Education (Leaving Certificate 2021) (Accredited Grades) Act 2021

Data protection

10. (1) Personal data of candidates collected for the purposes of the system of accredited grades pursuant to this Act and any regulations made thereunder may, in so far as is necessary, be processed by—

(a) the Minister and the Commission, for the purposes of the performance of their respective functions pursuant to this Act and any regulations made thereunder,

(b) an appeals officer appointed to consider an appeal referred to in section 2 (3) or (4), 4 (6) or 5 (2), as the case may be, for the purposes of the performance of his or her functions pursuant to this Act and any regulations made thereunder relating to the consideration of such appeal, subject to such other conditions (if any) as the Minister considers appropriate to impose on such processing, and

(c) a person with whom the Minister or the Commission, as the case may be, has entered into a contract for the provision of any services relating to the process of standardisation, including the design and application of that process and any necessary quality assurance related to such application, for the purposes of the provision of such service, subject to such other conditions (if any) as the Minister considers appropriate to impose on such processing.

(2) For the purposes of this section, the Minister and the Commission are designated as data controllers in relation to the personal data processed for the purposes referred to in subsection (1) and the Minister and the Commission, as the case may be, shall put in place appropriate data processing contracts, where necessary, with the persons referred to in paragraphs (b) and (c) of subsection (1).

(3) Personal data processed for the purposes referred to in subsection (1) shall be kept and used by the persons referred to in paragraphs (b) and (c) of subsection (1) for the respective purposes only referred to in those provisions and may be processed only for as long as the personal data are required for those purposes and shall be permanently deleted after they are no longer so required.

(4) (a) The Minister may, subject to the General Data Protection Regulation, and following consultation with the Commission, make regulations—

(i) in relation to the processing of personal data which is necessary for the purposes of this Act or any regulations made thereunder,

(ii) to designate such other person, as the Minister considers appropriate, as a data controller for the purposes of this Act or any regulations made thereunder, and such person may be designated in addition to, or in substitution for, the Minister or the Commission.

(b) Regulations made under paragraph (a) (i) shall specify—

(i) the personal data that may be processed,

(ii) the circumstances in which the personal data may be processed, including specifying the persons to whom the data may be disclosed, and

(iii) such other conditions (if any) as the Minister considers appropriate to impose on such processing.

(5) In this section—

“controller” means a controller within the meaning of the General Data Protection Regulation;

“General Data Protection Regulation” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 20161 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);

“personal data” has the meaning it has in the General Data Protection Regulation;

“processing”, in relation to personal data, has the meaning it has in the General Data Protection Regulation.

1 OJ No. L119, 4.5.2016, p.1