My Department is fully committed to applying the principles contained in the General Data Protection Regulation and associated Irish legislation.
The formalisation of data sharing arrangements was introduced by the GDPR in 2018. Details of the sharing of personal or person-specific data are, therefore, not available for the last 20 years.
My Department has a wide range of functions and shares personal data with other bodies in the course of the exercise of those functions or the provision of public services to individuals. My Department’s remit incorporates responsibility for child protection and welfare, prevention and early intervention, adoption, family supports, early learning and childcare, youth services and youth justice, legacy issues in relation to Mother and Baby Institutions, areas of equality, integration, international protection and disability policy, providing and co-ordinating the provision of emergency short-term accommodation and assistance for Ukrainian Beneficiaries of Temporary Protection.
Sharing of personal data may also take place in response to a valid lawful request from another public body such as An Garda Síochána.
Personal data is only shared by my Department where there is an appropriate legal basis to do so having regard to the circumstances of the data sharing. In the exercise of official functions, the legal basis to share data may be provided in specific legislation enabling the sharing of personal data or the Data Sharing and Governance Act 2019 may provide the legal basis.
Sharing of personal data by my Department takes place in accordance with the GDPR principles including purpose limitation, data minimisation and the integrity and confidentiality principles.
Regular or ad-hoc sharing of personal data under the GDPR occurs with a range of entities, including but not limited to Tusla, the Department of Education, the Department of Social Protection, the Department of Justice, the Department of Foreign Affairs, Revenue, the Central Statistics Office, the HSE, City and County Childcare Committees, Local Authorities, the Central Statistics Office and the State Claims Agency.
The personal data sets that my Department shares are varied in nature depending on the type of services that are being provided to individuals or the functions being exercised. Specific details about the data sets that are shared and the legal bases for the sharing are set out in the Department’s Privacy Notices which are available on the Department’s website. These Notices provide individuals with information on how their personal data are being used and for what purpose, who has access to the data and how the sharing of their data will impact them.
Since the introduction of the GDPR, it is the policy of the Department that in instances of sharing data that appropriate governance arrangements are in place including data sharing agreements.
A range of joint controller agreements, controller processor agreements and data sharing agreements are in place across my Department.
Two data sharing agreements were progressed by my Department under the Data Sharing and Governance Act 2019 and were published for consultation, signed, and came into effect in 2022. The first agreement is with the Department of Education for the purposes of providing that Department with data on early learning and care settings to allow the Early Years Education Inspectorate to carry out inspections of the quality of educational provision in those settings. The second agreement relates to data sharing between the Department and Mary Immaculate College for the purposes of Recruitment for the Leadership for Inclusion in Early Years Care (LINC) Programme and providing additional funding to Early Learning and Care Settings with a LINC Graduate.
Finally, I wish to assure the Deputy that my Department has a range of organisational measures in place to ensure that the Department meets its obligations under data protection laws including a Data Protection Officer and a dedicated data protection team, various initiatives to build awareness of the Department’s data protection obligations and regular staff training.
