Data Sharing in the Public Sector
Locations
At a recent seminar hosted by McDowell Purcell, Data Protection was the hot topic among attendees. Through our blog we will bring you the most up to date information and developments in the area of data protection. The following is a summary of the latest publication from the Office of the Data Protection Commissioner.
Whilst data sharing can bring benefits in terms of efficient delivery of public services it must be done in a way that respects the rights of individuals to have their personal data treated with care and not accessed or used without good reason.
In a recent publication, the Office of the Data Protection Commissioner (“ODPC”) has welcomed the decision of the European Court of Justice in the case of Bara & Oths C-201/2014. The applicants in the case were Romanian self-employed citizens who challenged the lawfulness of the transfer of their personal data by the National Tax Authority to the National Health Insurance under the Data Protection Directive 95/46/EC. The judgment, which focuses on a public sector data sharing arrangement, re-iterates the importance of informing the data subject about the processing of their personal data as it affects the exercise by the data subjects of their right of access to their personal data, their right to rectify their data being processed and their right to object to the processing of data.
In the publication, the ODPC has set out guidance in relation to the sharing of personal data between public sector bodies. The guidance focuses on the key areas of justification and proportionality, an explicit legal basis, transparency, good communication, authorisation, data minimisation, data access and security, data retention, governance and review.
As a result of the judgment, the ODPC has recommended that all public sector bodies complete a full review of their obligations and arrangements to ensure that those arrangements are fully compliant with the Data Protection Directive 95/46/EC. In these circumstances, this guidance and judgment requires detailed consideration by all public bodies. By way of example those public bodies carrying out investigations and inquiries, should review their primary legislation to ensure that any data sharing arrangement is provided for in that public body’s primary legislation. The ODPC has stated that whilst data sharing arrangements need to have a basis in primary legislation, public sector bodies may at a later juncture, and in advance of any data sharing, outline the details of the arrangement by prescribing same in secondary legislation such as a statutory instrument.
For full text of the publication please click here.
For more details on the Bara case click here.