49. (1) Subject to the Data Protection Regulation and the Data Protection Act 2018, a designated institution of higher education or a funded body (whether or not also a designated institution of higher education) shall, if so requested by An tÚdarás, furnish to it such personal data in the format requested with regard to—

(a) a student of the designated institution of higher education or the funded body, including the name, address (including Eircode), date of birth, student number, Personal Public Service Number (PPSN), grant code for student support, Central Applications Office data, particulars of educational history, ethnicity, disability and socioeconomic status of the student,

(b) a member of the staff of the designated institution of higher education or the funded body, including the Personal Public Service Number (PPSN), gender, particulars regarding salary, disability and ethnicity of the member of the staff, and

(c) such other personal data as may be prescribed in consultation with An tÚdarás,

which are necessary and proportionate for An tÚdarás to perform its functions under paragraphs (b), (c), (d), (j), (k), (n) and (u) of section 9(1).

(2) The personal data requested by An tÚdarás from a designated institution of higher education or a funded body may include special categories of personal data, subject to suitable and specific measures taken to protect the data, which may include—

(a) limitations on access to the data undergoing processing within An tÚdarás in order to prevent unauthorised consultation, alteration, disclosure or erasure of the data,

(b) strict time limits for the erasure of the data and mechanisms to ensure that such time limits are observed,

(c) specific targeted training for those involved in processing operations, and

(d) where possible, the aggregation of the data.

(3) If a designated institution of higher education or a funded body fails or refuses to provide data when requested to do so under subsection (1) or (2), An tÚdarás may, by notice in writing, direct the designated institution of higher education or the funded body, as the case may be, to provide the data within a period specified in the notice.

(4) A designated institution of higher education or a funded body to which the direction under subsection (3) is given shall comply with the direction within the period specified in the notice under that subsection.

(5) An tÚdarás may, by notice in writing, amend or revoke a direction under this section.

(6) Subject to the Data Protection Regulation and the Data Protection Act 2018, An tÚdarás may publish the data obtained by it under this section in such form and manner as it considers appropriate.