Data Sharing and Governance Act 2019

• Permanent Page URL

PART 3

Regulation of Data-sharing

Data-sharing: requirements

13. (1) This section applies to the disclosure of personal data by a public body to another public body, where there is no other enactment or law of the European Union in operation under which specific provision is made permitting or requiring such data-sharing.

(2) A public body may disclose personal data to another public body, in a case in which this section applies to such disclosure, only where—

(a) the personal data concerned is disclosed—

(i) for the purpose of the performance of a function of the first or second mentioned public body, and

(ii) for one or more of the following purposes:

(I) to verify the identity of a person, where the first or second mentioned public body is providing or proposes to provide a service to that person;

(II) to identify and correct erroneous information held by the first or second mentioned public body;

(III) to avoid the financial or administrative burden that would otherwise be imposed on a person to whom a service is being or is to be delivered by the first or second mentioned public body were the second mentioned public body to collect the personal data directly from that person;

(IV) to establish the entitlement of a person to the provision of a service being delivered by the first or second mentioned public body, on the basis of information previously provided by that person to the first mentioned public body (or another public body that previously disclosed the information to the first mentioned public body);

(V) to facilitate the administration, supervision and control of a service, programme or policy delivered or implemented or being delivered or implemented, as the case may be, by, for or on behalf of the first or second mentioned public body;

(VI) to facilitate the improvement or targeting of a service, programme or policy delivered or implemented or to be delivered or implemented, as the case may be, by, for or on behalf of the first or second mentioned public body;

(VII) to enable the evaluation, oversight or review of a service, programme or policy delivered or implemented or being delivered or implemented, as the case may be, by, for or on behalf of the first or second mentioned public body;

(VIII) to facilitate an analysis of the structure, functions, resources and service delivery methods of the first or second mentioned public body,

(b) the personal data concerned is disclosed under and in accordance with a data-sharing agreement in compliance with Part 4,

(c) the first and second mentioned public body—

(i) comply with the rules, procedures and standards, if any, prescribed under section 64 ,

(ii) have regard to the guidelines, if any, issued under section 65 , and

(iii) where subsection (3) of section 66 applies, comply with that subsection,

(d) in a case in which the second mentioned public body is engaged for gain in the production, supply or distribution of goods or the provision of services, the use by that public body of the personal data could not lead to the distortion of competition in trade in those goods or services in the State or in any part of the State,

(e) the personal data concerned has been lawfully obtained and held by the first mentioned public body, and

(f) the personal data concerned is disclosed in accordance with the other provisions of this Act applicable to a disclosure of personal data to which this section applies and any other enactment or law of the European Union applicable to the first or second mentioned public body, and

(g) the disclosure of the personal data is—

(i) necessary for the performance of the functions in relation to which the information is being disclosed, and

(ii) proportionate in the context of the performance of those functions and the effects of the disclosure on the rights of the data subjects concerned.

(3) Subsection (2)(b) shall not apply to the disclosure of personal data under Part 5.