C25

Prospective affecting provision: section inserted by Health (Amendment) (No. 3) Act 2021 (37/2021), s. 3, not commenced as of date of revision.

F95[38W. (1) Personal data or special categories of personal data collected for the purposes of sections 38N and 38V may, insofar as necessary, be processed—

(a) by an approved person, relevant person, member of the Garda Síochána, the Health Service Executive and the Minister for the purposes of the performance of their respective functions under those sections,

(b) where an agreement has been entered into with an approved person in accordance with section 38T or an approved services provider in accordance with section 38U, by that approved person or approved services provider and the responsible person for the purposes of the performance of their respective functions under the agreement concerned or under sections 38U and 38V, and

(c) by the Minister, the Health Service Executive and the Garda Síochána, for the purposes of—

(i) recording and verifying information regarding whether or not an applicable traveller was, on his or her arrival in the State, in possession of the result of a pre-travel test as defined in, and in accordance with the requirements of, any regulations made under this Act,

(ii) recording information regarding the designated states (within the meaning of section 38Q) that an applicable traveller has been in in the 14 days prior to his or her arrival in the State,

(iii) identifying and recording the place of residence (within the meaning of section 38P) of an applicable traveller,

(iv) recording whether or not an applicable traveller has taken a RT-PCR test in the State and, if so, the result of such test,

(v) recording whether or not an applicable traveller has taken a test prescribed by regulations under section 38S(1) (f) in the State and, if so, the result of such test, and

(vi) identifying and recording other personal data, including special categories of personal data required in accordance with section 38N and regulations under section 38S(1)(f), in respect of applicable travellers.

(2) For the purposes of this section, the Health Service Executive and the Minister are designated as data controllers in relation to personal data and special categories of personal data processed for the purposes referred to in subsection (1) and the Health Service Executive and the Minister, as the case may be, shall put in place appropriate data processing contracts, where necessary, with approved persons, approved services providers and any Minister of the Government in relation to whom the Minister has entered into an agreement in accordance with section 38X.

(3) Subject to subsections (4) and (5), personal data and special categories of personal data processed for the purposes referred to in subsection (1) shall be permanently deleted no later than 42 days after the arrival in the State of the person in relation to whom the data relates.

(4) Notwithstanding subsection (3), where an applicable traveller remains in quarantine in accordance with section 38N(2) for a period of more than 14 days, personal data and special categories of personal data processed in respect of the applicable traveller for the purposes referred to in subsection (1) shall be permanently deleted no later than 28 days after the end of the period of quarantine of the applicable traveller concerned.

(5) Notwithstanding subsections (3) and (4), where personal data or special categories of personal data, processed in accordance with subsection (1), are required for the purposes of the prevention, investigation, detection or prosecution of a criminal offence, the data—

(a) may be processed for as long as they are required for such prevention, investigation, detection or prosecution, and

(b) shall be permanently deleted after they are no longer required for such prevention, investigation, detection or prosecution.

(6) The Minister may, subject to the General Data Protection Regulation, and following consultation with such other Minister of the Government as he or she considers appropriate, make regulations—

(a) in relation to the processing of personal data, including special categories of personal data, which is necessary for the purposes of this Act or any regulations under this Act,

(b) designating a Minister of the Government, or such other person as the Minister considers appropriate, as a data controller for the purposes of this Act, and such Minister or person may be designated in addition to, or in substitution for, the Minister or the Health Service Executive.

(7) Regulations made under subsection (6)(a) shall specify—

(a) the personal data that may be processed,

(b) the circumstances in which the personal data may be processed, including specifying the persons to whom the data may be disclosed, and

(c) such other conditions (if any) as the Minister considers appropriate to impose on such processing.

(8) In this section—

"General Data Protection Regulation" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 20161 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);

"personal data" has the meaning it has in the General Data Protection Regulation;

"processing", in relation to personal data, has the meaning it has in the General Data Protection Regulation;

"special categories of personal data" has the meaning it has in the Data Protection Act 2018.]