40H.— (1) Article 3(2) authorities and FIU Ireland shall, in respect of information exchanged pursuant to section 40CA, section 40DA, section 40E(4), section 40F and section 40G, ensure that only staff who have been specifically trained and specifically authorised may process the following special categories of personal data under the guidance of a data protection officer:

(a) personal data revealing —

(i) the racial or ethnic origin of the data subject,

(ii) the political opinions or the religious or philosophical beliefs of the data subject, or

(iii) whether the data subject is a member of a trade union;

(b) data concerning health;

(c) personal data concerning an individual’s sex life or sexual orientation.

(2) In this section the following expressions shall have the meaning that they have in section 69 of the Data Protection Act 2018:

"data subject";

"personal data";

"processing";

"special categories of personal data".]