28.— (1) F24[Notwithstanding anything contained in any enactment (other than the Act of 2018)], the F24[controller] of a person listed in Schedule 2, or of a person prescribed for the time being under subsection (2) (in this subsection called “the first named person”) shall on being requested to do so by the F24[controller] of a person so listed or prescribed, process personal data kept by the first named person, or information extracted from such data, to the F24[controller] of the other person so listed or prescribed for the time being, if the F24[controller] of F25[the first named person is satisfied that the data or information will be used only for a relevant purpose as respects a grant].

(2) If a person (not being a person listed in Schedule 2, or prescribed for the time being under this subsection) keeps personal data that is relevant to any of the functions of an awarding authority, inquiry officer, appeals officer or the Appeals Board, and the Minister considers that such supply by the person not so listed or prescribed to F25[a person so listed or prescribed will further the attainment of a relevant purpose as respects a grant], then the Minister, following consultation with the Data Protection Commissioner, may prescribe that person for the purposes of subsection (1).

F26[(2A) Notwithstanding anything contained in any enactment (other than the Act of 2018), the controller of a person listed in Schedule 3, or of a person prescribed for the time being under subsection (2B) (in this subsection called "the first named person"), shall on being requested to do so by the controller of a person so listed or prescribed, process personal data kept by the first named person, or information extracted from such data, for the controller of the other person so listed or prescribed for the time being, if the controller of the first named person is satisfied that the data or information will be used only for a relevant purpose as respects a bursary or scholarship.

(2B) If a person (not being a person listed in Schedule 3 or prescribed for the time being under this subsection) keeps personal data that are relevant to the functions of an awarding authority under section 12(1A), and the Minister considers that the supply of those data by the person not so listed or prescribed to a person so listed or prescribed will further the attainment of a relevant purpose as respects a bursary or scholarship, then, the Minister following consultation with the Data Protection Commission, may prescribe that person for the purposes of subsection (2A).]

(3) Any processing of personal data F25[for the purposes of subsection (1) or (2A) shall go no further than is necessary] for the attainment of the relevant purpose.

(4) A F24[controller] may refuse a request under subsection (1) F26[or (2A)] if he or she is satisfied that it would be unwarranted in any particular case by reason of prejudice to the fundamental rights and freedoms or legitimate interests of the data subject.

(5) In this section—

F24["Act of 2018" means the Data Protection Act 2018;

"controller" means a controller within the meaning of—

(a) the Data Protection Regulation, or

(b) Part 5 of the Act of 2018;

"Data Protection Regulation" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016⁴¹ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);]

F24["personal data" means personal data within the meaning of—

(a) the Data Protection Regulation, or

(b) Part 5 of the Act of 2018;]

F24["processing" means processing with the meaning of—

(a) the Data Protection Regulation, or

(b) Part 5 of the Act of 2018;]

“relevant purpose” means the purpose of—

(a) obtaining information to determine whether an applicant is eligible for a grant, F26[, bursary or scholarship, as the case may be]

(b) verifying data supplied as part of the application process,

(c) providing data to assist in an inquiry under section 22 or the prosecution of an offence under section 23,

(d) assisting in the processing of an application for a grant by a student and assisting in the payment of grants F26[, bursaries and scholarships]to students, and

(e) verifying that a student is enrolled or registered, in accordance with the rules of an approved institution, and continuing to attend an approved course at an approved institution.