S.L. 546.3 Art. 3The Person Register.

(1) There shall be established a Person Register to be kept by the Agency which shall contain therein the core person record and, where applicable, the extended person details.

(2) The Agency shall maintain the quality and accuracy of the personal data within the Register in so far as the personal data falls within the remit of the Agency and shall ensure that access to the Register is limited to categories of personal data, listed in the Fifth Schedule, as required for each public sector body to fulfil their obligations under these regulations. In so doing, the Agency shall use appropriate security safeguards and role-based access control mechanisms to ensure that each public sector body shall only have access to the personal data that is strictly required to facilitate the sharing of personal data under the Act.

(3) Pursuant to the provisions of sub-regulation (2), the public sector body shall be responsible for the manner in which the data from the Register is used within such public sector body and for the authorisations of users from within the public sector body.

(4) In line with its functions under sub-regulation (1), the Agency shall conduct, where necessary, a data protection impact assessment and publish guidelines for the transfer of core person data from the Register to other official registers.

(5) The source for the initial loading of the records in the Register shall be derived from the existing records stored in the DATA SHARING WITHIN THE PUBLIC SECTOR

Common Database.

(6) New person records or changes to existing details in respect of the core person record by the processes included in the Fourth Schedule shall be verified and certified in terms of completeness and correctness. Such verification shall be done by the data owner responsible for the process authorized to generate such changes and before such details can be accepted to form part of the Register by the Registrar.

(7) Pending the verification and certification of such data, which shall be completed within the shortest time possible but not later than thirty (30) days, the new details shall remain suspended and shall be visible only to the data owner of the originating process and the Registrar:

Provided that all records which remain suspended in excess of the first thirty (30) days shall be reported to the Data Governance Council for a decision:

Provided further that if the status remains unchanged for more than thirty (30) days following the first escalation process, the matter shall be reported to the regulatory authority for a final decision and the required direction or order as applicable.

(8) The certification through a digital marker including the details of the public officer attesting to the completion of the verification process as described in sub-regulation (6) shall be stored as part of the pertinent person record which shall then become an official record forming an integral part of the Register.