Data Sharing and Governance Act 2019

Cited as:IR No. 5/2019
Jurisdiction:Ireland


Data Sharing and Governance Act 2019

2019 5

An Act to provide for the regulation of the sharing of information, including personal data, between public bodies; to provide for the regulation of the management of information by public bodies; to provide for the establishment of base registries; to provide for the collection of public service information; to establish the Data Governance Board; to amend the Taxes Consolidation Act 1997; to amend the Social Welfare Consolidation Act 2005; to amend the Ministers and Secretaries (Amendment) Act 2011; to amend the National Shared Services Office Act 2017; and to provide for related matters.

[4 March 2019]

1 Preliminary and General

PART 1

Preliminary and General

S-1 Short title and commencement

1 Short title and commencement

(1) This Act may be cited as the Data Sharing and Governance Act 2019.

(2) This Act shall come into operation on such day or days as the Minister may by order or orders appoint either generally or with reference to any particular purpose or provision and different days may be so appointed for different purposes or different provisions.

S-2 Definitions

2 Definitions

2. In this Act—

“Act of 1997” means the Taxes Consolidation Act 1997;

“Act of 2005” means the Social Welfare Consolidation Act 2005;

“Act of 2014” means the Companies Act 2014;

“base registry” means a database which is designated as such in an order made undersection 37(1);

“base registry owner” means a public body specified as such in respect of a base registry in an order made undersection 37(1);

“Board” has the meaning assigned to it bysection 45(1);

“company” means a company formed and registered under the Act of 2014 or an existing company within the meaning of that Act;

“controller” has the same meaning as it has in the General Data Protection Regulation;

“data protection impact assessment” means an assessment carried out for the purposes of Article 35 of the General Data Protection Regulation;

“data protection law” means—

(a) the Data Protection Acts 1988 to 2018,

(b) the General Data Protection Regulation,

(c) all law of the State giving further effect to the General Data Protection Regulation, and

(d) all law of the State giving effect or further effect to Directive 2016/680;

“data protection officer” in respect of a public body, means the person designated in accordance with Article 37 of the General Data Protection Regulation;

“data-sharing” shall be construed in accordance withsection 9;

“data-sharing agreement” means an agreement between two or more public bodies which provides for the disclosure of information by one or more of the parties to the agreement to one or more of the other parties to the agreement;

“data subject” has the same meaning as it has in the General Data Protection Regulation;

“database” has the same meaning as it has in the Copyright and Related Rights Act 2000;

“Directive 2016/680” means Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA1 1;

“enactment” has the same meaning as it has in the Interpretation Act 2005;

“General Data Protection Regulation” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC2 2;

“information” includes data;

“information system” has the same meaning as it has in the Electronic Commerce Act 2000;

“lead agency” has the meaning assigned to it bysection 21;

“Minister” means the Minister for Public Expenditure and Reform;

“personal data” has the same meaning as it has in the General Data Protection Regulation;

“prescribed” means prescribed by regulations made by the Minister undersection 3(1);

“processing” has the same meaning as it has in the General Data Protection Regulation;

“public body” shall be construed in accordance withsection 10;

“public service pension scheme” has the same meaning as it has in Part 4 of the Public Service Pay and Pensions Act 2017;

“special categories of personal data” means information referred to in Article 9(1) of the General Data Protection Regulation.

1 OJ No. L 119, 4.5.2016, p. 89.

2 OJ No. L 119, 4.5.2016, p. 1.

S-3 Regulations and Orders

3 Regulations and Orders

(1) The Minister may by regulations provide for any matter referred to in this Act as prescribed or to be prescribed.

(2) Without prejudice to any provision of this Act, regulations under this section may contain such incidental, supplementary and consequential provisions as appear to the Minister to be necessary or expedient for the purposes of the regulations.

(3) Every order (other than an order under section 1(2)) and regulation under this Act shall be laid before each House of the Oireachtas as soon as may be after it is made and, if a resolution annulling the order or regulation is passed by either such House within the next 21 days on which that House sits after the order or regulation is laid before it, the order or regulation shall be annulled accordingly, but without prejudice to the validity of anything previously done thereunder.

S-4 Expenses

4 Expenses

4. The expenses incurred by the Minister in the administration of this Act shall be paid out of monies provided by the Oireachtas.

2 Application of Act

PART 2

Application of Act

S-5 Application of Act to special categories of personal data

5 Application of Act to special categories of personal data

5. This Act, other than Part 5, Part 8 and Chapter 3 of Part 9, shall not apply to special categories of personal data.

S-6 Interaction with Data Protection Acts and General Data Protection Regulation

6 Interaction with Data Protection Acts and General Data Protection Regulation

(1) Subject to subsections (2) and (3), nothing in this Act shall affect the operation of data protection law.

(2) Section 38 of the Data Protection Act 2018 shall not apply to the disclosure of information by one public body to another public body.

(3) Regulations made under section 38(4) of the Data Protection Act 2018 shall not constitute an enactment under which specific provision is made permitting or requiring data-sharing for the purpose of sections 13(1), 15(1) or 34(1).

S-7 Interaction with Social Welfare Consolidation Act 2005

7 Interaction with Social Welfare Consolidation Act 2005

(1) Subject to subsection (2), this Act, other than Part 5 and Chapter 3 of Part 9, does not affect the operation of the Act of 2005.

(2) Notwithstanding section 262(6)(b) of the Act of 2005, a specified body (in this section referred to as the “first mentioned specified body”) may, subject to subsection (3), disclose the information comprised in a person’s public service identity to another specified body (in this section referred to as the “second mentioned specified body”), where the information is disclosed in accordance with this Act.

(3) The first mentioned specified body may not disclose the information comprised in a person’s public service identity to the second mentioned specified body for the purpose specified in section 13(2)(a)(ii)(VIII).

(4) The reference in subsections (2) and (3) to the disclosure of the information referred to in those subsections includes the accessing of that information by the second mentioned specified body where that information is contained in a base registry in respect of which the first mentioned specified body is the base registry owner.

(5) In this section—

“specified body” has the same meaning as it has in section 262 of the Act of 2005;

“public service identity” has the same meaning as it has in section 262 of the Act of 2005, subject to the modification that the reference, in the definition of that phrase in subsection (1) of that section, to information specified in subsection (3) of that section shall not include a reference to special categories of personal data.

S-8 Interaction with other enactments

8 Interaction with other enactments

(1) Subject to section 34(3), nothing in this Act shall affect the operation of section 851A of the Act of 1997.

(2) Subject to section 64(3), this Act shall not apply to information—

(a)

collected for statistical purposes in accordance with the Statistics Act 1993, or

(b)

disclosed in accordance with regulations made under section 2 of the Vital Statistics and Births, Deaths and Marriages Registration Act 1952.

(3) This Act, other than Chapter 3 of Part 9, shall not apply to the disclosure of information under the Civil Registration Act 2004.

S-9 Data-sharing: meaning

9 Data-sharing: meaning

(1) In this Act, “data-sharing” means the disclosure of information, including personal data, by a public body to another public body.

(2) For the purposes of this Act, an addition or change to the information held on an information system under the control of a public body that results automatically from an addition or change to information held on an information system under the control of another public body, is deemed to be a disclosure by the second mentioned public body to the first mentioned public body of the information so added or changed on the information system under the control of the first mentioned public body.

S-10 Public body: meaning

10 Public body: meaning

(1) In this Act, “public body” means—

(a)

a Minister of the Government,

(b)

the Attorney General,

(c)

the Comptroller and Auditor General,

(d)

the Revenue Commissioners,

(e)

the Commissioners of Public Works in Ireland,

(f)

the Commissioner of Valuation,

(g)

the Garda Síochána,

(h)

the Defence Forces,

(i)

a local authority for the purposes of the Local Government Act 2001,

(j)

the Health Service Executive,

(k)

an education and training...

To continue reading

Request your trial