendment to a data-sharing agreement for the purpose of—

• (a) updating the schedule referred to in section 19(1)(a), or

• (b) reflecting a change to the lead agency in accordance with section 21(3)(c).

55. Public consultation

55. (1) Each of the proposed parties to a proposed agreement shall publish on a website accessible to the public—

• (a) a copy of the proposed agreement,

• (b) where a data protection impact assessment has been carried out in relation to the processing proposed to be undertaken under the proposed agreement, a summary of the matters referred to in Article 35(7) of the General Data Protection Regulation,

• (c) where no data protection impact assessment has been carried out in relation to the processing proposed to be undertaken under the proposed agreement, a summary of the reasons why no data protection impact assessment has been carried out,

• (d) a statement from the data protection officer of each of the proposed parties to the effect that the data protection officer concerned—

• (i) has reviewed the proposed agreement, and

• (ii) is satisfied that compliance by the proposed parties with the terms of the proposed agreement would not result in a contravention of data protection law,

• (iii) is satisfied that the agreement is consistent with Article 5(1) of the General Data Protection Regulation,

and

• (e) a notice—

• (i) stating that the proposed party is intending to enter into the proposed agreement,

• (ii) stating where, on a website accessible to the public, the documents referred to in paragraphs (a) to (d) can be accessed,

• (iii) inviting the making, during the period specified by the Board for this purpose, of submissions in relation to the proposed agreement to the designated lead agency, and

• (iv) stating the date of publication of the notice.

• (2) The proposed parties to a proposed agreement shall publish the information referred to in subsection (1) on the same date.

• (3) The designated lead agency concerned shall notify the Board of the publication of the information referred to in subsection (1).

• (4) The proposed parties to a proposed agreement shall consider the submissions, if any, made in response to the invitation referred to in subsection (1)(e)(iii) and may, where those proposed parties consider it appropriate, amend the proposed agreement concerned to take into account any such submissions.

56. Submission of documentation and information to Board

56. (1) The designated lead agency concerned shall, within the period specified by the Board for this purpose, submit the following to the Board:

• (a) a copy of the proposed agreement (as amended in accordance with section 55(4), where applicable);

• (b) where a data protection impact assessment has been carried out in relation to the processing proposed to be undertaken under the proposed agreement, a summary of the matters referred to in Article 35(7) of the General Data Protection Regulation;

• (c) the statements referred to in section 55(1)(d);

• (d) such information as the Board may specify in relation to the submissions, if any, made in response to the invitation referred to in section 55(1)(e)(iii).

• (2) The designated lead agency concerned shall provide such additional information relating to the proposed agreement as is requested by the Board, following receipt of the documentation referred to in subsection (1), within the period specified by the Board for this purpose.

57. Review of data-sharing agreement

57. (1) The Board shall review the documentation submitted under section 56(1) and the additional information, if any, provided under section 56(2).

• (2) The Board shall have regard to the following matters when carrying out a review under this section:

• (a) the extent to which the proposed agreement concerned complies with this Act;

• (b) the extent to which the proposed agreement concerned reflects the model agreement, if any, prepared or revised under section 66(1) for the purpose of the enactment in connection with which the proposed agreement is to be entered into;

• (c) whether compliance by the proposed parties with the terms of the proposed agreement concerned would result in a contravention of data protection law;

• (d) where a data protection impact assessment has been carried out in relation to the processing proposed to be undertaken under the proposed agreement concerned, the summary of the matters referred to in Article 35(7) of the General Data Protection Regulation submitted in accordance with section 56(1)(b);

• (e) the extent to which the proposed agreement concerned complies with the orders and regulations, if any, made under this Act;

• (f) the provisions of the proposed agreement concerned relating to the security measures to apply to the transmission, storage and accessing of personal data;

• (g) the submissions, if any, made in response to the invitation referred to in section 55(1)(e)(iii);

• (h) whether, in the opinion of the Board, the proposed agreement concerned is in the public interest.

• (3) The Board may, when carrying out a review under this section, consult with the Ministers of the Government, if any, in whom functions relating to the proposed parties to the proposed agreement concerned are vested and such other person as the Board considers appropriate having regard to the subject matter of the proposed agreement concerned.

• (4) The Board shall notify the designated lead agency concerned following completion of the Board’s review under this section.

• (5) A notification under subsection (4) shall—

• (a) specify the recommendations, if any, of the Board as regards amendments to the proposed agreement concerned,

• (b) where the Board is of the view that its recommendations concern substantive issues, state that the proposed agreement is to be submitted to the Board following amendment for further review under this section.

• (6) The proposed parties to the proposed agreement concerned shall take account of the recommendations, if any, notified to the designated lead agency under subsection (4) and amend the proposed agreement accordingly.

58. Amendments following review

58. Where a proposed agreement is amended following receipt of a notification under section 57(4) containing the statement referred to in section 57(5)(b), the designated lead agency shall submit the proposed agreement, as amended, to the Board and section 57 shall apply as if the amended agreement was documentation submitted under section 56(1).

59. Execution of agreement

59. Where, following a review of a proposed agreement under section 57—

• (a) the Board does not specify any recommendations in the notification given under section 57(4) on foot of the review, or

• (b) the Board specifies recommendations in the notification given under section 57(4) on foot of that review and the following conditions are met:

• (i) the notification does not contain the statement referred to in section 57(5)(b);

• (ii) the proposed parties are satisfied that the amendments made by them to the proposed agreement take account of the recommendations in that notification,

the proposed agreement may be executed by the proposed parties.

60. Publication

60. (1) The lead agency in respect of a data-sharing agreement shall send to the Minister—

• (a) within 10 days of the execution of the agreement, a copy of the agreement, and

• (b) within 10 days of the accession to or withdrawal from the agreement of any party, notification of such accession or withdrawal in writing.

• (2) The Minister shall cause copies of the documents received by him or her under subsection (1)—

• (a) to be laid before each House of the Oireachtas, and

• (b) to be sent to the Board.

• (3) The Minister shall publish, on a website maintained by him or her, a list of all documents received by him or her under subsection (1).

• (4) The lead agency in respect of a data-sharing agreement shall publish a copy of the agreement on the website maintained by it as soon as practicable after sending a copy of the agreement to the Minister in accordance with subsection (1).

• (5) The Board shall publish the following on the website maintained by it following receipt of a copy of the data-sharing agreement in accordance with subsection (2):

• (a) a copy of the agreement;

• (b) where a data protection impact assessment has been carried out in relation to the processing proposed to be undertaken under the proposed agreement, a summary of the matters referred to in Article 35(7) of the General Data Protection Regulation;

• (c) a copy of the recommendations, if any, made under section 57(2).

• (6) The Minister shall, on request from a Committee, send a copy of a data-sharing agreement received by him or her under subsection (1) to that Committee.

• (7) In subsection (6), “Committee” means a Committee appointed by either House of the Oireachtas or jointly by both Houses of the Oireachtas, other than—

• (a) the Committee on Members’ Interests of Dáil Éireann or the Committee on Members’ Interests of Seanad Éireann, or

• (b) a subcommittee of a Committee referred to in paragraph (a).

61. Effective date of agreement

61. A data-sharing agreement under which it is proposed that personal data will be disclosed shall come into effect on the date of its publication in accordance with section 60(4).

62. Time periods and documentation

62. (1) The Board shall specify—

• (a) the time periods referred to in section 55(1)(e)(iii) and section 56, and

• (b) the information to be submitted in accordance with section 56(1)(d).

• (2) The time period specified by the Board for the purposes of section 55(1)(e)(iii) shall not be less than 14 days.

Chapter 3 Governance

63. Application (Chapter 3)

63. This Chapter applies to—

• (a) personal data (including special categories of personal data), and

• (b) information other than personal data.

64. Rules, procedures and standards

64. (1) The Minister may, for the purposes referred to in subsection (2), prescribe rules, procedures and standards in relation to—

• (a) the operation and use of base registries,

• (b) the accessing of personal data by persons—

• (i) employed by, or holding an office or other position in a public body, or

• (ii) employed by a person acting for or on behalf of a public body,

• (c) the recording of information relating to the accessing of personal data held by, or for or on behalf of, public bodies,

• (d) the management, preparation and publication of information for re-use by persons other than public bodies,

• (e) the processing of personal data by a public body designated in an order made under section 10(4),

• (f) the conduct of data protection impact assessments by public bodies, and

• (g) other matters relating to the management of information held by public bodies.

• (2) The purposes referred to in subsection (1) are as follows:

• (a) to improve the quality and accuracy of information created, held and maintained by public bodies;

• (b) to promote increased sharing of information between public bodies in accordance with this Act and any other enactment providing for such sharing of information;

• (c) to ensure a consistent approach to the management of information by public bodies so as to facilitate the exchange of information between them;

• (d) to increase the usefulness of information held by public bodies for the purposes of—

• (i) performing their functions,

• (ii) modernising and developing public services,

• (iii) evaluating the effectiveness of services provided by public bodies, and

• (iv) evaluating the effectiveness of expenditure by public bodies;

• (e) to ensure that information is managed by public bodies in accordance with international best practice as regards data protection;

• (f) to improve the availability and accessibility for re-use and redistribution of information, other than personal data, held by public bodies.

• (3) A rule, procedure or standard prescribed under subsection (1)(a) shall apply to information—

• (a) collected for statistical purposes in accordance with the Statistics Act 1993, or

• (b) disclosed in accordance with regulations made under section 2 of the Vital Statistics and Births, Deaths and Marriages Registration Act 1952.

65. Guidelines

65. (1) The Minister may, after consultation with such (if any) other Ministers of the Government as the Minister considers appropriate, prepare and issue guidelines (including guidelines in relation to rules, procedures or standards prescribed under section 64) to assist public bodies in the performance of their functions under this Act or other enactments relating to data-sharing.

• (2) Public bodies shall have regard to the guidelines, if any, issued under this section in the performance of their functions under this Act and the provisions of other enactments relating to data-sharing.

66. Model agreements

66. (1) The Minister may, after consultation with such (if any) other Ministers of the Government as the Minister considers appropriate, prepare or revise model data-sharing agreements for the purpose of this Act or another enactment relating to data-sharing.

• (2) The Minister may request the Board to provide advice in relation to the preparation or revision of model data-sharing agreements.

• (3) Where a model data-sharing agreement has been prepared or revised, as the case may be, for the purpose of an enactment under subsection (1), a public body entering into a data-sharing agreement for the purpose of that enactment shall use the model data-sharing agreement as a basis for the data-sharing agreement to be entered into by it.

67. Publication of regulations and guidelines

67. The Minister shall publish, on a website maintained by him or her—

• (a) the rules, procedures and standards, if any, prescribed under section 64, and

• (b) the guidelines, if any, issued under section 65.

68. Compliance report

68. (1) The Board may by notification in writing request a public body to provide a compliance report within a particular time.

• (2) A public body shall provide the Board with a compliance report within the time period specified in a notification given to the public body under subsection (1).

• (3) In this section, “compliance report” means a statement signed by—

• (a) the person who is the accounting officer, in relation to the appropriation accounts of the public body concerned, for the purposes of the Comptroller and Auditor General Acts 1866 to 1998, or

• (b) where there is no such accounting officer, the person who holds, or performs the functions of, the office of chief executive officer (by whatever name called) of the public body,

detailing how the public body has complied with its obligations under this Act and the orders and regulations, if any, made under this Act.

PART 10 Miscellaneous

69. Prohibition on requests for certain documents

69. (1) The Minister may, following consultation with any relevant Minister of the Government and having had regard to the matters referred to in subsection (4), prescribe—

• (a) certain documents or classes of document the provision of which a public body shall not request from a person (other than a public body) in original, copy or electronic form, or

• (b) certain uses for the purposes of which a public body shall not request the provision of certain documents or classes of documents from a person (other than a public body) in original, copy or electronic form.

• (2) A public body shall not—

• (a) request a document or class of document which is prescribed under subsection (1)(a), or

• (b) request a document or class of document for the purposes of a use of such a document or class of document which is prescribed under subsection (1)(b).

• (3) In this section “relevant Minister of the Government” means a Minister of the Government the exercise of whose functions would be affected by the making of an order proposed to be made under subsection (1).

• (4) The matters to which the Minister is to have regard for the purposes of subsection (1) are as follows:

• (a) whether the proposed prohibition would facilitate the carrying out of a function of a public body by—

• (i) reducing the duplication of tasks carried out by one or more public bodies,

• (ii) increasing the efficiency of the public body in carrying out the function, or

• (iii) facilitating an improvement in the quality of services being delivered by one or more public bodies;

• (b) whether the proposed prohibition would reduce the need for a person to provide the same information to more than one public body.

70. Specification of information

70. (1) The Minister may, with the consent of such other (if any) Minister of the Government as the Minister considers appropriate having regard to the functions of that other Minister, for the purposes of—

• (a) ensuring greater consistency and accuracy of information held and managed by public bodies, and

• (b) increasing the usefulness of information held and used by public bodies for the purposes of—

• (i) performing their functions,

• (ii) modernising and developing public services,

• (iii) evaluating the effectiveness of services provided by public bodies, and

• (iv) evaluating the effectiveness of expenditure by public bodies,

direct a public body to collect information or classes of information specified in the direction.

• (2) A direction under subsection (1) may specify the format in which the information is to be stored following collection.

• (3) A public body to which a direction under subsection (1) applies shall comply with the direction.

• (4) This section applies to—

• (a) personal data (including special categories of personal data), and

• (b) information other than personal data,

whether or not the disclosure of that information is regulated by this or any other enactment.

71. Provision of information on data-sharing

71. (1) The Minister may direct a public body to provide him or her with the information specified in subsection (2).

• (2) The information referred to in subsection (1) is as follows:

• (a) a list of all data-sharing arrangements that that body has engaged in with other public bodies under this or any other enactment, setting out in respect of each such arrangement—

• (i) the names of the participants in the arrangement,

• (ii) the purpose of the data-sharing,

• (iii) the function of the public body concerned to which the purpose referred to in subparagraph (ii) relates,

• (iv) the legal basis for the data-sharing and any further processing, by the parties to the arrangement, of the information disclosed pursuant to the arrangement,

• (v) a description of the information disclosed pursuant to the arrangement,

• (vi) how the information is processed following its disclosure,

• (vii) any restrictions on the disclosure of information after the processing of such information referred to in subparagraph (vi),

• (viii) where a data protection impact assessment has been carried out, a summary of the matters referred to in Article 35(7) of the General Data Protection Regulation,

• (ix) the security measures applied to the transmission, storage and accessing of personal data, in a manner that does not compromise those security measures,

• (x) the requirements in relation to the retention of—

• (I) the information disclosed, and

• (II) the information resulting from the processing of that information,

for the duration of the arrangement and in the event that the arrangement is terminated, and

• (xi) the method employed or to be employed to destroy or delete—

• (I) the information disclosed, and

• (II) the information resulting from the processing of that information,

at the end of the period for which the information is to be retained in accordance with the arrangement;

• (b) any alteration of the data-sharing arrangements referred to in subsection (2) in the period since the public body last provided information on such data-sharing arrangements to the Minister;

• (c) such additional information as may be prescribed under subsection (5).

• (3) A direction under subsection (1) may specify that the information be provided—

• (a) on a periodic basis, or

• (b) on each occasion that a new arrangement is entered into or an existing arrangement is altered in any way.

• (4) A public body to which a direction under subsection (1) applies shall comply with the direction.

• (5) The Minister may, for the purposes of—

• (a) increasing transparency in the activities of public bodies as regards their sharing of information under this Act or any other enactment, and

• (b) promoting good governance in the sharing of information under this Act or any other enactment,

prescribe additional information to be provided by a public body in receipt of a direction under subsection (1).

• (6) The Minister shall publish, on a website maintained by him or her, all of the information received by him or her pursuant to a direction issued under subsection (1).

72. Amendment of Act of 1997

72. Section 917D of the Act of 1997 is amended in subsection (1) by the substitution of the following definition for the definition of “digital signature”:

“ ‘digital signature’ in relation to a person, means—

• (a) a qualified certificate (within the meaning of the Electronic Commerce Act 2000) provided to the person by the Revenue Commissioners (or a person appointed in that behalf by the Revenue Commissioners), and

• (b) an advanced electronic signature (within the meaning of that Act) generated using the qualified certificate referred to in paragraph (a);”.

73. Amendment of Ministers and Secretaries (Amendment) Act 2011

73. Section 17A of the Ministers and Secretaries (Amendment) Act 2011 is amended by the substitution of the following subsection for subsection (2):

• “(2) Information provided to the Minister under subsection (1) shall not include any personal data (within the meaning of the General Data Protection Regulation), unless that information is provided in accordance with Part 5 of the Data Sharing and Governance Act 2019.”.

74. Amendment of Social Welfare Consolidation Act 2005

74. Schedule 5 to the Act of 2005 is amended by the insertion, in paragraph 1(4), of “the National Shared Services Office,” after “the National Council for Special Education”.

75. Amendment of National Shared Services Office Act 2017

75. Section 6 of the National Shared Services Office Act 2017 is amended in subsection (1) by the substitution of “An Oifig Náisiúnta um Sheirbhísí Comhroinnte” for “Oifig Náisiúnta Seirbhísí Comhroinnte”.

SCHEDULE Bodies to which definition of “public body” does not apply

Section 10(5)

F1[25A. Uisce Éireann.]

Footnotes