28.—(1) The F28[controller] of a prescribed body may supply personal data kept by him or her, or information extracted from such data, to the F28[controller] of another prescribed body if he or she is satisfied that it will be used for a relevant purpose only.

(2) The F28[controller] of a prescribed body may, for a relevant purpose only, keep and use personal data supplied to him or her under this section.

(3) In this section—

F29[…]

F29["controller" means a controller within the meaning of the Data Protection Regulation;

"Data Protection Regulation" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016²⁵ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);

"personal data" means personal data within the meaning of the Data Protection Regulation;]

“prescribed body” means a body prescribed by the Minister;

“relevant purpose” means the purpose of—

(a) recording a person's educational or training history or monitoring his or her educational or training progress in order to ascertain how best he or she may be assisted in availing of educational or training opportunities or in developing his or her full educational potential, or

(b) carrying out research into—

(i) the extent to which persons in receipt of, or who have received, a certain minimum education present for examinations to which Part VIII of the Act of 1998 applies, and the performance in such examinations of persons who so present,

(ii) the extent to which persons who have received a certain minimum education participate further in programmes of education, training or instruction, or

(iii) the general effectiveness of educational or training programmes.