European Union (European Data Governance Act) Regulations 2024

S.I. No. 272/2024 - European Union (European Data Governance Act) Regulations 2024 Download PDF Íoslódáil PDF Notice of the making of this Statutory Instrument was published in “Iris Oifigiúil” of th June, 2024. I, EAMON RYAN, Minister for the Environment, Climate and Communications, in exercise of the powers conferred on me by section 3 of the European Communities Act 1972 (No. 27 of 1972) and for the purpose of giving effect to Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022 , hereby make the following regulations: 1. These Regulations may be cited as the European Union (Data Governance Act) Regulations 2024. 2. (1) In these Regulations – “Reviews Commissioner” means the person who, for the time being, holds the office of Information Commissioner under the Freedom of Information Act 2014 (No. 30 of 2014), “body governed by public law” means a body, having a legal personality, established for the specific purpose of meeting needs in the general interest, not having an industrial or commercial character, that – (a) is financed, for the most part, by one or more of the following: (i) the State; (ii) a regional assembly; (iii) a local authority; (iv) any other body governed by public law, (b) is subject to management supervision by one or more of the bodies referred to in paragraph (a), or (c) has an administrative, managerial or supervisory board, more than half of whose members are appointed by one or more of the bodies referred to in subparagraph (a), “categories of protected data” means data held by a public sector body which is protected on the grounds of: (a) commercial confidentiality, including business, professional and company secrets, (b) statistical confidentiality, (c) the protection of intellectual property rights of third parties, or (d) the protection of personal data, insofar as such data fall outside the scope of Directive (EU) 2019/1024, “competent body” means the body referred to in Regulation 6, “enactment” has the same meaning as it has in the Interpretation Act 2005 (No. 23 of 2005), “exclusive arrangement” means an agreement or other practice pertaining to the re-use of categories of protected data which grants exclusive rights or which has as its objective or effect to grant such exclusive rights or to restrict the availability of data for re-use by entities other than the parties to such agreement or practice, “EU Regulation” means Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022 on European data governance and amending Regulation (EU) 2018/1724 (Data Governance Act), “local authority” means a local authority for the purposes of the Local Government Act 2001 (No. 37 of 2011), “Minister” means the Minister for the Environment, Climate and Communications, “public sector body” means – (a) the State, (b) a regional assembly, (c) a local authority, (d) a body governed by public law, or (f) an association formed by one or more than one body referred to in (a) to (e), “regional assembly” means a body established in accordance with section 43 of the Local Government Act 1991 (No. 11 of 1991), “re-use” means the use by natural or legal persons of data held by public sector bodies, for commercial or non-commercial purposes other than the initial purpose within the public task for which the data were produced, except for the exchange of data between public sector bodies purely in pursuit of their public tasks, and “single information point” has the meaning it has in Regulation 7. (2) A word or expression used in these Regulations and which is also used in the EU Regulation has, unless the context otherwise requires, the same meaning in these Regulations as it has in the EU Regulation. 3. (1) These Regulations apply to categories of protected data held by public sector bodies. (2) These Regulations do not apply to data referred to in Article 3(2) of the EU Regulation and are without prejudice to – (a) European Union, national law and international agreements on categories of protected data to which the European Union or Member States are party, (b) European Union and national law on access to documents, (c) the matters provided for in paragraph (a) and (b) of Article 1(2) of the EU Regulation, and (d) the EU instruments listed in Article 1(3) of the EU Regulation. Exclusive arrangements 4. (1) Subject to paragraph (2), exclusive arrangements pertaining to the re-use of categories of protected data are prohibited. (2) An exclusive arrangement pertaining to the re-use of categories of protected data may be permitted where it is in accordance with paragraphs (2) to (4) of Article 4 of the EU Regulation. (4) Where, prior to the coming into operation of these Regulations, there is in place an exclusive arrangement concluded prior to 23 June 2022 that does not meet the conditions laid down in paragraphs (2) and (3) of Article 4 of the EU Regulation, such arrangement shall be terminated at the end of the applicable contract and in any event by 24 December 2024. Re-use of categories of protected data 5. (1) A public sector body which holds categories of protected data and decides to make the data available for re-use shall set conditions for the grant or refusal of access for the re-use of the data in accordance with Article 5 of the EU Regulation. (2) Conditions on re-use of categories of protected data may be set out in an agreement between the public sector body and the data re-user. (3) Subject to paragraphs (2) and (3) of Article 31 of the EU Regulation, a public sector body to which paragraph (1) applies, shall take all reasonable technical, legal and organisation measures, including contractual arrangements, in order to prevent international transfer or governmental access to non-personal data held in the European Union where such transfer or access would create a conflict with European law or national law. (4) It shall be an offence for a person to whom the right to re-use non-personal data was granted to transfer, facilitate the transfer or permit the transfer of data to a third country other than in accordance with this Regulation and with Articles 5(14) and 31 of the EU Regulation. (5) A person who commits an offence under paragraph (4) shall be liable – (a) on summary conviction to a class A fine or imprisonment for a term not exceeding 6 months or to both, (b) on conviction on indictment, to a fine not exceeding €500,000 or imprisonment for a term not exceeding 3 years or to both. (6) Any fees charged by the public sector body shall be in accordance with the requirements of Article 6 of the EU Directive. Competent Body 6. (1) The Central Statistics Office is designated as the competent body for the purposes of Article 7(1) of the EU Regulation. (2) The Central Statistics Office shall, in accordance with Article 7(4) of the EU Regulation, assist public sector bodies which decide to make categories of protected data available for reuse. (3) The Central Statistics Office may engage public sector bodies through an agreement setting out the basis for its engagement under this Regulation and may include the following conditions: (b) that the public sector body applies safeguards appropriate to sharing categories of protected data; (e) timeliness for access and reuse of data, including access to secure processing environments. Single Information Point 7. (1) The Minister is designated with responsibility for maintaining a single information point for the purposes of Article 8(1) of the EU Regulation. (3) The means for the single information point may, with the agreement of the Minister, be replaced by another means, which shall be easily identifiable from a website of the Government. (4) A public sector body shall provide the single information point with information pertaining to the categories of protected data it proposes to make available or which it has already made available for re-use and this information shall include – (a) a description of the data, (b) terms and conditions for re-use, including compliance with the conditions for re-use in Article 5 of the EU Regulation, (c) procedures for applying for data access and re-use, and (d) information relating to any fees that may apply. 8. (1) Where a public sector body decides – (a) to refuse to allow a person access for re-use of categories of protected data, (b) to permit access for re-use of the protected data but subject to a fee which the person to whom access is being granted considers is not in accordance with Article 6 of the EU Regulation, or (c) to permit access for re-use of the protected data but subject to a condition which the person to whom access is being granted considers is not in accordance with Article 5 of the EU Regulation, then the person may request a review of the decision from the Reviews Commissioner. (2) Where a public sector body fails to adopt a decision on whether to permit or refuse re-use of categories of protected data within two months of the date of receipt of the request, such failure shall be deemed a refusal. (3) A request for a review under paragraph (1) shall be sent to the Reviews Commissioner in a legible form. (4) A request for a review under paragraph (1) shall be made – (a) not later than 4 weeks after the notification of the decision by the public sector body to the person concerned or the expiry of the period referred to in paragraph (2), as the case may be, or (b) in a case in which the Reviews Commissioner is of the opinion that there are reasonable grounds for extending that period, not later than the expiration of an additional period of such length as he or she may determine. Delegation of functions by Reviews Commissioner 9. (1) The Reviews Commissioner may delegate his or her functions as Reviews Commissioner in respect of a request for a review under Regulation 8 to a member of his or her staff. (2) Where a delegation has been made under paragraph (1), references elsewhere in these Regulations to the Reviews Commissioner shall be read, where appropriate having regard to the delegation, as including references to any person to whom functions stand delegated by the delegation. (3) A person exercising functions by virtue of a delegation made under paragraph (1) shall cease to exercise those functions – (a) if the delegation is revoked by the Reviews Commissioner, or (b) if the person ceases to be a member of the staff of the Reviews Commissioner and consequentially those functions are exercisable by the Reviews Commissioner or by such other person as the Reviews Commissioner may delegate those functions to under paragraph (1). (4) In this Regulation, a reference to a member of staff includes, where appropriate, an employee, officer or servant. Reviews Commissioner decision 10. (1) This Regulation applies to a decision by a public sector body to which a request for a review under Regulation 8(1) relates. (2) The Reviews Commissioner – (a) shall review in accordance with these Regulations a decision to which this Regulation applies, and (b) following the review may, as the Reviews Commissioner considers appropriate, decide – (i) to affirm the decision, or (ii) remit it with such directions as the Reviews Commissioner considers appropriate to the public sector body for reconsideration. (3) Where the Reviews Commissioner remits a decision, the public sector body concerned shall take into consideration any directions of the Reviews Commissioner and if the person who made the request for review under paragraph (2) is further aggrieved on the same ground under Regulation 8(1) by the subsequent decision of the public sector body, redress lies by way of appeal to the High Court under Regulation 13. (4) The Reviews Commissioner shall establish and maintain efficient and effective procedures for conducting reviews and reach decisions in a timely and effective manner. (5) (a) A person who makes a request for review under Regulation 8 may, by notice in writing given to the Reviews Commissioner, at any time before a notice under paragraph (9) in relation to the decision of the Reviews Commissioner is given to the person, withdraw the request. (b) The Reviews Commissioner shall cause a copy of any notice given to him or her under this paragraph to be given to the public sector body concerned and to any other person to whom, in the opinion of the Reviews Commissioner, it should be given. (6) As soon as may be after the receipt by the Reviews Commissioner of a request for review under Regulation 8, the Reviews Commissioner shall cause a copy of the request for review to be given to the public sector body concerned. (7) Where a request for a review under Regulation 8 is made, the Reviews Commissioner may at any time endeavour to effect a settlement between the parties concerned of the matter concerned and may for that purpose, notwithstanding paragraph (4), suspend, for such period as may be agreed with the parties concerned and, if appropriate, discontinue, the review concerned. (8) In relation to a review under this Regulation the public sector body concerned may make submissions (in writing, orally or by electronic means) to the Reviews Commissioner in relation to any matter relevant to the review and the Reviews Commissioner shall take any such submissions into account for the purposes of the review. (9) (a) The Reviews Commissioner may refuse to carry out a review under paragraph (2)(a) if he or she is or becomes of the opinion that – (i) the request for review under Regulation 8 is frivolous or vexatious, (ii) the request does not relate to a decision specified in paragraph (1), or (iii) the matter to which the request relates is, has been or will be, the subject of another review under this Regulation. (b) In determining whether to refuse to carry out or discontinue a review under this Regulation, the Reviews Commissioner shall, subject to these Regulations, act in accordance with his or her own discretion. (10) Notice, in writing (including by electronic means), of a decision under paragraph (2)(b), or of a refusal or discontinuation under paragraph (9) and the reasons therefor, shall be given by the Reviews Commissioner to – (a) the public sector body concerned, (b) the person who made the request for review under Regulation 8, and (c) any other person to whom, in the opinion of the Reviews Commissioner, such notice should be given. (11) The notice referred to in paragraph (10) shall be given as soon as may be after the decision, refusal or discontinuation concerned. (12) The Reviews Commissioner shall not disclose confidential information obtained while performing functions under these Regulations. Request for further information 11. (1) Where the Reviews Commissioner considers that the reasons given by the public sector body for its decision are not adequate, then he or she shall direct the public sector body concerned to furnish to the person concerned and the Reviews Commissioner a statement, in writing (including by electronic means), containing any further information in relation to those matters that is in the power or control of the public sector body. (2) A public sector body shall comply with a direction under this Regulation as soon as may be, but not later than 3 weeks after its receipt, or such longer period or periods as the Reviews Commissioner considers appropriate in the circumstances. Powers of Reviews Commissioner 12. (1) The Reviews Commissioner may, for the purposes of a review under Regulation 10 – (a) require any person who, in the opinion of the Reviews Commissioner, is in possession of information, or has a record in his or her power or control that, in the opinion of the Reviews Commissioner, is relevant to the said purposes, to furnish to the Reviews Commissioner any such information or record that is in his or her possession or, as the case may be, power or control and, where appropriate, require the person to attend before him or her for that purpose, and (2) The Reviews Commissioner may for the purpose of such a review enter any premises occupied by a public sector body and there – (a) require any person found on the premises – (i) to furnish the Reviews Commissioner with such information in the possession of that person as the Reviews Commissioner may reasonably require for that purpose, and (ii) to make available to the Reviews Commissioner any record in that person’s power or control that, in the opinion of the Reviews Commissioner, is relevant to that purpose, and (3) Subject to paragraph (4), no enactment or rule of law prohibiting or restricting the disclosure or communication of information shall preclude a person from furnishing to the Reviews Commissioner any information or record to which paragraph (2) relates. (4) A person to whom a requirement is addressed under this Regulation is entitled to the same immunities and privileges as a witness in a court. (5) The Reviews Commissioner may, if he or she thinks fit, pay to any person who for the purposes of a review under Regulation 10, attends before the Reviews Commissioner or furnishes information or a record to him or her – (a) sums in respect of travelling and subsistence expenses properly incurred by the person, and (b) allowances by way of compensation for loss of his or her time, of such amount as may be determined by the Minister for Public Expenditure, NDP Delivery and Reform. (6) Subject to these Regulations, the procedure for conducting a review under Regulation 10 shall be such as the Reviews Commissioner considers appropriate in all the circumstances of the case and, without prejudice to the foregoing, shall be as informal as is consistent with the due performance of the functions of the Reviews Commissioner. Appeal to High Court 13. (1) A person to whom Regulation 8(1) applies may, following a decision of the Reviews Commissioner affirming the decision, or a decision of the public sector body concerned following remittance to it by the Reviews Commissioner, appeal to the High Court on a point of law. (2) A person who is directly affected by a decision of a public sector body to permit access for the re-use of categories of public sector data and who is not a person to whom Regulation 8(1) applies may appeal a decision of the public sector body to the High Court. (3) An appeal under this Regulation shall be initiated not later than 8 weeks after – (a) in the case of a person to whom Regulation 8(1) applies, notice of the decision was given, and (b) in the case of a person to whom paragraph (2) applies, he or she has been made aware of the decision. (4) The High Court shall endeavour to ensure that the protected nature of data is preserved in accordance with Article 5 of the EU Regulation. (5) Without prejudice to paragraph (4), precautions under that paragraph may include – (a) hearing the whole or part of any proceedings before a Court otherwise than in public, (b) prohibiting the publication of such information in relation to any such proceedings as it may determine, including information in relation to the parties to the proceedings and the contents of orders made by the Court concerned in the proceedings, and (c) examining a document or a copy of a document without giving access or information in relation to it to a party (other than the public sector body concerned) to the proceedings. GIVEN under my Official Seal, 5 June, 2024. EAMON RYAN, Minister for the Environment, Climate and Communications. EXPLANATORY NOTE This note is not part of the Instrument and does not purport to be a legal interpretation These Regulations give effect to provisions in Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022 on European data governance and amending Regulation (EU) 2018/1724 (Data Governance Act). In particular, they seek to establish a framework for the sharing of ‘categories of protected data’ held by public sector bodies as set out in Chapter 2 of the EU Regulation. 1 OJ L 152, 3.6.2022, p. 1. 1 OJ L 152, 3.6.2022, p. 1.