Catherine Murphy (Kildare North, Social Democrats)
Link to this: Individually | In context | Oireachtas source

606. To ask the Minister for Culture, Heritage and the Gaeltacht the changes she has made to allow access by persons to their own data held by her Department and bodies under its aegis following the introduction of GDPR; and if she will make a statement on the matter. [31467/18]

Catherine Murphy (Kildare North, Social Democrats)
Link to this: Individually | In context | Oireachtas source

607. To ask the Minister for Culture, Heritage and the Gaeltacht the staffing complement and resources of her Department's data protection officer; and if she will make a statement on the matter. [31491/18]

Catherine Murphy (Kildare North, Social Democrats)
Link to this: Individually | In context | Oireachtas source

608. To ask the Minister for Culture, Heritage and the Gaeltacht the data protection impact assessments her Department has commenced since 15 May 2018; and if she will make a statement on the matter. [31508/18]

Catherine Murphy (Kildare North, Social Democrats)
Link to this: Individually | In context | Oireachtas source

612. To ask the Minister for Culture, Heritage and the Gaeltacht the measures she has taken in her Department further to the Minister of State at the Department of Public Expenditure and Reform's statement (details supplied) that the Data Sharing and Governance Bill 2018 is needed to provide a legal basis for certain data transfers; and if she will make a statement on the matter. [31619/18]

Josepha Madigan (Dublin Rathdown, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I propose to take Questions Nos. 606 to 608, inclusive, and 612 together.

As the Deputy will be aware, in common with other Government Departments, my Department was subject to existing Data Protection legislation prior to the coming into effect of the General Data Protection Regulation (GDPR) on 25th May 2018. This legislation included provision for Data Subject Access requests and for the use of Data Sharing Agreements for the transfer or sharing of data between bodies.

In February of this year, my Department appointed a Data Protection Officer (DPO) in line with the requirements of Article 37 of the GDPR. This officer was appointed at Assistant Principal Officer level and is based in the Corporate Governance & Services Unit of my Department and is responsible for overseeing the ongoing programme of work to ensure that the Department meets its obligations under the GDPR and the Data Protection Acts 1988 to 2018.

My Department has reviewed and updated its Data Protection webpage to ensure compliance with the GDPR and the Data Protection Acts 1988 to 2018, and has published a “Right to Access” webpage to assist persons who wish to submit a data access request. This webpage includes the contact details for our Data Protection Officer and the Data Protection Commission.

In line with Article 35 of the GDPR, the Department is required to undertake a data protection impact assessment where it intends to perform a new type of processing, in particular using new technologies, which is likely to result in a high risk to the rights and freedoms of natural persons. No requirements for a DPIA have been identified as yet since 15 May 2018.

With regard to data sharing and/or data transfer, while my Department continues to operate a number of Data Sharing Agreements in line with Data Protection legislation, the Data Protection Officer is overseeing a review of these to ensure compliance with best practice under the new legislative regime, including the adoption of a standardised template for Data Sharing Agreements entered into by this Department. I am advised that my Department is not currently engaged in data sharing or transfer arrangements of the kind referred to by the Deputy.