Human Tissue (Transplantation, Post-Mortem, Anatomical Examination and Public Display) Act 2024

108. In proceedings for an offence under this Act, it shall be a defence for a person against whom such proceedings are brought to show all or any of the following:

(a) that he or she took reasonable steps to ensure compliance with such provisions of this Act as are alleged to have been contravened;

(b) that at the time of the activity, the person reasonably believed that the activity was carried out in accordance with the requirements of this Act.

109. Sharing of information in certain circumstances

109. (1) Where, in the opinion of a relevant body, having had regard to the functions of the relevant body, it is necessary for the purposes of the safety of patients or in respect of Part 3 where it is in the public interest that such information be shared with one or more other relevant bodies for the performance by any such relevant body of its functions under this Act, the relevant body may share information provided to it, or as the case may be, to him or her under, and in accordance with, this Act with any such other relevant body.

(2) A relevant body shall use any information provided to it under this section solely for the purpose of the performance by it of its functions under and in accordance with this Part.

(3) In this section—

“Act of 1962” means the Coroners Act 1962;

“relevant body” means any or all of the following:

(a) the coroner (within the meaning of the Act of 1962) for the coroner’s district (within the meaning of the Act of 1962) in which a notifiable incident has occurred;

(b) Medical Council;

(c) the Health Products Regulatory Authority;

(d) the Health and Safety Authority;

(e) a body established by or under any enactment (other than the Companies Act 2014) whose functions include the carrying on of post-mortem activities.

110. Data protection

110. (1) Subject to this section and such regulations (if any) as may be made under subsection (8), personal data may be processed by a person in accordance with the Data Protection Regulation and the Act of 2018 for the purposes for the performance of functions under Parts 2, 3, 4 and 5.

(2) For the purposes of Part 2, the Executive is designated as a data controller in relation to personal data processed pursuant to subsection (1).

(3) For the purposes of Part 3, the Executive is designated as a data controller in relation to personal data processed pursuant to subsection (1).

(4) For the purposes of Part 4, a licensed institution is designated as a data controller in relation to personal data processed pursuant to subsection (1).

(5) For the purposes of Part 5, a Part 5 licence holder is designated as a data controller in relation to personal data processed pursuant to subsection (1).

(6) Subject to subsection (7), personal data processed for the purposes referred to in subsection (1) shall not be retained for any period beyond which it is required and shall be permanently deleted after it is no longer required.

(7) Notwithstanding subsection (6), where personal data processed in accordance with this section is required for the purposes of the prevention, investigation, detection or prosecution of a criminal offence, the data—

(a) may be processed for as long as it is required for such prevention, investigation, detection or prosecution, and

(b) shall be permanently deleted after it is no longer required for such prevention, investigation, detection or prosecution.

(8) The Minister may for the purposes of this Act, prescribe by regulations—

(a) the personal data that may be processed,

(b) the circumstances in which the personal data may be processed, including specifying the persons to whom the data may be disclosed, and

(c) such other conditions (if any) as the Minister considers appropriate to impose on such processing.

(9) In this section—

“Act of 2018” means the Data Protection Act 2018;

“Data Protection Regulation” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016[^1] on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);

“licensed institution” has the same meaning as it has in section 61;

“Part 5 licence holder” has the same meaning as it has in section 84;

“personal data” has the meaning it has in the General Data Protection Regulation;

“processing”, in relation to personal data, has the meaning it has in the General Data Protection Regulation.