Global menu

Our global pages

Close

Data Sharing between public bodies: Five key updates

  • Ireland
  • Privacy, data protection and cybersecurity
  • Technology, Media and Telecoms

27-08-2021

The 7 July 2021 marked the date on which a significant number of sections of the Data Sharing and Governance Act 2019 commenced (the “Act”). With the exception of subsections (2) and (3) of Section 6, which will commence on 31 March 2022, the Act is now fully enacted. The recent commencement of these provisions has implications for public bodies who have entered into, and who will enter into, data sharing agreements with another public body. Further, the Act will change the regulatory landscape whereby a new Data Governance Board will be established and base registries and a personal data access portal may be created. We have set out the 5 key updates below. 

1. Data Sharing Requirements

A public body may disclose personal data to another public body subject to the requirements set out in section 13 of the Act. Section 13 limits the circumstances upon which personal data may be shared by specifying specific purposes for which such disclosure may take place. The section also requires that disclosure is necessary for the performance of the functions in relation to which the information is being disclosed and proportionate in the context of the performance of those functions and the effects of the disclosure on the rights of the data subject concerned (section 13(2)(g) of the Act). The disclosure must also be made pursuant to a data sharing agreement.

2. Data Sharing Agreements

Data sharing agreements are provided for under Part 4 of the Act. Where there is no EU law which permits or requires the disclosure of personal data by a public body, a public body is obliged to enter into data sharing agreement prior to any disclosures. The Act regulates the content of these agreements by specifying the minimum information to be contained in the agreement. The data sharing agreement must be in writing and reviewed at least every 5 years. Draft data sharing agreements as well as data sharing amendment agreements shall be subject to public consultation in accordance with section 55 of the Act. The data sharing agreement must also specify the “lead agency” which is the party to be nominated to carry out certain functions under section 21 of the Act.

3. Data Governance Board

Part 9 of the Act provides for the establishment of the Data Governance Board (the “Board”). The Board shall be independent and shall have certain oversight and advisory functions under the Act. In particular, the Board shall advise the Minister for Public Expenditure and Reform in relation to certain provisions of the Act, promote and monitor compliance by public bodies and review data-sharing agreements. Chapter 2 of Part 9 of the Act provides that draft data sharing agreements and data sharing amendment agreements shall be reviewed and signed off by the Board.

4. Base Registries

Part 7 of the Act provides for the creation of base registries. The Minister for Public Expenditure and Reform may, by order, designate a database as a base registry. The order shall regulate the name, owner, purpose and information to be contained in the base registry. The purposes of a base registry are to create a shared database for public bodies to access, to ensure the consistency and accuracy of information frequently used by public bodies and to avoid the burden of a person having to provide the same information to multiple public bodies. The Act regulates the terms and conditions upon which access to the base registry is to be provided to a public body.

5. Personal Data Access Portal

The establishment of a personal data access portal is legislated for under Part 8 of the Act. The portal would allow individuals to access their personal data in accordance with their rights under the GDPR. The portal would also show an individual if their data has been subject to a data breach. The Act provides that the portal may also facilitate the means by which a data subject may (i) view personal data relating to him or her held by a public body, (ii) view a copy of the data sharing agreement under which his or her personal data has been disclosed, and (iii) send a request to a public body in accordance with his or her rights under the GDPR.

Next Steps

The recent commencement of certain provisions of the Act will require a thorough review of their data sharing agreements to ensure compliance with public bodies to carry out the Act.

If you have any questions in relation to the above, please feel free to contact a member of our Data Protection team:

Marie McGinley, Partner and Head of IP, Technology & DP - MarieMcGinley@eversheds-sutherland.ie

Leona Chow, Solicitor in IP, Technology & DP - LeonaChow@eversheds-sutherland.ie