05 May 2016
The Office of the Data Protection Commissioner (DPC) has issued updated guidance on data sharing in the public sector. It has re-iterated the importance of informing the data subject about the processing of their personal data.
Following on from the recent case of Bara at the Court of Justice of the EU, the DPC recommends that all data sharing arrangements in the public sector should:
It is also advised that in circumstances where the public policy objective being pursued involves a data sharing arrangement without the data subject’s consent, an assessment should be made as to whether the likely benefits of the sharing justify the overriding of the individual’s data protection rights. Any exemptions contained in the Data Protection Acts which reduce fair processing provisions should be applied on a very narrow basis in order to protect and uphold the fundamental data rights of the individual.
The drafting of a data sharing and governance Bill has been approved by the Irish Government and it is to be led by the Department of Public Expenditure and Reform. Case law is emanating from Europe on this topic, raising the profile of data protection among public sector bodies even further. Now is the time that public sector bodies should review their data sharing activities with other public bodies and be clear on data protection compliance and the potential effect the sharing would have on the individual involved.