33.— (1) The Commission may, in the circumstances referred to in subsection (2), disclose personal data to any of the following:

(a) the Data Protection Commission;

(b) a national regulatory authority or body designated by another Member State under Article 30 of the Directive;

F40[(ba) the Competition and Consumer Protection Commission;]

(c) the Garda Síochána;

(d) a broadcaster or a provider of an audiovisual on-demand media service;

F40[(da) an intermediary service provider;]

(e) a body prescribed in regulations made by the Minister.

(2) The circumstances referred to in subsection (1) are:

(a) in the case of subsection (1)(a), where the Commission considers that a complaint, or part of a complaint, made under section 48 is not relevant to the performance by the Commission of its functions, but may be relevant to the performance by the Data Protection Commission of its functions, and the Commission considers that the disclosure is necessary and proportionate for the purposes of transferring the complaint or part to the Data Protection Commission;

(b) in the case of subsection (1)(b), where the Commission considers that a complaint, or part of a complaint, made under section 48 is made in relation to a broadcaster, or a provider of an audiovisual on-demand media service, which is under the jurisdiction of another Member State, and the Commission considers that the disclosure is necessary and proportionate for the purposes of transferring the complaint or part to the national regulatory authority or body designated by that Member State;

F40[(ba) In the case of subsection (1)(ba), where the Commission considers that the disclosure is necessary and proportionate—

(i) for the effective implementation of the Digital Services Regulation, or

(ii) for the purposes of transferring a complaint or part of a complaint to the Competition and Consumer Protection Commission, where a complaint, or part of a complaint made under section 201 relates to a failure to comply with the Digital Services Regulation;]

(c) in the case of subsection (1)(c), where the Commission considers that the disclosure may be necessary and proportionate for the prevention or investigation of a criminal offence;

(d) in the case of subsection (1)(d), where the Commission considers that a complaint, or part of a complaint, made under section 48 is made in relation to the broadcaster or provider of an audiovisual on-demand media service, and the Commission considers that the disclosure is necessary and proportionate for the purposes of transferring the complaint or part to the broadcaster or provider under section 48(3);

F40[(da) in the case of subsection (1)(da),where the Commission considers that a complaint, or part of a complaint, made under section 201 is made in relation to an intermediary service provider, and the Commission considers that the disclosure is necessary and proportionate for the purposes of considering a complaint or part of a complaint made under that section;]

(e) in the case of any paragraph of subsection (1), where the Commission considers that the disclosure is necessary and proportionate in such other circumstances as may be prescribed in regulations made by the Minister.

(3) Where the Commission discloses a person’s personal data under this section the Commission shall notify the person of the disclosure in so far as it is practicable to do so.

F40[(3A) Where the Commission processes or discloses special categories of personal data in accordance with this section, it shall only do so where the Commission considers that the disclosure is necessary and proportionate in accordance with the Data Protection Regulation and the Act of 2018.

(3B) The Minister may make regulations prescribing suitable and specific measures for the processing of special categories of personal data under this section.

(3C) Where personal data processed by the Commission is required for the purposes of the prevention, investigation, detection or prosecution of a criminal offence, the data—

(a) may be processed for as long as it is required for such prevention, investigation, detection or prosecution, and

(b) shall be permanently deleted after it is no longer required for such prevention, investigation, detection or prosecution.]

(4) The matters that section 19 (1) of the Data Sharing and Governance Act 2019 requires to be specified or included in a data-sharing agreement shall be specified or included in any agreement entered into by the Commission for the disclosure to another body of personal data in accordance with subsection (1), subject to the following modifications to the description of those matters in section 19 (1) of that Act:

(a) references to the data-sharing shall be construed as references to any disclosure under the agreement;

(b) the reference in paragraph (d) to the public body concerned shall be construed as a reference to the body with whom the agreement is entered into;

(c) the reference in paragraph (f) to a public body shall be construed as a reference to a party to the agreement;

(d) the following paragraph shall be substituted for paragraph (r):

“(r) include in a schedule to the agreement a statement summarising the grounds on which the Commission considers the disclosure of the information to be necessary and proportionate as described in any paragraph of section 33 (2) of the Broadcasting Act 2009.”.

(5) The Minister shall make regulations under subsection (1)(e) only where he or she is satisfied that disclosure by the Commission of personal data to a body prescribed under the regulations, in the circumstances referred to in subsection (2), is necessary for the performance by the Commission or the body prescribed of functions in the public interest.

(6) The Minister shall make regulations under subsection (2)(e) only where he or she is satisfied that disclosure by the Commission of personal data to a body referred to in subsection (1), in the circumstances prescribed under the regulations, is necessary for the performance by the Commission or such a body of functions in the public interest.

(7) The Minister shall consider whether it is necessary to carry out an assessment of the impact of regulations made under subsection (1)(e) or (2)(e) on the processing of personal data before making the regulations and, where he or she considers it necessary to do so, shall carry out the assessment.

(8) Regulations made under this section shall be laid by the Minister before each House of the Oireachtas as soon as may be after they are made and, if a resolution annulling the regulations is passed by either such House within the next 21 days on which the House sits after the regulations are laid before it, the regulations shall be annulled accordingly, but without prejudice to the validity of anything previously done under them.

(9) The Commission shall give a copy of any agreement referred to in subsection (4) to the Minister.]

F40[(10) In this section—

“Act of 2018” means the Data Protection Act 2018;

“special categories of personal data” has the same meaning as it has in the Act of 2018;

“suitable and specific measures” means measures to be taken to safeguard the fundamental rights and freedoms of data subjects in processing the personal data of those data subjects and may include measures specified in section 36(1) of the Act of 2018.]