S.L. 546.3 Art. 6Person status information.

(1) Personal data concerning the status headings listed in the Third Schedule shall only be accessed following approval pursuant to sub-regulation (3) given by the public sector body responsible for such data:

Provided that the information referred to in this sub-regulation shall be derived upon a request received from a public sector body who is the owner of a process or service and made available through the specific person view and the related process as authorized by the relevant public sector body responsible for such data, and published in the Fifth and Sixth Schedules respectively:

Provided further that the public sector body responsible for an official register shall establish a mechanism that ensures that such person status information is not visible or accessible to the administrators of the Person Register as created by regulation 3.

(2) (a) Pursuant to the provisions of sub-regulation (1), any permission enabling a role to use a specific person view as included in the Fifth Schedule in the context of a specific public administration process shall be published under the Sixth Schedule.

(b) Any request for the publication of new data access permissions shall be addressed to the head of the public sector body who is the recognised data owner responsible for the relevant official register, or his delegate, in writing or by using the provided digital platform.

(3) The public sector body responsible for an official register shall ensure that permissions are designed in accordance with the principles of data minimization and purpose limitation and shall only authorise access to their official register after having evaluated the legal basis for the processing of such data, and after being satisfied that such processing meets any of the legal criteria as established in Article 6 of the General Data Protection Regulation. Such access shall be based on defined public administration roles, with public administration processes linked to a specific public administration role for data access authorisation purposes:

Provided that a record of the request and granting of such permission shall be kept, and that such permission shall be immediately revoked when no longer required.

(4) The public sector body responsible for an official register shall also establish adequate technical measures to enable the publication and maintenance of the roles and permissions referred to in sub-regulation (3) in a digital and machine-readable format and to DATA SHARING WITHIN THE PUBLIC SECTOR

provide for the request process for new permissions to add or delete roles and processes.

(5) Any permission under sub-regulation (3) shall be authorised by the public sector body responsible for the official register in accordance with the law under which the official register is established:

Provided that the permissions referred to in this regulation shall be made visible immediately through the appropriate web enabled forms of the national open data portal.