Kathleen Funchion (Carlow-Kilkenny, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

382. To ask the Minister for Education and Skills the reason for the introduction by SUSI of the third party representative process (details supplied); and if he will make a statement on the matter. [55159/17]

Richard Bruton (Dublin Bay North, Fine Gael)
Link to this: Individually | In context | Oireachtas source

The Deputy will be aware that the new General Data Protection Regulation (GDPR) will take effect across the EU on 25 May 2018. As part of its due diligence process, SUSI has reviewed and updated its data processes and procedures.

SUSI processes data relating to up to 400,000 individuals in any one year and is obliged to ensure that personal information is processed in accordance with all relevant legislation. 

Under GDPR, the concept of assumed and implicit consent to process data will no longer exist and data controllers like SUSI, must therefore ensure that they obtain explicit consent from individuals to process their data for whatever reason.  

SUSI commissioned an independent audit and review of data protection procedures in 2016. On foot of the recommendations to mitigate against any potential data breach and to ensure that processes are operationalised and embedded in time for compliance with GDPR, SUSI has determined that in order to handle or process requests made by any third party on behalf of applicants and other parties to student grant applications, a form of consent or third party authorisation process is necessary.