Research and Innovation Act 2024
|
PART 4 Data Protection | ||
|
Supply of personal data | ||
|
52. (1) Subject to the Data Protection Regulation and the Data Protection Act 2018 , a recipient of funding shall, if so requested by the Agency, furnish to it such personal data in the format requested with regard to— | ||
(a) a member of its staff, including the gender, particulars regarding salary, disability and ethnicity of the member of the staff, and | ||
(b) such other personal data as may be prescribed in consultation with the Agency, | ||
which are necessary and proportionate for the Agency to perform its functions under paragraphs (b), (c), (d), (e), (g), (l), (n) and (o) of section 9 (1). | ||
(2) The personal data requested by the Agency from a recipient of funding may include special categories of personal data (within the meaning of the Data Protection Act 2018 ), subject to suitable and specific measures taken by the Agency to protect the data as part of any processing of those data, which may include— | ||
(a) limitations on access to the data undergoing processing within the Agency in order to prevent unauthorised consultation, alteration, disclosure or erasure of the data, | ||
(b) strict time limits for the erasure of the data and mechanisms to ensure that such time limits are observed, | ||
(c) specific targeted training for those involved in processing operations, and | ||
(d) where possible, the aggregation of the data. | ||
(3) If a recipient of funding fails or refuses to provide data when requested to do so under subsection (1) or (2), the Agency may, by notice in writing, direct the recipient of funding to provide the data within a period specified in the notice. | ||
(4) A recipient of funding to which the direction under subsection (3) is given shall comply with the direction within the period specified in the notice under that subsection. | ||
(5) The Agency may, by notice in writing, amend or revoke a direction under this section. | ||
(6) Subject to the Data Protection Regulation and the Data Protection Act 2018 , the Agency may publish the data obtained by it under this section in such form and manner as it considers appropriate. | ||
(7) Notwithstanding subsection (6), special category data (within the meaning of the Data Protection Act 2018 ) may only be made publicly available in aggregated form to ensure that no person to whom the data relate is identifiable. |