S.I. No. 724/2020 - Health Act 1970 (Section 75A) Order 2020

1. Categories of data subjects

1.1 The personal data transferred concerns the following categories of data subjects

- Persons for whom the costs of healthcare are or may be the responsibility of one of the Government of Ireland or the Government of the United Kingdom of Great Britain and Northern Ireland who are residing, working or staying in the territory of one of the countries.

- These are employed persons, self-employed persons, student, pensioners, pension claimants, family members, and other residents and insured persons of the countries.

2. Purposes of the transfers

2.1 The personal data will be transferred for the purpose of administering the reciprocal healthcare arrangements that will operate between the Government of Ireland and the Government of the United Kingdom of Great Britain and Northern Ireland, and specifically

a) to provide the receiving data controller with information necessary for its country to reimburse the other country for the costs of treatment received for persons whose healthcare costs it is responsible for

b) to establish the rights and obligations of persons covered by the reciprocal arrangements, and in order to administer applications, claims, registrations or payments;

c) to erase or destroy personal data when it is no longer required for the above purposes.

3. Categories of personal data concerned

3.1 The following categories of personal data will be processed to the extent that it is necessary and proportionate by the data controllers

a) Name,

b) Health identifier (where available),

c) Date of birth,

d) Address and post code,

e) Benefits received,

f) Status (as an insured person, pensioner or family member),

g) Familial status,

h) Pregnancy status,

i) Email address,

j) National or social security insurance number (where appropriate),

k) Employee number (where appropriate),

l) Confirmation that medical treatment has been received or is required,

m) The kind of medical treatment received or required,

n) The location of any received or required treatment,

o) Any expected duration of medical treatment,

p) Any other information which may be required for the purpose only of the administrative process in a particular case.

4. How the personal data will be exchanged/shared between the data controllers

4.1 The exchange of information may take place via paper-based postal mail, structured electronic documents and Electronic Data Interchange files with appropriate security measures in place that have regard to the method of exchange.

5. Legal Basis for Processing

5.1 The lawful basis for the processing of personal data is Article 6(1)(e) of the GDPR (and of the UK GDPR).

5.2 The data controllers will process special category data in accordance with Article 9 (2)(h) and Article 9(3) of the GDPR (and of the UK GDPR)

5.3 The underlying legislative provision for the HSE in relying on Article 6(1)(e) is the

Health Act 2004

which established the HSE and sets out its statutory functions.

5.4 The underlying legislative provision for the Department of Health and Social Care and the NHS Business Services Authority for relying on Article 6(1)(e) is the Healthcare (European Economic Area and Switzerland Arrangements) Act 2019 and the Healthcare (European Economic Area and Switzerland Arrangements) (EU Exit) Regulations 2019.

6. Sharing of personal data

6.1 The Department of Health and Social Care and the NHS Business Services Authority may share personal data received with the following third parties, for the purpose of administering applications, claims, registrations or payments

(i) The Department for Work and Pensions

(ii) HM Revenue and Customs

(iii) The NHS Commissioning Board (NHS England)

(iv) NHS Counter Fraud Authority

The Minister for Finance consents to the making of the foregoing Order.

GIVEN under the Official Seal of the Minister for Finance,

31 December, 2020.

PASCHAL DONOHOE,

Minister for Finance.

The Minister for Public Expenditure and Reform consents to the making of the foregoing Order.

GIVEN under the Official Seal of the Minister for Public Expenditure and Reform,

31 December, 2020.

MICHAEL MCGRATH,

Minister for Public Expenditure and Reform.

GIVEN under my Official Seal,

31 December, 2020.

STEPHEN DONNELLY,

Minister for Health.

EXPLANATORY NOTE

(

This note is not part of the Instrument and does not purport to be a legal interpretation.

)

Part 2 of the

Withdrawal of the United Kingdom from the European Union (Consequential Provisions) Act 2020

provides the Minister with the power to make an Order(s) to carry out any reciprocal or other arrangements made with the Government of the United Kingdom in respect of health services that will apply between the State and the United Kingdom after the end of the transition period. The purpose of this Order is to declare that the arrangements specified in the Memorandum of Understanding, the text of which is set out in the Schedule to the Order, which has been made with the Government of the United Kingdom, will apply between the State and the United Kingdom after the end of the transition period in respect of the categories of persons and the categories of health services specified in the Memorandum of Understanding.

Actual cost relates to Public Patient National Tariffs in the UK and DRG costs in Ireland

7. The controllers accept that suspension or discontinuation of this Arrangement (except for discontinuation in the event of a positive adequacy decision) does not relieve them from following the safeguards under this Arrangement as regards the processing of the personal data already transferred.

VIII. Coming into effect

This Arrangement will come into effect at the same time as the Reciprocal Healthcare Arrangements, or, if later, on the signatures of the controllers below, and will continue to have effect for as long as the processing of personal data is necessary to operate the reciprocal healthcare arrangements.

Date

Signed by

for and on behalf of the

HEALTH SERVICE EXECUTIVE

Date

Signed by

for and on behalf of the

DEPARTMENT OF HEALTH AND SOCIAL CARE

Date

Signed by

for and on behalf of the

NHS BUSINESS SERVICES AUTHORITY

Schedule 1

Details of transfers of personal data to which this Arrangement applies

8. The Participants will exchange these datasets on an annual basis and no later than the end of each calendar year.

9. The formula will be adjusted to reflect the inclusion of students and posted workers.

10. The formula will include the cost of patient charges and co-payments for public hospital services (including secondary and tertiary healthcare).

11. The Participants will agree the outputs of the formula(e) calculations on an annual basis.

12. A balancing lump sum will be paid annually by the Participant with the greater liability for that year.

13. The lump sum will be paid prior to the end of each calendar year.

14. The formula will be reviewed and renewed or updated every 3 years or more frequently by consent, for instance if new improved datasets become available or if a change in the methodology is required to improve the accuracy of the estimated costs.

Annex D

Draft administrative arrangements

Data Sharing Administrative Arrangements

RECIPROCAL HEALTHCARE ARRANGEMENTS BETWEEN THE GOVERNMENT OF THE UNITED KINGDOM OF GREAT BRITAIN AND NORTHERN IRELAND AND THE GOVERNMENT OF IRELAND IN THE CONTEXT OF THE COMMON TRAVEL AREA

Draft administrative arrangement under Article 46(3)(b) of the GDPR for the transfer of personal data between the Health Service Executive (Ireland) and the Department of Health and Social Care and the NHS Business Services Authority (United Kingdom) relating to the Common Travel Area Healthcare Arrangements

Each a “Participant” to this arrangement and together the “Participants”

The Participants

- acting in good faith and having no reason to believe that existing applicable legal requirements in their respective jurisdictions prevent them from doing so,

- recognising the importance of the protection of personal data and of having robust data protection regimes in place and having satisfied themselves that such protections are in place,

- having regard to Article 46(3)(b) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“General Data Protection Regulation” or “GDPR”),

- having regard also to the necessity to meet the data protection principles in Article 5 and to have a legal basis under Article 6 for the processing of personal data and also under Article 9 where the processing involves a special category of personal data as is the case under this arrangement,

- having regard to the relevant legal framework for the protection of personal data in the jurisdiction of the Participants and acknowledging the importance of dialogue between the National Data Protection Supervisory Authorities in each jurisdiction,

- having regard also to (i) the European Data Protection Board Guidelines 2/2020 on articles 46 (2) (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies Version 1.0 Adopted on 18 January 2020 and (ii) the Court of Justice of the European Union Judgment in Case C-311/18 Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (July 2020),

- noting the need to share personal data to operate the Reciprocal Healthcare arrangements entered into by the Department of Health and Social Care of the United Kingdom of Great Britain and Northern Ireland and the Department of Health of Ireland on the specified date,

- have reached the following understanding

- that controllers transferring personal data for the lawful purposes of reciprocal healthcare arrangements between the two countries will do so in accordance with the terms the of administrative arrangement (“the Arrangement”) under Article 46(3)(b) of the General Data Protection Regulation set -out hereunder.

For the avoidance of doubt, the Department of Health and Social Care is the data controller as regards the Secretary of State for Health and Social Care.

For the United Kingdom, the Department of Health and Social Care and the NHS Business Services Authority are the joint data controllers for the purposes of processing data transferred pursuant to this arrangement.

For Ireland, the Health Service Executive is the data controller.

The terms of the Arrangement are as follows

I. Purpose and Scope

Notice of the making of this Statutory Instrument was published in

“Iris Oifigiúil” of

8

th January,

2021.

WHEREAS the arrangements in respect of health services set out in the Memorandum of Understanding between the Government of the United Kingdom of Great Britain and Northern Ireland and the Government of Ireland concerning common travel area healthcare arrangements (in recognition of residency based health systems) (hereinafter called “the Memorandum of Understanding”) were made by the Government of Ireland with the Government of the United Kingdom of Great Britain and Northern Ireland;

AND WHEREAS paragraph 9(1) of the Memorandum of Understanding provides that the arrangements will come into effect at 11.00 p.m. on 31 December 2020;

AND WHEREAS, the Minister for Health having regard to the matters specified in subsection (3) of section 75A (inserted by

section 5

of the

Withdrawal of the United Kingdom from the European Union (Consequential Provisions) Act 2020

(No. 23 of 2020)) of the

Health Act 1970

(No. 1 of 1970) considers that it is necessary to make the following Order to carry out any reciprocal or other arrangements contained in the Memorandum of Understanding that will apply between the State and the United Kingdom after the end of the transition period;

NOW, I STEPHEN DONNELLY, Minister for Health, in exercise of the powers conferred on me by section 75A(1) (inserted by

section 5

of the

Withdrawal of the United Kingdom from the European Union (Consequential Provisions) Act 2020

(No. 23 of 2020)) of the

Health Act 1970

(No. 1 of 1970), with the consent of the Minister for Finance and the Minister for Public Expenditure and Reform, hereby make the following Order -