95A. (1) The Minister, following consultation with such other Minister of the Government as he or she considers appropriate and with the Data Protection Commission, may make regulations to provide for the disclosure by the Director of information lawfully obtained by him or her, which may include personal data in relation to a relevant person or another person, to a public authority or a public body specified under subsection (2)(b), and in particular may make regulations relating to where—

(a) such disclosure is necessary to protect the vital interests of the relevant person or another person,

(b) such disclosure is necessary to protect and safeguard the interests of a relevant person or another person in relation to his or her treatment or care,

(c) such disclosure is necessary to protect and safeguard the assets of a relevant person, or

(d) the Director comes into possession of information that discloses the commission or possible commission of a criminal offence.

(2) Regulations made under subsection (1) shall specify—

(a) the type of information that the Director may disclose,

(b) the public authorities or public bodies to which the Director may disclose the information,

(c) the purpose or purposes of the disclosure of the information, and

(d) the conditions in accordance with which the information is to be disclosed.

(3) Without prejudice to the generality of subsection (1), regulations made thereunder may provide for the sharing of special categories of personal data or data relating to the prevention, detection, investigation or prosecution of criminal offences in relation to a relevant person where this is necessary for reasons of substantial public interest, in which case the regulations shall identify—

(a) the substantial public interest concerned, and

(b) the suitable and specific measures to be taken to safeguard the fundamental rights and freedoms of data subjects in processing the personal data which is authorised by the regulations.

(4) For the purposes of subsection (3)(b), subsections (2) to (8) of section 36 of the Data Protection Act 2018 shall apply in like manner to regulations to which subsection (3) of this section refers as they apply to regulations made under the said section 36.

(5) The Minister, when making regulations under subsection (1), shall have regard to the need for the protection of individuals with regard to the processing of their personal data, and without prejudice to the generality of that need, have regard to—

(a) the nature, scope and purposes of the processing,

(b) the nature of the substantial public interest concerned,

(c) any benefits likely to arise for the data subjects concerned,

(d) any risks arising for the rights and freedoms of such subjects, and

(e) the likelihood of any such risks arising and the severity of such risks.

(6) Regulations made under subsection (1) shall—

(a) respect the essence of the right to data protection, and

(b) enable processing of such data only in so far as is necessary and proportionate to the aim sought to be achieved.

(7) Regulations made under subsection (1) may, in specifying the conditions in accordance with which the information referred to in subsection (2) is to be disclosed under paragraph (d) of the said subsection (2), provide for information to be disclosed under and in accordance with a data sharing agreement within the meaning of section 2 of the Data Sharing and Governance Act 2019.

(8) In this section—

"Act of 2018" means the Data Protection Act 2018;

"information" includes data;

"personal data" has the same meaning as it has in section 69(1) of the Act of 2018;

"public authority" has the same meaning as it has in section 2(1) of the Act of 2018;

"public body" has the same meaning as it has in section 2(1) of the Act of 2018;

"special categories of personal data" has the same meaning as it has in section 2(1) of the Act of 2018.]