Notice of the making of this Statutory Instrument was published in

“Iris Oifigiúil” of 26th March, 2021.

I, STEPHEN DONNELLY, Minister for Health, in exercise of the powers conferred upon me by section 5 and sections 38G(1) and 38K (inserted by section 7 of the Health (Amendment) Act 2021 (No. 1 of 2021)) of the Health Act 1947 (No. 28 of 1947) hereby make the following regulations:

Citation and operation

1. (1) These Regulations may be cited as the Health Act 1947 (Personal Data) Regulations 2021.

(2) These Regulations shall come into operation on the 22nd day of March 2021.

Definition

2. In these Regulations, “Act of 1947” means the Health Act 1947 (No. 28 of 1947).

Processing personal data

3. (1) Personal data specified in paragraph (2) that are collected for the purposes of sections 38B and 38J of the Act of 1947 may be processed, solely for the purposes and to the extent provided for in that Act, in accordance with a contract in force between the data controller and a data processor in relation to the processing of such data.

(2) The personal data referred to in paragraph (1), in relation to an applicable traveller, are the following:

(a) name of the applicable traveller;

(b) his or her place of residence;

(c) his or her email address;

(d) his or her phone number;

(e) number of people travelling with the applicable traveller;

(f) number of adults travelling with the applicable traveller;

(g) number of children travelling with the applicable traveller;

(h) reservation information, including:

(i) date for check in and check out;

(ii) reservation number;

(iii) number of rooms required;

(i) travel information, including:

(i) expected date of arrival;

(ii) expected time of arrival;

(iii) flight or ferry number;

(iv) place of arrival;

(j) states in which the applicable traveller was in the 14 days prior to his or her arrival in the State;

(k) passport number or national identity card number.

Processing special categories of personal data

4. (1) Special categories of personal data specified in paragraph (2) that are collected for the purposes of sections 38B and 38J of the Act of 1947 may be processed, solely for the purposes and to the extent provided for in that Act, in accordance with a contract in force between the data controller and a data processor in relation to the processing of such special categories of personal data.

(2) The special categories of personal data referred to in paragraph (1), in relation to an applicable traveller, are the following:

(a) information on dietary requirements for meals while in quarantine;

(b) information on accessibility requirements for room allocation while in quarantine;

(c) results of any RT-PCR tests undertaken by applicable travellers while undergoing quarantine;

(d) medical information provided for the purposes of diagnosis or treatment of persons who are quarantining in a designated facility or for the purposes of requesting a review of quarantine under section 38B(16) of the Act of 1947.

Processing of test results and medical information

5. Without prejudice to the generality of Regulation 4, personal data concerning health, including data relating to the results of a RT-PCR test undertaken by a person quarantining in a designated facility, may be processed, solely for the purposes and extent provided for in the Act of 1947, in accordance with a contract in force between the Minister and a data processor in relation to such data.

Non-disclosure of personal data

6. Where personal data or special categories of personal data are provided by an applicable traveller, in accordance with these Regulations or the Act of 1947, to the data controller or to a data processor referred to in Regulation 3 or 4, the data controller or the data processor, as the case may be, shall not share or otherwise disclose the data –

(a) to another person with whom the Minister has a contract for the processing of such data, unless the disclosure is necessary for the person to carry out his or her functions under that contract, these Regulations or the Act of 1947, and

(b) to a person with whom the Minister does not have a contract for the processing of such data, without the explicit consent of the applicable traveller.

Retention of personal data and special categories of personal data

7. Personal data and special categories of personal data processed in accordance with the provisions of section 38K of the Act of 1947 shall not be retained for a period longer than that specified in subsections (3), (4) or (5) of that section.

GIVEN under my Official Seal,

22 March, 2021.

STEPHEN DONNELLY,

Minister for Health.

EXPLANATORY NOTE

(This note is not part of the Instrument and does not purport to be a legal interpretation.)

This order sets out the data processing regulations which will apply to arrangements relating to the implementation of subsections 38B to 38L (inserted by the Health (Amendment) Act 2021 ) of the Health Act (1947).