I propose to take Questions Nos. 606 to 608, inclusive, and 612 together.
As the Deputy will be aware, in common with other Government Departments, my Department was subject to existing Data Protection legislation prior to the coming into effect of the General Data Protection Regulation (GDPR) on 25th May 2018. This legislation included provision for Data Subject Access requests and for the use of Data Sharing Agreements for the transfer or sharing of data between bodies.
In February of this year, my Department appointed a Data Protection Officer (DPO) in line with the requirements of Article 37 of the GDPR. This officer was appointed at Assistant Principal Officer level and is based in the Corporate Governance & Services Unit of my Department and is responsible for overseeing the ongoing programme of work to ensure that the Department meets its obligations under the GDPR and the Data Protection Acts 1988 to 2018.
My Department has reviewed and updated its Data Protection webpage to ensure compliance with the GDPR and the Data Protection Acts 1988 to 2018, and has published a “Right to Access” webpage to assist persons who wish to submit a data access request. This webpage includes the contact details for our Data Protection Officer and the Data Protection Commission.
In line with Article 35 of the GDPR, the Department is required to undertake a data protection impact assessment where it intends to perform a new type of processing, in particular using new technologies, which is likely to result in a high risk to the rights and freedoms of natural persons. No requirements for a DPIA have been identified as yet since 15 May 2018.
With regard to data sharing and/or data transfer, while my Department continues to operate a number of Data Sharing Agreements in line with Data Protection legislation, the Data Protection Officer is overseeing a review of these to ensure compliance with best practice under the new legislative regime, including the adoption of a standardised template for Data Sharing Agreements entered into by this Department. I am advised that my Department is not currently engaged in data sharing or transfer arrangements of the kind referred to by the Deputy.