6-month deadline for data sharing in the public sector as Data Sharing and Governance Act fully comes into force on 16 December 2022

The last provisions of the Data Sharing and Governance Act 2019 (the DSGA - see our earlier overview of the DSGA) finally come into force on 16 December 2022, which has significant implications for public bodies that share personal data with one another.  

The DSGA is one of a series of measures under the Public Service Data Strategy 2019-2023 to improve how data is governed, managed and re-used within the public service. The DSGA provides the legal basis upon which public bodies may share personal data with each other and replaces the key provision that has allowed public bodies to share personal data with one another to date: section 38 of the Data Protection Act 2018. Section 38 of the Data Protection Act 2018 allows public bodies to process personal data where necessary and proportionate for (i) the performance of their function that a body is tasked with by legislation or (ii) the administration of any non-statutory scheme, programme or funds in connection with that function.

From 16 December 2022, public bodies can no longer rely on section 38 and must move to the new DSGA’s framework for sharing personal data. The DSGA sets out specific contractual and consultative requirements prior to the data sharing taking place. For example, a data sharing agreement that includes certain information required by the DSGA must be in place between the public bodies, which is then subject to public consultation and review and approval by the Data Governance Board (the Board).

The Board – which was recently established under the DSGA and empanelled by the Minister for Public Expenditure and Reform – is responsible for implementing the DSGA’s framework and is currently focused on the migration process for data sharing among public bodies to the DSGA regime. All existing data sharing arrangements that rely on section 38 must implement a DSGA compliant data sharing agreement before 16 December 2022 (unless another specific legislative provision exists that permits or requires the data sharing).

How to prepare for DSGA-compliant data sharing  

The Data Governance Unit (DGU) within the Office of the Government Chief Information Officer has published Guidelines and a Data Sharing Playbook to assist public bodies in a 9-step process from inception of the data sharing activity to signing and publication of data sharing agreements. These essential steps require a significant investment of time and resources by each public body involved in the planned data sharing:

• Step 1 – Preparation for data sharing completed by the public bodies.

• Step 2 – Data Officers designated in each public body participating in the data sharing activity. Review the proposed data sharing (Data officers act as points of contact on the data sharing activity throughout the life of the data sharing agreement and steward it through the 9 steps).

• Step 3 – A lead public body is nominated from the participating public bodies which prepares the data sharing agreement (with assistance from other public bodies).

• Step 4 – Public consultation on the draft data sharing agreement (minimum of 28 days).

• Step 5 – Public bodies review submissions following the public consultation and amend the data sharing agreement (maximum of 21 days).

• Step 6 – Review by the Board.

• Step 7 – Public bodies address recommendations from the Board (if any) and sign the data sharing agreement.

• Step 8 – Publication of the signed data sharing agreement (maximum of 10 days).

• Step 9 – Implementation of the data sharing agreement.

The time required to complete the early stages will vary depending on the complexity of the proposed data sharing and number of public sector bodies involved. Steps 4, 5 and 8 alone will take approximately 2 months to complete. PSBs should ensure to allow as much time as possible to complete this essential work.

The Board is required to review all data sharing agreements falling under the DSGA, which are replacing existing data sharing agreements which rely on Section 38 DPA before the deadline on 16 December 2022.

Key initial actions for public sector bodies

• Conduct an inventory of data sharing arrangements relying on Section 38 DPA (if not already completed) and prepare a mandatory return to the DGU at datagovernance@per.gov.ie.

• Engage with any other public bodies with which personal data is being, or proposed to be, shared.

• Designate internal roles: Data Officer and authorised signatory/ies (who will sign the data sharing agreement).

• Prepare for public consultation: Draft DPO statements and data sharing agreements.

For more information on the DSGA, and how your organisation can prepare for the 16 December 2022 deadline, please contact Seán O'Donnell, Zelda Deasy, Kelly Mackey or any member of the ByrneWallace LLP Data Protection Team.

To register for ByrneWallace LLP updates click here, and follow us on LinkedIn.