C59

Prospective affecting provision: section inserted by Road Traffic and Roads Act 2023 (16/2023), s. 46, not commenced as of date of revision.

F112[77A.— (1) A road authority may set up and operate cameras and other data-gathering devices, or cause cameras or such devices to be set up and operated, on any public road situated in its functional area for any of the following purposes:

(a) the safe and efficient management, operation and use of public roads, including traffic management and providing information to the public;

(b) charging and collecting tolls and the operation of toll roads;

(c) the deterrence, prevention, investigation and detection of criminal offences, including road traffic offences;

(d) any other purpose prescribed by the Minister.

(2) A road authority shall obtain the written consent of the Authority before it sets up or operates cameras or other data-gathering devices, or causes cameras or such devices to be set up or operated, on a national managed road.

(3) The Authority may set up and operate cameras and other data-gathering devices, or cause cameras or such devices to be set up and operated, on any public road for any of the purposes specified in paragraphs (a) to (d) of subsection (1).

(4) Before the Authority sets up or operates cameras or other data-gathering devices, or causes cameras or such devices to be set up or operated, on a road other than a national road, it shall obtain the written consent of the road authority in whose functional area the road is situated.

(5) The Minister may provide by regulations that the exercise by a road authority of a power in subsection (1) or by the Authority of a power referred to in subsection (3) be subject to authorisation by the Minister or to conditions, and such regulations may prescribe criteria by which the Minister may grant or refuse such authorisation and conditions subject to which the Minister may grant an authorisation or subject to which the powers may be exercised without authorisation.

(6) Each road authority shall publish, and update, a schedule of such cameras and other data-gathering devices as the Minister may prescribe that are in operation on any road situated in its functional area for any of the purposes specified in paragraphs (a) to (d) of subsection (1) as soon as possible after this section comes into operation and in such manner and at such times as the Minister prescribes.

(7) The Authority shall publish, and update, a schedule of such cameras and other data-gathering devices as the Minister may prescribe that are in operation on any national road for any of the purposes specified in paragraphs (a) to (d) of subsection (1) as soon as possible after this section comes into operation and in such manner and at such times as the Minister prescribes.

(8) The Minister may, by regulations, provide for data obtained using cameras and other data-gathering devices operated by or on behalf of a road authority or the Authority on public roads to be processed and to be provided to any of the following persons, or for any of the following persons to be given access to such data, for any of the purposes specified in paragraphs (a) to (d) of subsection (1):

(a) a local authority;

(b) the Authority;

(c) the Garda Síochána;

(d) the National Transport Authority;

(e) the Road Safety Authority;

(f) any other person to whom the Minister considers that it is necessary, for any of the purposes specified in paragraphs (a) to (d) of subsection (1), that the data or access to the data be provided or given, and so prescribes.

(9) Regulations under subsection (8) shall provide that personal data only be provided to persons, or access to data only be given to persons, on specified conditions.

(10) Regulations under subsection (8) may provide for the entry into data-sharing agreements between a road authority, or the Authority, and persons to whom data is to be provided or access to data is to be given, which agreements may specify:

(a) the personal data to be provided, and to which access is to be given,

(b) how personal data provided or to which access is given is to be processed after it has been provided or such access has been given,

(c) that a data protection impact assessment be carried out under section 84 of the Data Protection Act 2018 or Article 35 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016⁴,

(d) the security measures to apply to the transmission, storage and accessing of data to which the agreement applies (in a manner that does not compromise those security measures),

(e) requirements in relation to the retention of—

(i) data provided or to which access is given, and

(ii) information resulting from the processing of that data, for the duration of the agreement and in the event that the agreement is terminated,

(f) the method to be employed to destroy or delete—

(i) data provided or to which access is given, and

(ii) information resulting from the processing of that data, at the end of the period for which the data is to be retained in accordance with the agreement,

and

(g) the procedure in accordance with which a party may withdraw from the agreement.

(11) The Minister may prescribe suitable and specific measures, including measures specified in section 36(1) of the Data Protection Act 2018, to be taken by a road authority or the Authority to safeguard the fundamental rights and freedoms of data subjects in processing personal data of those subjects and that enable processing of such data only in so far as is necessary and proportionate for any of the purposes specified in paragraphs (a) to (d) of subsection (1).

(12) The Minister shall prescribe measures to safeguard personal data obtained using cameras and other data-gathering devices operated by or on behalf of a road authority or the Authority on public roads, or provided or to which access is given under this section, including any of the following:

(a) limitations on access to the data undergoing processing within a workplace in order to prevent unauthorised consultation, alteration, disclosure or erasure of personal data,

(b) time-limits for the erasure of data and mechanisms to ensure that such limits are observed,

(c) specific targeted training for those involved in processing operations, and

(d) having regard to the state of the art, the context, nature, scope and purposes of data processing and the likelihood of risk to, and the severity of any risk to, the rights and freedoms of data subjects—

(i) logging mechanisms to permit verification of whether and by whom the personal data have been consulted, altered, disclosed or erased,

(ii) in cases in which it is not mandatory under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016⁵, designation of a data protection officer,

(iii) pseudonymisation of the data, and

(iv) encryption of the data.

(13) The Minister may issue guidelines relating to the operation of this section and may amend or cancel any such guidelines and any person carrying out a function under this section shall have regard to such guidelines.

(14) The Minister may make such further regulations as the Minister considers necessary for the purposes of enabling this section to have effect.

(15) Nothing in this section shall affect an authorisation under section 38 of the Garda Síochána Act 2005.]