S.I. No. 624/2024 - Data Protection Act 2018 (Section 38(4)(b)) (Defence Forces Tribunal of Inquiry) Regulations 2024

Notice of the making of this Statutory Instrument was published in

“Iris Oifigiúil” of 12th November, 2024.

I, MICHEÁL MARTIN, Minister for Defence, in exercise of the powers conferred on me by subsection (4)(b) of section 38 of the Data Protection Act 2018 (No. 7 of 2018) and having duly complied with subsections (4) and (5) of section 38 of that Act, hereby make the following regulations:

Citation

1. These Regulations may be cited as the Data Protection Act 2018 (Section 38(4)(b)) (Defence Forces Tribunal of Inquiry) Regulations 2024.

Definitions

2. In these Regulations –

“Instrument of 2024” means the Tribunals of Inquiry (Evidence) Act 1921 (Appointment of Tribunal) Instrument 2024 ( S.I. No. 304 of 2024 );

“relevant task”, in relation to the Tribunal, means a task carried out by the Tribunal in connection with a matter which is specified in the resolutions as a matter of urgent public importance and for which the Tribunal was appointed to inquire into, report and make such findings and recommendations as it sees fit to the Taoiseach under the Instrument of 2024;

“resolutions” means the resolution passed by Dáil Éireann on 24 January 2024 and the resolution passed by Seanad Éireann on 30 January 2024, the text of which resolutions is set out in the recital to the Instrument of 2024;

“Tribunal” means the tribunal appointed by the Instrument of 2024.

Application of Regulations

3. These Regulations apply to personal data processed by the Tribunal in respect of which the Tribunal is the controller.

Processing, including further processing – public interest

4. Subject to the Data Protection Regulation and the Data Protection Act 2018 (No. 7 of 2018), the processing, including further processing, by the Tribunal of personal data to which these Regulations apply which is necessary and proportionate for the performance of a relevant task carried out in the public interest by the Tribunal, is hereby specified.

Circumstances in which personal data may be processed, including further processed

5. Without prejudice to the generality of Regulation 4, the circumstances in which personal data to which these Regulations apply may be processed, including further processed, shall include the performance by the Tribunal of such relevant tasks as the Tribunal considers necessary and proportionate to enable the Tribunal to perform its functions under the Tribunals of Inquiry (Evidence) Acts 1921 to 2011.

Persons to whom personal data may be disclosed

6. Personal data to which these Regulations apply may be disclosed to the following persons in accordance with such policies and procedures as may be provided for under Regulation 7:

(a) the sole member of the Tribunal;

(b) the registrar to the Tribunal;

(c) counsel to the Tribunal;

(d) solicitor to the Tribunal;

(e) a person appointed by the Tribunal in accordance with section 6 of the Tribunals of Inquiry (Evidence) (Amendment) Act 2002 (No. 7 of 2002) to be an investigator;

(f) a member of staff of the Tribunal;

(g) a person appointed by the Tribunal to provide advice or assistance to it in respect of any matter it thinks fit.

Conditions of processing, including further processing

7. (1) The Tribunal shall prepare and implement policies and procedures for the processing, including further processing, of personal data under these Regulations.

(2) Without prejudice to the generality of paragraph (1), the policies and procedures referred to in that paragraph shall provide for the following:

(a) the use of secure storage, passwords, encryption and other methods to ensure that personal data can only be accessed by persons authorised by the Tribunal to access that personal data;

(b) the use of controls to ensure that personal data are only disclosed to persons authorised by the Tribunal, or who are entitled or permitted by law, to receive that personal data;

(c) the determination of appropriate storage periods for personal data or classes of personal data;

(d) the treatment of personal data or classes of personal data at the expiry of the storage periods referred to in subparagraph (c);

(e) data minimisation, including the use of anonymisation and pseudonymisation, where appropriate.

(3) The policies and procedures referred to in paragraph (1) shall be reviewed by the Tribunal on a regular basis and, as the Tribunal considers it appropriate to do so, be updated.

GIVEN under my Official Seal,

7 November, 2024.

MICHEÁL MARTIN,

Minister for Defence.

EXPLANATORY NOTE

(This note is not part of the Instrument and does not purport to be a legal interpretation.)

These Regulations authorise the processing, including the further processing, of personal data by the Defence Forces Tribunal of Inquiry (‘the Tribunal’) pursuant to section 38 (4) of the Data Protection Act 2018 to the extent that such processing is necessary and proportionate to the performance of a relevant task by the Tribunal.

The Regulations also require the Tribunal to have in place certain policies and procedures relating to the processing, including the further processing, of data under these regulations.