Vehicle Registration Data (Automated Searching and Exchange) Act 2018

Recording of automated supply of personal data

6. (1) The national contact point in the State shall, in relation to requests for supply of personal data under section 3 or 4 , whether or not data are supplied, record such requests and, where appropriate, the supply and receipt of such data.

(2) The recording in accordance with subsection (1) of the supply and receipt of personal data shall be in a permanent legible form or be capable of being converted into a permanent legible form and shall include the following information in relation to the data:

(a) a description of the data supplied or received;

(b) the date and time of the supply or receipt of the data;

(c) the name or reference code of the national contact point of the designated state concerned;

(d) the reason for the search for the data supplied or received;

(e) the identifier of the authorised officer who carried out the search and that of the authorised officer who approved the search or request.

(3) Records created under this section may be used only for the purposes of monitoring data protection and ensuring data security.

(4) The national contact point in the State shall—

(a) retain records created under this section for a period of 2 years from the date of their creation, and

(b) immediately after that period, delete those records.

(5) Whenever requested to do so by the Data Protection Commissioner, the national contact point in the State shall furnish to the Data Protection Commissioner records created under this section as soon as practicable, but in any event not later than 4 weeks, after the receipt of a request to do so.

(6) The national contact point in the State shall—

(a) using the records created under this section, carry out random checks on the lawfulness of the supply and receipt by it of data,

(b) keep the results of those random checks for a period of 18 months from the time they were carried out for the purposes of inspection by the Data Protection Commissioner, and

(c) immediately after that period, delete those results.