Stephen Donnelly (Wicklow, Fianna Fail)
Link to this: Individually | In context | Oireachtas source

The formalisation of data sharing arrangements was introduced by the General Data Protection Regulation (GDPR) and Data Protection Act 2018, and was supplemented by the Data Sharing and Governance Act 2019, with the commencement of final sections of that Act coming into effect on 16th December 2022. A schedule of personal or person-specific data is therefore not available for the last 20 years.

Personal data held by my Department is shared with other Government Departments and Agencies in the performance of its official functions, and to comply with certain legal obligations. In such cases the disclosure is made in a manner consistent with the original purpose for which the information was provided.

The personal data sets that this Department share are varied in nature depending on the nature of the tasks required. A high-level Privacy Statement is available on my Department’s website. These Notices provide individuals with information on how their personal data is being used, for what purpose, who has access to this data and how the sharing of their data may impact them. Personal data is only shared by my Department where there is a specified, explicit, and legitimate need for such sharing.

Technical and organisational safeguards are in place to protect the personal data that is being disclosed or received. My Department has also appointed a Data Officer and Data Protection Officer to provide assistance to staff in meeting obligations under legislation.

Where Data Sharing Agreements fall under the Data Sharing and Governance Act 2019, all documentation is subject to prior approval by the new Data Governance Board under the Department of Public Expenditure, NDP Delivery and Reform. These Agreements are also subject to a public consultation process prior to final approval by the Board and publication. My Department and its Offices also adhere to all recommendations provided by the Data Protection Commission (DPC) in relation to the processing and sharing of personal data.

Finally, I wish to assure the Deputy that my Department and the Offices under its aegis have an effective governance framework in place to ensure that we meet our obligations under data protection laws, the Data Sharing and Governance Act and Health legislation in respect of our data processing and sharing activities.