Data Sharing and Governance Act 2019

Data Sharing and Governance Act 2019 Skip to content Disclaimer Feedback Helpdesk Gaeilge Léim go dtí an t-ábhar Séanadh Aiseolas Deasc chabhrach English Gaeilge English Produced by the Office of the Attorney General Táirgthe ag Oifig an Ard-Aighne Home Legislation Acts of the Oireachtas Statutory Instruments Pre-1922 Legislation Constitution External Resources Bills (Houses of the Oireachtas) Iris Oifigiúil / Official Gazette Revised Acts (LRC) Classified List of Legislation (LRC) Translations (acts.ie) Translations (Houses of the Oireachtas) Government Publications for Sale EU Law (EUR-Lex) FAQ Disclaimer Feedback Helpdesk Search Baile Reachtaíocht Achtanna an Oireachtais Ionstraimí Reachtúla Reachtaíocht Réamh-1922 Bunreacht Acmhainní Seachtracha Billí (Tithe an Oireachtais) Iris Oifigiúil Achtanna Athbhreithnithe (CAD) (An Coimisiún um Athchóiriú an Dlí) Liosta Rangaithe Reachtaíochta Aistriúcháin (achtanna.ie) Aistriúcháin (Tithe an Oireachtais) Foilseacháin Rialtais ar Díol Dlí AE (EUR-Lex) CCanna (Ceisteanna Coitianta) Séanadh Aiseolas Deasc chabhrach Cuardach TitleTeideal Year(s) or rangeBliain nó blianta nó raon TypeCineál All Legislation Acts Statutory Instruments Advanced SearchCuardach Casta HomeBaile ActsAchtanna 2019 Data Sharing and Governance Act 2019 Data Sharing and Governance Act 2019 Permanent Page URL View by SectionAmharc de réir Ailt View Full ActAmharc ar an Acht Iomlán Bill History Stair Bille Commencement, Amendments, SIs made under the Act Tosach Feidhme, Leasuithe, IRí arna ndéanamh faoin Acht Revised Act Acht Athbh… Open PDFOscail PDF Print Full ActPriontáil an tAcht Iomlán Number 5 of 2019 DATA SHARING AND GOVERNANCE ACT 2019 CONTENTS PART 1 Preliminary and General 1. Short title and commencement 2. Definitions 3. Regulations and Orders 4. Expenses PART 2 Application of Act 5. Application of Act to special categories of personal data 6. Interaction with Data Protection Acts and General Data Protection Regulation 7. Interaction with Social Welfare Consolidation Act 2005 8. Interaction with other enactments 9. Data-sharing: meaning 10. Public body: meaning 11. Deceased persons 12. Exclusions PART 3 Regulation of Data-sharing 13. Data-sharing: requirements 14. Directions PART 4 Data-sharing Agreements 15. Application (Part 4) 16. Obligation to enter into data-sharing agreement 17. Formal requirements 18. Accession to data-sharing agreement 19. Content of data-sharing agreement 20. Review of operation of data-sharing agreement 21. Lead agency 22. Cessation PART 5 Public service information 23. Definitions (Part 5) 24. Application (Part 5) 25. Administration of Single Public Service Pension Scheme 26. Administration of pre-existing public service pension schemes 27. Public service policy analysis 28. Information requests 29. Data protection impact assessment 30. Anonymisation 31. Pension scheme information systems 32. Transparency PART 6 Business Information 33. Definitions (Part 6) 34. Application (Part 6) 35. Allocation of unique business identifier number 36. Disclosure of business information PART 7 Base Registries 37. Designation of base registry 38. Base registry owner 39. Processing of information 40. Terms of service 41. Access to information 42. Obligation to use base registry PART 8 Personal Data Access Portal 43. Application (Part 8) 44. Establishment of personal data access portal PART 9 Data Governance Chapter 1 Data Governance Board 45. Appointment of Board 46. Functions of Board 47. Membership of Board and related matters 48. Committees 49. Disqualification from membership of Board 50. Resignation from membership 51. Casual vacancies 52. Reporting Chapter 2 Review of Data Sharing Agreements 53. Definitions (Chapter 2) 54. Exclusions (Chapter 2) 55. Public consultation 56. Submission of documentation and information to Board 57. Review of data-sharing agreement 58. Amendments following review 59. Execution of agreement 60. Publication 61. Effective date of agreement 62. Time periods and documentation Chapter 3 Governance 63. Application (Chapter 3) 64. Rules, procedures and standards 65. Guidelines 66. Model agreements 67. Publication of regulations and guidelines 68. Compliance report PART 10 Miscellaneous 69. Prohibition on requests for certain documents 70. Specification of information 71. Provision of information on data-sharing 72. Amendment of Act of 1997 73. Amendment of Ministers and Secretaries (Amendment) Act 2011 74. Amendment of Social Welfare Consolidation Act 2005 75. Amendment of National Shared Services Office Act 2017 SCHEDULE Bodies to which definition of “public body” does not apply Acts Referred to Civil Partnership and Certain Rights and Obligations of Cohabitants Act 2010 (No. 24) Civil Registration Act 2004 (No. 3) Civil Service Regulation Act 1956 (No. 46) Communications Regulation (Postal Services) Act 2011 (No. 21) Companies Act 2014 (No. 38) Comptroller and Auditor General Acts 1866 to 1998 Copyright and Related Rights Act 2000 (No. 28) Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 (No. 6) Criminal Justice (Terrorist Offences) Act 2005 (No. 2) Criminal Law Act 1976 (No. 32) Data Protection Act 2018 (No. 7) Data Protection Acts 1988 to 2018 Education Act 1998 (No. 51) Education and Training Boards Act 2013 (No. 11) Electronic Commerce Act 2000 (No. 27) Employment Equality Act 1998 (No. 21) European Parliament Elections Act 1997 (No. 2) Family Law (Divorce) Act 1996 (No. 33) Family Law Act 1995 (No. 26) Interpretation Act 2005 (No. 23) Irish Human Rights and Equality Commission Act 2014 (No. 25) Local Government Act 2001 (No. 37) Ministers and Secretaries (Amendment) Act 2011 (No. 10) National Shared Services Office Act 2017 (No. 26) Offences against the State Acts 1939 to 1998 Public Service Pay and Pensions Act 2017 (No. 34) Public Service Pensions (Single Scheme and Other Provisions) Act 2012 (No. 37) Public Service Superannuation (Miscellaneous Provisions) Act 2004 (No. 7) Social Welfare Consolidation Act 2005 (No. 26) Statistics Act 1993 (No. 21) Taxes Consolidation Act 1997 (No. 39) Vital Statistics and Births, Deaths and Marriages Registration Act 1952 (No. 8) Number 5 of 2019 DATA SHARING AND GOVERNANCE ACT 2019 An Act to provide for the regulation of the sharing of information, including personal data, between public bodies; to provide for the regulation of the management of information by public bodies; to provide for the establishment of base registries; to provide for the collection of public service information; to establish the Data Governance Board; to amend the Taxes Consolidation Act 1997 ; to amend the Social Welfare Consolidation Act 2005 ; to amend the Ministers and Secretaries (Amendment) Act 2011 ; to amend the National Shared Services Office Act 2017 ; and to provide for related matters. [4th March, 2019] Be it enacted by the Oireachtas as follows: PART 1 Preliminary and General Short title and commencement 1. (1) This Act may be cited as the Data Sharing and Governance Act 2019. (2) This Act shall come into operation on such day or days as the Minister may by order or orders appoint either generally or with reference to any particular purpose or provision and different days may be so appointed for different purposes or different provisions. Definitions 2. In this Act— “Act of 1997” means the Taxes Consolidation Act 1997 ; “Act of 2005” means the Social Welfare Consolidation Act 2005 ; “Act of 2014” means the Companies Act 2014 ; “base registry” means a database which is designated as such in an order made under section 37 (1); “base registry owner” means a public body specified as such in respect of a base registry in an order made under section 37 (1); “Board” has the meaning assigned to it by section 45 (1); “company” means a company formed and registered under the Act of 2014 or an existing company within the meaning of that Act; “controller” has the same meaning as it has in the General Data Protection Regulation; “data protection impact assessment” means an assessment carried out for the purposes of Article 35 of the General Data Protection Regulation; “data protection law” means— (a) the Data Protection Acts 1988 to 2018, (b) the General Data Protection Regulation, (c) all law of the State giving further effect to the General Data Protection Regulation, and (d) all law of the State giving effect or further effect to Directive 2016/680; “data protection officer” in respect of a public body, means the person designated in accordance with Article 37 of the General Data Protection Regulation; “data-sharing” shall be construed in accordance with section 9 ; “data-sharing agreement” means an agreement between two or more public bodies which provides for the disclosure of information by one or more of the parties to the agreement to one or more of the other parties to the agreement; “data subject” has the same meaning as it has in the General Data Protection Regulation; “database” has the same meaning as it has in the Copyright and Related Rights Act 2000 ; “Directive 2016/680” means Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA1 ; “enactment” has the same meaning as it has in the Interpretation Act 2005 ; “General Data Protection Regulation” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC2 ; “information” includes data; “information system” has the same meaning as it has in the Electronic Commerce Act 2000 ; “lead agency” has the meaning assigned to it by section 21 ; “Minister” means the Minister for Public Expenditure and Reform; “personal data” has the same meaning as it has in the General Data Protection Regulation; “prescribed” means prescribed by regulations made by the Minister under section 3 (1); “processing” has the same meaning as it has in the General Data Protection Regulation; “public body” shall be construed in accordance with section 10 ; “public service pension scheme” has the same meaning as it has in Part 4 of the Public Service Pay and Pensions Act 2017 ; “special categories of personal data” means information referred to in Article 9(1) of the General Data Protection Regulation. Regulations and Orders 3. (1) The Minister may by regulations provide for any matter referred to in this Act as prescribed or to be prescribed. (2) Without prejudice to any provision of this Act, regulations under this section may contain such incidental, supplementary and consequential provisions as appear to the Minister to be necessary or expedient for the purposes of the regulations. (3) Every order (other than an order under section 1 (2)) and regulation under this Act shall be laid before each House of the Oireachtas as soon as may be after it is made and, if a resolution annulling the order or regulation is passed by either such House within the next 21 days on which that House sits after the order or regulation is laid before it, the order or regulation shall be annulled accordingly, but without prejudice to the validity of anything previously done thereunder. Expenses 4. The expenses incurred by the Minister in the administration of this Act shall be paid out of monies provided by the Oireachtas. PART 2 Application of Act Application of Act to special categories of personal data 5. This Act, other than Part 5, Part 8 and Chapter 3 of Part 9, shall not apply to special categories of personal data. Interaction with Data Protection Acts and General Data Protection Regulation 6. (1) Subject to subsections (2) and (3), nothing in this Act shall affect the operation of data protection law. (2) Section 38 of the Data Protection Act 2018 shall not apply to the disclosure of information by one public body to another public body. (3) Regulations made under section 38 (4) of the Data Protection Act 2018 shall not constitute an enactment under which specific provision is made permitting or requiring data-sharing for the purpose of sections 13 (1), 15 (1) or 34(1). Interaction with Social Welfare Consolidation Act 2005 7. (1) Subject to subsection (2), this Act, other than Part 5 and Chapter 3 of Part 9, does not affect the operation of the Act of 2005. (2) Notwithstanding section 262(6)(b) of the Act of 2005, a specified body (in this section referred to as the “first mentioned specified body”) may, subject to subsection (3), disclose the information comprised in a person’s public service identity to another specified body (in this section referred to as the “second mentioned specified body”), where the information is disclosed in accordance with this Act. (3) The first mentioned specified body may not disclose the information comprised in a person’s public service identity to the second mentioned specified body for the purpose specified in section 13 (2)(a)(ii)(VIII). (4) The reference in subsections (2) and (3) to the disclosure of the information referred to in those subsections includes the accessing of that information by the second mentioned specified body where that information is contained in a base registry in respect of which the first mentioned specified body is the base registry owner. (5) In this section— “specified body” has the same meaning as it has in section 262 of the Act of 2005; “public service identity” has the same meaning as it has in section 262 of the Act of 2005, subject to the modification that the reference, in the definition of that phrase in subsection (1) of that section, to information specified in subsection (3) of that section shall not include a reference to special categories of personal data. Interaction with other enactments 8. (1) Subject to section 34 (3), nothing in this Act shall affect the operation of section 851A of the Act of 1997. (2) Subject to section 64 (3), this Act shall not apply to information— (a) collected for statistical purposes in accordance with the Statistics Act 1993 , or (b) disclosed in accordance with regulations made under section 2 of the Vital Statistics and Births, Deaths and Marriages Registration Act 1952 . (3) This Act, other than Chapter 3 of Part 9, shall not apply to the disclosure of information under the Civil Registration Act 2004 . Data-sharing: meaning 9. (1) In this Act, “data-sharing” means the disclosure of information, including personal data, by a public body to another public body. (2) For the purposes of this Act, an addition or change to the information held on an information system under the control of a public body that results automatically from an addition or change to information held on an information system under the control of another public body, is deemed to be a disclosure by the second mentioned public body to the first mentioned public body of the information so added or changed on the information system under the control of the first mentioned public body. Public body: meaning 10. (1) In this Act, “public body” means— (a) a Minister of the Government, (b) the Attorney General, (c) the Comptroller and Auditor General, (d) the Revenue Commissioners, (e) the Commissioners of Public Works in Ireland, (f) the Commissioner of Valuation, (g) the Garda Síochána, (h) the Defence Forces, (i) a local authority for the purposes of the Local Government Act 2001 , (j) the Health Service Executive, (k) an education and training board, (l) a recognised school established and maintained by an education and training board, (m) a board of a recognised school established and maintained by an education and training board, (n) a body (other than an exempted body) established— (i) by or under an enactment (other than the Act of 2014 or a former enactment relating to companies within the meaning of section 5 of that Act), or (ii) under the Act of 2014, or a former enactment relating to companies within the meaning of section 5 of that Act, in pursuance of powers conferred by or under another enactment, and financed wholly or partly by means of moneys provided, or loans made or guaranteed, by a Minister of the Government or the issue of shares held by or on behalf of a Minister of the Government, in respect of which a public service pension scheme exists or applies or may be made, (o) a body (other than an exempted body) that is wholly or partly funded directly or indirectly out of moneys provided by the Oireachtas or from the Central Fund or the growing produce of that Fund and in respect of which a public service pension scheme exists or applies or may be made, (p) any subsidiary of, or company controlled (within the meaning given by section 10 of the Act of 1997) by, a body to which paragraph (i), (j), (k), (n) or (o) relates and in respect of which a public service pension scheme exists or applies or may be made, and (q) any other body specified in an order made under subsection (4). (2) The Minister may, with the consent of the Minister of the Government in whom functions in relation to that body are vested and having had regard to the matters referred to in subsection (3), by order exempt a body that would otherwise be included in the definition of “public body” in subsection (1). (3) The Minister shall, prior to making an order under subsection (2), have regard to whether— (a) the body proposed to be specified in the order is engaged for gain in the production, supply or distribution of goods or the provision of a service, and (b) the use by that body of information disclosed to it by a public body could lead to the distortion of competition in trade in any goods or services in the State or in any part of the State. (4) The Minister may, at the request of a body that would not otherwise be included in the definition of “public body” in subsection (1) and with the consent of the Minister of the Government in whom functions in relation to that body are vested, by order designate that body as a public body where— (a) that body is financed wholly or partly, whether directly or indirectly, by means of moneys provided, or loans made or guaranteed, by a Minister of the Government or the issue of shares held by or on behalf of a Minister of the Government, and (b) the Minister is satisfied that the principal activity of the body is the delivery of services to the public under an agreement with a public body. (5) In this section— “Act of 1998” means the Education Act 1998 ; “board” has the same meaning as it has in the Act of 1998; “education and training board” means an education and training board established under section 9 of the Education and Training Boards Act 2013 ; “exempted body” means— (a) a body specified or referred to in the Schedule , (b) a body specified in an order made under subsection (2), (c) a recognised school (other than a recognised school referred to in subsection (1)(l)), (d) a board (other than a board referred to in subsection (1)(m)), and (e) a management committee established under section 37(3) of the Act of 1998; “recognised school” has the same meaning as it has in the Act of 1998. Deceased persons 11. Unless the context otherwise requires— (a) a reference in this Act to a person includes a reference to a deceased person, and (b) a reference in this Act to personal data or special categories of personal data includes a reference to the personal data or special categories of personal data, as the case may be, of a deceased person. Exclusions 12. (1) This Act shall not apply to data-sharing for the purposes of— (a) the prevention, detection or investigation of offences, (b) the apprehension or prosecution of offenders, (c) the imposition or execution of a fine or sentence of imprisonment, (d) the exercise of the functions of the Criminal Assets Bureau, (e) protecting the security of the State including, but not limited to, the following: (i) preventing, detecting and investigating offences under the Offences against the State Acts 1939 to 1998, the Criminal Law Act 1976 , the Criminal Justice (Terrorist Offences) Act 2005 and the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 ; (ii) protecting the State from— (I) espionage, (II) sabotage, (III) unlawful acts that subvert or undermine, or are intended to subvert or undermine, parliamentary democracy or the institutions of the State, and (IV) acts of foreign interference that are, or are intended to be, detrimental to the interests of the State and are clandestine or deceptive or involve a threat to any person, whether directed from, or committed or intended to be committed within, the State or not, (f) identifying foreign capabilities, intentions or activities within or relating to the State that impact on the international or economic well-being of the State, (g) co-operating with authorities in other states and international organisations aimed at preserving international peace, public order and security, (h) the defence of the State, or (i) the international relations of the State. (2) Subject to Part 5, this Act shall not apply to the disclosure by a public body to another public body of the personal data of a data subject for the internal administrative purposes of the first or second mentioned public body. (3) The reference in subsection (2) to internal administrative purposes includes a reference to purposes relating to the employment of the data subject concerned. PART 3 Regulation of Data-sharing Data-sharing: requirements 13. (1) This section applies to the disclosure of personal data by a public body to another public body, where there is no other enactment or law of the European Union in operation under which specific provision is made permitting or requiring such data-sharing. (2) A public body may disclose personal data to another public body, in a case in which this section applies to such disclosure, only where— (a) the personal data concerned is disclosed— (i) for the purpose of the performance of a function of the first or second mentioned public body, and (ii) for one or more of the following purposes: (I) to verify the identity of a person, where the first or second mentioned public body is providing or proposes to provide a service to that person; (II) to identify and correct erroneous information held by the first or second mentioned public body; (III) to avoid the financial or administrative burden that would otherwise be imposed on a person to whom a service is being or is to be delivered by the first or second mentioned public body were the second mentioned public body to collect the personal data directly from that person; (IV) to establish the entitlement of a person to the provision of a service being delivered by the first or second mentioned public body, on the basis of information previously provided by that person to the first mentioned public body (or another public body that previously disclosed the information to the first mentioned public body); (V) to facilitate the administration, supervision and control of a service, programme or policy delivered or implemented or being delivered or implemented, as the case may be, by, for or on behalf of the first or second mentioned public body; (VI) to facilitate the improvement or targeting of a service, programme or policy delivered or implemented or to be delivered or implemented, as the case may be, by, for or on behalf of the first or second mentioned public body; (VII) to enable the evaluation, oversight or review of a service, programme or policy delivered or implemented or being delivered or implemented, as the case may be, by, for or on behalf of the first or second mentioned public body; (VIII) to facilitate an analysis of the structure, functions, resources and service delivery methods of the first or second mentioned public body, (b) the personal data concerned is disclosed under and in accordance with a data-sharing agreement in compliance with Part 4, (c) the first and second mentioned public body— (i) comply with the rules, procedures and standards, if any, prescribed under section 64 , (ii) have regard to the guidelines, if any, issued under section 65 , and (iii) where subsection (3) of section 66 applies, comply with that subsection, (d) in a case in which the second mentioned public body is engaged for gain in the production, supply or distribution of goods or the provision of services, the use by that public body of the personal data could not lead to the distortion of competition in trade in those goods or services in the State or in any part of the State, (e) the personal data concerned has been lawfully obtained and held by the first mentioned public body, and (f) the personal data concerned is disclosed in accordance with the other provisions of this Act applicable to a disclosure of personal data to which this section applies and any other enactment or law of the European Union applicable to the first or second mentioned public body, and (g) the disclosure of the personal data is— (i) necessary for the performance of the functions in relation to which the information is being disclosed, and (ii) proportionate in the context of the performance of those functions and the effects of the disclosure on the rights of the data subjects concerned. (3) Subsection (2)(b) shall not apply to the disclosure of personal data under Part 5. Directions 14. (1) The Minister may, with the consent of such other Minister of the Government, if any, in whom functions in relation to a public body to which the Minister proposes to issue a direction are vested, and having had regard to the matters referred to in subsection (8), direct one or more public bodies to disclose information to one or more other public bodies. (2) A direction under subsection (1) shall specify the public bodies to which it applies and the information to be disclosed. (3) A direction under subsection (1) may specify conditions in accordance with which specified information is to be disclosed. (4) Where a direction under subsection (1) specifies conditions in accordance with which specified information is to be disclosed, those conditions shall be reflected in a data-sharing agreement relating to the disclosure of the information specified in the direction. (5) Part 4 shall not apply to a data-sharing agreement referred to in subsection (4) unless section 13 applies to the disclosure to which the direction concerned relates. (6) The Minister shall not issue a direction to a public body under subsection (1) if— (a) the disclosure of the information concerned is prohibited by a law of the European Union or any enactment, or (b) compliance with the direction would result in a public body being in breach of this Act, another enactment or a law of the European Union. (7) Prior to issuing a direction under subsection (1), the Minister shall consult with the public bodies concerned, as well as such other Minister of the Government, if any, as the Minister considers appropriate having regard to the functions of that other Minister. (8) The Minister, shall for the purposes of subsection (1), have regard to whether the disclosure of the information concerned would— (a) assist in the carrying out of a function of one or more of the public bodies concerned by— (i) reducing the duplication of tasks carried out by one or more public bodies, (ii) increasing the efficiency of a public body in carrying out that function, or (iii) facilitating an improvement in the quality of services being delivered, (b) assist a public body in verifying the identity of a person receiving a service being delivered by the public body, (c) assist in the identification or correction of any erroneous information held by one or more of the public bodies concerned, (d) reduce the need for a person to provide the same information to more than one public body, (e) assist a public body in establishing the entitlement of a person to a service being delivered by the public body, (f) facilitate the administration, supervision and control of a service, programme or policy being delivered or implemented, as the case may be, by a public body, (g) facilitate the improvement or targeting of a service, programme or policy being delivered or implemented, as the case may be, by a public body, (h) enable the evaluation of a service, programme or policy delivered or implemented or being delivered or implemented, as the case may be, by a public body, or (i) facilitate an analysis of the structure, functions, resources and service delivery methods of a public body. (9) A public body to which a direction under subsection (1) applies shall comply with the direction. (10) Where, following the issue of a direction under subsection (1)— (a) the disclosure of the information concerned becomes prohibited by a law of the European Union or any enactment, or (b) compliance with the direction would result in a public body being in breach of this Act, another enactment or a law of the European Union, the direction shall, subject to subsection (11), cease to have effect. (11) Where the Data Protection Commission, in exercise of its powers under Article 58(2)(f) of the General Data Protection Regulation, imposes a temporary limitation on a disclosure of information in accordance with a direction under subsection (1), the direction shall cease to have effect until the expiry of that temporary limitation. PART 4 Data-sharing Agreements Application (Part 4) 15. (1) Subject to subsection (2), this Part applies to the disclosure of personal data by a public body to another public body where there is no other enactment or law of the European Union in operation under which specific provision is made permitting or requiring such data-sharing. (2) This Part does not apply to the disclosure of personal data under Part 5. Obligation to enter into data-sharing agreement 16. A public body shall, in a case in which this Part applies to such disclosure, enter into a data-sharing agreement with the public body to which it proposes to disclose personal data prior to commencing that disclosure. Formal requirements 17. A data-sharing agreement shall be in writing. Accession to data-sharing agreement 18. (1) A public body that was not a signatory to a data-sharing agreement on its date of execution may accede to the agreement by executing an accession agreement to the data-sharing agreement. (2) An accession agreement referred to in subsection (1) shall be executed, on behalf of the public bodies who were parties to the data-sharing agreement concerned immediately prior to the execution of the accession agreement, by the lead agency specified in that data-sharing agreement in accordance with section 21 (1). (3) A lead agency specified in a data-sharing agreement in accordance with section 21 (1) shall notify the Board prior to executing an accession agreement to that data-sharing agreement. Content of data-sharing agreement 19. (1) A data-sharing agreement shall— (a) specify the names of the parties to the agreement in a schedule to the agreement, (b) specify the information to be disclosed, (c) specify the purpose of the data-sharing, (d) specify the function of the public body concerned to which the purpose referred to in paragraph (c) relates, (e) specify the legal basis for the data-sharing and for any further processing, by the parties to the agreement, of the information to be disclosed under the agreement, (f) specify whether the impetus for the disclosure of information under the agreement will come from a data subject or a public body, (g) specify whether, where information is disclosed under the agreement, the disclosure will be of information in relation to individual data subjects or classes of data subjects, (h) specify whether the disclosure of information under the agreement will be on a once-off or ongoing basis, (i) specify how the information to be disclosed is to be processed following its disclosure, (j) specify any restrictions on the disclosure of information after the processing referred to in paragraph (i), (k) include an undertaking by the parties to the agreement to comply with Article 5 of the General Data Protection Regulation in disclosing information under the agreement, (l) where a data protection impact assessment has been carried out in relation to the data-sharing, include a summary of the matters referred to in Article 35(7) of the General Data Protection Regulation in a schedule to the agreement, (m) specify the security measures to apply to the transmission, storage and accessing of personal data, in a manner that does not compromise those security measures, (n) specify the requirements in relation to the retention of— (i) the information to be disclosed, and (ii) the information resulting from the processing of that information, for the duration of the agreement and in the event that the agreement is terminated, (o) specify the method to be employed to destroy or delete— (i) the information to be disclosed, and (ii) the information resulting from the processing of that information, at the end of the period for which the information is to be retained in accordance with the agreement, (p) specify the procedure in accordance with which a party may withdraw from the agreement, (q) include such other matters as may be prescribed under subsection (2), (r) include in a schedule to the agreement a statement summarising the analysis of the parties in relation to the extent to which— (i) the disclosure of the information is necessary for the performance of the functions in relation to which the information is being disclosed, and (ii) the disclosure and safeguards applicable to that disclosure are proportionate in the context of the performance of those functions and the effects of the disclosure on the rights of the data subjects concerned. (2) The Minister may prescribe matters, in addition to those listed in subsection (1), to be included in a data-sharing agreement where he or she is satisfied that the inclusion of those matters would— (a) be consistent with Article 5(1) of the General Data Protection Regulation, and (b) (i) improve transparency as regards the sharing of information by public bodies, or (ii) facilitate good governance in the sharing of information by public bodies. (3) A data-sharing agreement may provide for matters in addition to those listed in subsection (1). Review of operation of data-sharing agreement 20. (1) The parties to a data-sharing agreement shall review the operation of the agreement on a regular basis, with each such review being carried out on a date that is not more than 5 years from— (a) in the case of the first such review under this subsection, the date on which the agreement came into effect in accordance with section 61 (in this section referred to as the “effective date”), and (b) in the case of each subsequent review under this subsection, the date of the previous review under this subsection. (2) A review under subsection (1) shall consider the impact of the technical, policy and legislative changes that have occurred since the date of the previous review under that subsection or, in the case of the first review under that subsection, the effective date. (3) Where the parties to a data-sharing agreement consider that it is appropriate following completion of a review under subsection (1), they shall prepare a draft amendment agreement to take account of the technical, policy and legislative changes that have occurred since the date of the previous review under that subsection or, in the case of the first review under that subsection, the effective date. (4) A draft amendment agreement prepared in accordance with subsection (3) shall be submitted for review in accordance with Chapter 2 of Part 9. Lead agency 21. (1) A data-sharing agreement shall specify a party (in this Act referred to as the “lead agency”) to that agreement to be responsible for carrying out the functions set out in subsection (3). (2) Subject to section 38 (1)(e) and in default of agreement, the lead agency in respect of a data-sharing agreement shall— (a) where one of the parties only to the data-sharing agreement is a controller in respect of the information being or to be disclosed under that agreement, be that party, and (b) where more than one party to the data-sharing agreement is a controller in respect of the information being or to be disclosed under that agreement, be the controller nominated by those controllers to be the lead agency in respect of that agreement. (3) The lead agency shall— (a) where a public body that was not a signatory to the data-sharing agreement concerned on its date of execution accedes to the agreement in accordance with section 18 or where a party withdraws from the agreement, update the schedule referred to in section 19 (1)(a), (b) notify the parties to the data-sharing agreement concerned of any changes to the schedule referred to in section 19 (1)(a), (c) where a party that was the lead agency withdraws from the data-sharing agreement concerned, amend the agreement accordingly, and (d) publish a copy of the conclusions of a review of the data-sharing agreement concerned carried out under section 20 on a website maintained by it or on its behalf. (4) Where information in respect of a person is, or is believed by the person to be, included in the information disclosed or to be disclosed under a data-sharing agreement, that person may direct a request in relation to the exercise of a right of that person under Article 15, 16, 17, 18, 20 or 21 of the General Data Protection Regulation in respect of that information to the lead agency specified in that data-sharing agreement. (5) Where a lead agency receives a request in accordance with subsection (4), the lead agency shall— (a) where the lead agency is not a controller in respect of the information concerned, send the request to the controller, or (b) where the lead agency is a joint controller (within the meaning of Article 26 of the General Data Protection Regulation) in respect of the information concerned, send the request to the other joint controller, as soon as practicable following receipt of the request. Cessation 22. (1) Where a data-sharing agreement expires or is terminated, the lead agency shall notify the Minister as soon as practicable after such expiration or termination, as the case may be. (2) Where the Minister receives a notification under subsection (1), the Minister shall— (a) publish, on a website maintained by him or her, a notification to the effect that the data-sharing agreement concerned has expired or has been terminated, as the case may be, and (b) ensure that where a copy of the data-sharing agreement concerned or documentation in relation thereto is accessed on the website maintained by the Minister that it is clear to the person accessing the information that the agreement concerned has expired or has been terminated, as the case may be. PART 5 Public service information Definitions (Part 5) 23. (1) In this Part— “Act of 2010” means the Civil Partnership and Certain Rights and Obligations of Cohabitants Act 2010 ; “Act of 2011” means the Ministers and Secretaries (Amendment) Act 2011 ; “Act of 2012” means the Public Service Pensions (Single Scheme and Other Provisions) Act 2012 ; “administration”, in relation to a pension scheme, includes the technical and organisational measures implemented by a public service body for the purposes of the administration of the scheme; “anonymised” in relation to personal data, means processed such that the personal data can no longer be attributed to a specific data subject; “child” has the same meaning as it has in Part 2 of the Act of 2012; “civil partner” shall be construed in accordance with section 3 of the Act of 2010; “former scheme member” means a person who was a member of a public service pension scheme during the period of his or her employment with a public service body, irrespective of whether or not an entitlement has vested in that person as a member of that scheme; “pension adjustment order” means an order under— (a) section 12 of the Family Law Act 1995 , (b) section 17 of the Family Law (Divorce) Act 1996 , (c) section 121 of the Act of 2010, or (d) section 187 of the Act of 2010; “pension scheme beneficiary” means a person, other than a scheme member, former scheme member or pensioner, who has or had an entitlement to a benefit under a public service pension scheme; “pension scheme membership information” means the information held by or on behalf of a public service body for the purposes of— (a) keeping full and proper account of the contributions paid or repaid under a public service pension scheme by a scheme member or a former scheme member, (b) keeping full and proper account of the benefits accrued by or restored to a scheme member or a former scheme member under a public service pension scheme, (c) keeping full and proper account of all benefits paid or payable to a scheme member, a former scheme member, a pensioner or any other pension scheme beneficiary under a public service pension scheme, (d) determining the eligibility of a person under a public service pension scheme, (e) calculating or recalculating the contributions and benefits referred to in paragraphs (a) and (b), or (f) the effective administration of a public service pension scheme; “pensioner” means a person who— (a) is entitled to the payment of a public service pension under a public service pension scheme, (b) has a preserved benefit under a public service pension scheme, or (c) is the surviving spouse, civil partner, cohabitant (or surviving former spouse, civil partner or cohabitant) or child of a scheme member or former scheme member who is entitled or may become entitled to the payment of a public service pension; “pre-existing public service pension scheme” has the same meaning as it has in Part 2 of the Act of 2012; “preserved benefit” has the same meaning as it has in the Public Service Superannuation (Miscellaneous Provisions) Act 2004 ; “pseudonymised” in relation to personal data, means processed such that the personal data can no longer be attributed to a specific data subject without the use of additional information, where such additional information is— (a) kept separately from the personal data, and (b) subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person; “public servant” means— (a) a person who is employed by, or holds any office or other position in, a public service body, (b) the President, (c) a Minister of the Government or Minister of State, (d) a member of Dáil Éireann, (e) a member of Seanad Éireann, (f) the holder of a judicial office, (g) the Comptroller and Auditor General, (h) a member of a local authority, or (i) any other person who is a member of a public service pension scheme; “public service body” has the same meaning as it has in Part 2 of the Act of 2012, subject to the modification that the reference to the Civil Service in the definition of “public service body” in section 5 of that Act shall be construed as a reference to a person or body whose employees are civil servants (within the meaning of the Civil Service Regulation Act 1956 ); “public service pension” means a periodic payment of a pension or other benefit by whatever name called, which is not a lump sum, payable to or in respect of a public servant or former public servant under a public service pension scheme; “relevant authority” has the same meaning as it has in Part 2 of the Act of 2012; “scheme member” means a public servant who is a member of a public service pension scheme, irrespective of whether or not an entitlement has vested in that public servant as a member of that scheme; “statutory pensions appeal” means a process provided for in an enactment for the resolution of a dispute in relation to an entitlement under a public service pension scheme; “transfer network” has the same meaning as it has in Part 2 of the Schedule to the Rules for Pre-existing Public Service Pension Scheme Members Regulations 2014 ( S.I. No. 582 of 2014 ). (2) For the purposes of this Part “cohabitant” has the meaning assigned to it in subsection (1) of section 172 of the Act of 2010 and, in determining whether or not 2 persons are cohabitants, regard shall be had to the circumstances that a court has to take into account under subsection (2) of that section. (3) In this Part a reference to an entitlement includes a reference to a past, present, future, actual or contingent entitlement. Application (Part 5) 24. (1) Subject to subsection (2), this Part applies to— (a) personal data (other than special categories of personal data), and (b) information other than personal data. (2) This Part applies to special categories of personal data where the processing of the information concerned is for the purposes of— (a) the administration of a public service pension scheme, or (b) an actuarial valuation of a public service pension scheme. Administration of Single Public Service Pension Scheme 25. (1) A relevant authority or an agent of that authority, where the information concerned is held by that agent, shall at the request of a Minister of the Government provide information referred to in subsection (2) to— (a) the Minister, for the purposes of— (i) the performance of a function of the Minister under the Act of 2012, (ii) the performance of a function conferred on or transferred to the Minister under section 8(3), 9(1)(a), 10 or 17 of the Act of 2011, or (iii) the administration of the Single Public Service Pension Scheme, or (b) the Minister of the Government making the request (where that Minister of the Government is not the Minister) or another relevant authority, for the purposes of— (i) the performance of a function of that Minister or relevant authority under the Act of 2012, or (ii) the administration of the Single Public Service Pension Scheme. (2) The information to be provided under subsection (1) is the following information in respect of the Single Public Service Pension Scheme: (a) pension scheme membership information in respect of— (i) a scheme member, (ii) a former scheme member, (iii) a pensioner, (iv) a person who was, but is no longer, a pensioner, (v) a pension scheme beneficiary, or (vi) a person whose eligibility under a public service pension scheme is in the process of being determined; (b) such additional information as may be prescribed. (3) The Minister shall, when prescribing additional information under subsection (2)(b), have regard to whether the provision of such information to the Minister, another Minister of the Government or another relevant authority would— (a) reduce the duplication of tasks by relevant authorities or their agents, (b) increase the efficiency of a relevant authority in carrying out a function of that relevant authority, (c) improve the quality of services provided by a relevant authority to a scheme member, former scheme member, pensioner, pension scheme beneficiary or a person whose eligibility under a public service pension scheme is in the process of being determined, (d) improve the quality of information created, held and maintained by relevant authorities, (e) strengthen the accountability of relevant authorities in relation to the operation of the Single Public Service Pension Scheme, or (f) improve the quality of analysis and decision-making in relation to the Single Public Service Pension Scheme. Administration of pre-existing public service pension schemes 26. (1) A public service body or an agent of that body, where the information concerned is held by that agent, shall at the request of a Minister of the Government provide information referred to in subsection (2) to— (a) the Minister, for the purposes of— (i) the performance of a function of the Minister under the Act of 2012, (ii) the performance of a function conferred on or transferred to the Minister under section 8(3), 9(1)(a), 10 or 17 of the Act of 2011, (iii) the performance of a function of the Minister under an enactment relating to a pre-existing public service pension scheme, or (iv) the administration of a pre-existing public service pension scheme, or (b) the Minister of the Government making the request (where that Minister of the Government is not the Minister) or another public service body, for the purposes of— (i) the performance of a function of that Minister or public service body under an enactment relating to a pre-existing public service pension scheme, or (ii) the administration of a pre-existing public service pension scheme. (2) The information to be provided under subsection (1) is the following information in respect of a pre-existing public service pension scheme: (a) pension scheme membership information in respect of— (i) a scheme member, (ii) a former scheme member, (iii) a pensioner, (iv) a person who was, but is no longer, a pensioner, (v) a pension scheme beneficiary, or (vi) a person whose eligibility under a public service pension scheme is in the process of being determined; (b) information relating to— (i) a statutory pensions appeal of a decision made in relation to an entitlement under the scheme, (ii) an adjustment to the number of years of service of a person for the purposes of the calculation of an entitlement under the scheme, (iii) the operation of the transfer network, or (iv) the administration of a pension adjustment order, whether made or in respect of which an application has been or is proposed to be made, applying to an entitlement under the scheme; (c) such additional information as may be prescribed. (3) The Minister shall, when prescribing additional information under subsection (2)(c), have regard to whether the provision of such information to the Minister, another Minister of the Government or a public service body would— (a) reduce the duplication of tasks by public service bodies or their agents, (b) increase the efficiency of public service bodies in carrying out their functions, (c) improve the quality of services provided by a public service body to a scheme member, former scheme member, pensioner or pension scheme beneficiary, (d) improve the quality of information created, held and maintained by public service bodies, (e) strengthen the accountability of public service bodies in relation to the operation of pre-existing public service pension schemes, or (f) improve the quality of analysis and decision-making in relation to pre-existing public service pension schemes. Public service policy analysis 27. (1) A public service body or an agent of that body, where the information concerned is held by that agent, shall at the request of the Minister provide information referred to in subsection (2) to the Minister for the purposes of— (a) the performance of a function conferred on or transferred to the Minister under section 8(3), 9(1)(a), 10 or 17 of the Act of 2011, (b) carrying out actuarial calculations in respect of public service pension schemes or public expenditure, (c) calculating the adjustment to the expenditure by a public service body consequent upon the implementation of a policy or proposed policy of the Government, (d) assessing the current and future staffing requirements of a public service body, (e) developing, and analysing the consequences of, a policy or proposed policy of the Government for the purposes of— (i) eliminating discrimination, (ii) promoting equality of opportunity and treatment, or (iii) protecting human rights, in public service bodies, or (f) carrying out an analysis of the structure, functions, resources and service delivery methods of a public service body. (2) The information to be provided under subsection (1) is the following: (a) the information referred to in section 25 (2)(a) and section 26 (2)(a) and (b); (b) demographic information relating to a public servant, including age, gender and any disclosed disability; (c) information relating to the employment of a public servant, including payment-related information and information relating to the public servant’s employer, contract of employment, length of service and grade; (d) such additional information as may be prescribed. (3) The Minister shall have regard to the following when prescribing additional information under subsection (2)(d): (a) the need to strengthen the accountability of public service bodies; (b) the need to improve the quality of decision-making of public bodies; (c) the need to promote an evidence-based approach to the development of policy; (d) the need to increase the efficiency of public service bodies in carrying out their functions; (e) the need to ensure adequate information is available to facilitate effective staffing requirements planning across the public service; (f) the need to facilitate trend analysis, scenario testing and forecasting in relation to— (i) the number of public servants, and (ii) expenditure on pay and pensions by public service bodies; (g) the need to ensure adequate information is available to develop, implement and monitor policies for the purposes of— (i) eliminating discrimination, (ii) promoting equality of opportunity and treatment, or (iii) protecting human rights, in public service bodies. (4) In paragraph (e) of subsection (1) and paragraph (g) of subsection (3)— “discrimination” shall be construed in accordance with section 6 of the Employment Equality Act 1998 ; “human rights” has the same meaning as it has in Part 3 of the Irish Human Rights and Equality Commission Act 2014 . Information requests 28. A request under section 25 , 26 , or 27 may specify— (a) the classes of information required, (b) the period of time to which the information requested relates, (c) the format in which the information requested is to be provided, and (d) the date by which the information requested is to be provided. Data protection impact assessment 29. The Minister shall, prior to prescribing any additional information to be provided under section 25 , 26 or 27 , carry out an assessment of the potential impact of the processing of that information on the protection of personal data. Anonymisation 30. Where personal data is provided to the Minister under section 27 , it shall be anonymised or, where anonymisation of the information concerned would prevent the purpose for which the information is being provided from being achieved, pseudonymised, as soon as practicable following receipt of the information by the Minister. Pension scheme information systems 31. (1) The Minister may establish a database comprising all of the information provided to the Minister under section 25 . (2) The Minister may establish an information system for any or all of the following purposes: (a) enabling a public service body to access information held on the database referred to in subsection (1); (b) facilitating the calculation of the entitlement or liability of a person under the Act of 2012; (c) administering entitlements and liabilities under the Act of 2012. (3) Where an information system referred to in subsection (2) is established, a public service body shall establish and maintain a connection between that information system and an information system under the control of the public service body in order to facilitate— (a) the transfer, from that public service body to the Minister, of information requested under section 25 , and (b) the querying by that public service body of the database referred to in subsection (1) and the database, if any, which is part of an information system referred to in subsection (2), and the provision of the results of such querying to that public service body. (4) The Minister may disclose information to a public service body through an information system referred to in subsection (2), or other secure means, for the purposes described in that subsection. (5) The Minister shall be the controller in respect of personal data stored on— (a) the database referred to in subsection (1), and (b) the database, if any, which is part of an information system referred to in subsection (2), for the purposes of the General Data Protection Regulation. Transparency 32. The Minister shall publish, on a website maintained by him or her, the following in respect of information disclosed under this Part: (a) a description of the information provided; (b) the name of the public service body providing the information; (c) the provision of this Part under which the information is provided; (d) a description of the processing to which the information is subject; (e) a description of the restrictions, if any, which apply to the further disclosure of the information; (f) where a data protection impact assessment has been carried out in relation to the processing of the information, a summary of the matters referred to in Article 35(7) of the General Data Protection Regulation; (g) a description of the security measures applying to the processing of the information; (h) a description of the policies regarding the retention and destruction of the information; (i) whether or not the information will be anonymised or pseudonymised following disclosure under this Part; (j) such other details as the Minister considers necessary for the purposes of providing transparency with regard to the processing of the information. PART 6 Business Information Definitions (Part 6) 33. (1) In this Part— “business information” means the following information in respect of an undertaking: (a) the unique business identifier number; (b) the registered name, if any; (c) the business or operating name, if any; (d) the address (including the postcode (if any) within the meaning of section 66 of the Communications Regulation (Postal Services) Act 2011 ) at which the undertaking carries on business or ordinarily resides; (e) the number, if any, allocated or issued by a public body under an enactment or law of the European Union; (f) the number, if any, assigned in a register held or maintained by a public body under an enactment or law of the European Union; (g) the legal form; (h) the number of employees, if any; (i) the annual turnover; (j) the net assets; (k) in respect of the principal activity carried on by the undertaking, the NACE classification code, if any, as determined in accordance with Regulation (EC) No. 1893/2006 of the European Parliament and of the Council of 20 December 20063 , as amended by Regulation (EC) No 295/2008 of the European Parliament and of the Council of 11 March 20084 and Regulation (EU) No 70/2012 of the European Parliament and of the Council of 18 January 201255 ; (l) in the case of a natural person, a partnership of natural persons or an unincorporated body of natural persons, the nationality of the person or persons, as the case may be; (m) in the case of a legal person, the state under the law of which the legal person was established; (n) such other information as may be prescribed by the Minister, having regard to the matters referred to in subsection (3); “net assets”, in relation to an undertaking, means the total assets of the undertaking less the total liabilities of the undertaking as shown in the financial statements of the undertaking; “turnover”, in relation to an undertaking, means the amounts of revenue derived from the provision of goods and services falling within the undertaking’s ordinary activities, after deduction of— (a) trade …