40. (1) For the purpose of enabling an elected representative to perform his or her functions as such a representative, the processing of personal data and special categories of personal data of a data subject by or on behalf of that representative shall be lawful where he or she receives a request or representation from the data subject or where, in accordance with subsection (2), he or she receives a request or representation from another person on behalf of the data subject.

(2) A person may make a request or representation on behalf of a data subject where the data subject—

(a) has given his or her consent to the making of the request or representation, as the case may be, or

(b) is, by reason of his or her physical or mental incapacity or age, unable to make a request or representation on his or her own behalf.

(3) In processing special categories of personal data under subsection (1), an elected representative shall impose limitations on access to that data to prevent unauthorised consultation, alteration, disclosure or erasure of that data.

(4) For the purpose referred to in subsection (1) and to the extent that disclosure is necessary and proportionate to enable an elected representative to deal with a request or representation referred to in that subsection, subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of the data subject, it shall be lawful for a person to disclose to the representative or a person acting on his or her behalf personal data and special categories of personal data of a data subject who makes the request or representation, or on whose behalf the request or representation is made, as the case may be, to enable that representative respond to that request or representation.

(5) In this section, “elected representative” means—

(a) a member of either House of the Oireachtas,

(b) a member of the European Parliament,

(c) a member of a local authority.