MoU between the CSO and CORU

Memorandum of Understanding between the Central Statistics Office and CORU - Regulating Health & Social Care Professionals

List of Abbreviations

CSO                   Central Statistics Office

GDPR                General Data Protection Regulation

JLG                     Joint Liaison Group

MoU                  Memorandum of Understanding

CORU                CORU - Regulating Health & Social Care Professionals

Definitions of Terms

Act                    The Statistics Act, 1993

2018 Act           The Data Protection Act, 2018

The Data          CORU Register of Regulated Health Professionals

Establishment of the Parties

The CSO was established in 1949 and became a statutory body in 1994, under the Statistics Act, 1993 (the ‘Act’).

CORU has a statutory responsibility to regulate multiple health and social care professions. The full details of the Legislation governing CORU can be found at CORU Primary Legislation.

The Role of the Parties

The functions of the CSO are set out in the Act. In particular Section 10 states that the functions of the Office are the collection, compilation, extraction and dissemination for statistical purposes of information relating to economic, social and general activities and conditions in the State. The Office has the authority to co-ordinate official statistics compiled by public authorities to ensure, in particular, adherence to statistical standards and the use of appropriate classifications and has the authority to assess the statistical potential of the records maintained by public authorities and to ensure that the potential is realised. Furthermore, the CSO has legal obligations regarding the development, production, and dissemination of European statistics under Regulation 223/2009.

CORU is the independent, statutory organisation which regulates multiple health and social care professions. Their role is to protect the public by promoting high standards of professional conduct, education, training and competence through statutory registration of health and social care professionals.

Context and Background

The Act assigns the CSO authority to assess the statistical potential of the records maintained by public authorities and, in conjunction with them, to ensure that this potential is realised. This MoU sets out areas of mutual responsibility and understanding between the CSO and CORU in the use of administrative data for statistical purposes in accordance with Section 30 of the Act.

Purpose of the MoU

The purpose of this MoU is to clarify the roles and responsibilities of, as well as the areas of cooperation between, the CSO and CORU with regard to the Data.

This agreement is an MoU and is not intended to create binding or legal obligations on either Party. The MoU is entered into on the understanding that it is subordinate to the relevant legislation, set out below under ‘Legal Background’ governing each Party.

This MoU also sets out a shared understanding of the parties in relation to data protection issues that may arise and roles relating to the compilation, transfer, and use of this data. The processing of personal data of data subjects is governed by the Act, the Data Protection Act, 2018, (the ‘2018 Act’), and the General Data Protection Regulation (GDPR).

Responsibilities of Each Party

The controller for personal data is the CORU. When the data is transferred to the CSO, the CSO becomes the controller of the data file it holds. CORU remains the controller for the data file it holds. It follows then that it is the responsibility of the CSO to report any data breaches relating to the data it holds. All breach reporting will adhere to the timelines as set out in GDPR.

In the event of a breach relating to data, the CSO will inform the Data Protection Officer of CORU and also inform CORU of the breach through the Joint Liaison Group (JLG). This notification will be made as soon as possible. In addition, the CSO will refer to their own data breach procedures. CORU will not be held responsible for any loss, damage or injury caused as a result of such a breach. 

In the event of a breach relating to data the CSO will inform CORU through the JLG, in advance, of any decision to issue a public statement in relation to the breach.  Similarly, CORU will inform the CSO through the JLG, in advance, of any decision to issue a public statement in relation to the breach.  

CORU will not provide additional data or operational support in respect of the notification of data subjects in the event of a breach relating to CSO data.

All data subject requests are processed in line with GDPR and CSO’s Data Management Policy.

Legal Background

Transfer and processing of the data shall be done in accordance with Act, 2018 Act, GDPR, EU law and in accordance with the CSO’s Code of Practice, including its data matching policy.

The transfer and processing of the data is covered by, inter alia, the following provisions:

• Section 10(1) of the Act, concerning the functions of the CSO in the collection, compilation, extraction, and dissemination for statistical purposes of information relating to economic, social, and general activities and conditions in the State;
• Section 10(2) of the Act, concerning the authority of the CSO as regards co-ordination of official statistics compiled by public authorities and in ensuring, in particular, adherence to statistical standards and the use of appropriate classifications;
• Section 10(3) of the Act, concerning the authority of the CSO to assess the statistical potential of the records maintained by public authorities and, in conjunction with them, to ensure that this potential is realised;
• Section 13 of the Act, concerning the statistical independence of the Director General of the CSO;
• Section 11 of the Act, concerning co-operation and liaison with other public authorities and persons;
• Section 24(1) of the Act, concerning invitation to provide information on a voluntary basis;
• Section 24(2) of the Act, as amended by Section 178 of the 2018 Act, concerning the provision of information to the CSO;
• Sections 30 and 31 of the Act, concerning the use of the records of public authorities for statistical purposes;
• Article 6(1)(c) of the GDPR, concerning processing necessary for compliance with a legal obligation to which the controller is subject;
• Article 6(1)(e) of the GDPR, concerning processing necessary for the exercise of official authority vested in the CSO;
• Article 89 of the GDPR, concerning safeguards and derogations relating to processing for statistical purposes;
• Sections 32 and 33 of the Act, concerning the protection of information;
• Section 42 of the 2018 Act, concerning processing for statistical purposes;
• Article 9(2)(j) of the GDPR, concerning processing of special categories of personal data necessary for statistical purposes;
• Section 54(1)(c) of the 2018 Act, concerning processing for statistical purposes;
• Article 10 of the GDPR, concerning processing of personal data relating to criminal convictions and offences;
• Sections 55(1)(a) and 55(2)(e) of the 2018 Act concerning processing of personal data relating to criminal convictions and offences;

Data Transfer, Security, and Storage

The CSO will request the Data, or parts thereof, by means of a request pursuant to Section 30 of the Act, such request specifying the Data requested and, where relevant, the relevant period. Only necessary data will be requested, and used only for statistical purposes.

Data will be securely stored and processed by the CSO in accordance with GDPR, the Act, and CSO’s Data Management Policy. The CSO’s data retention and deletion processes will also follow the CSO’s Data Management Policy.

CORU will provide the CSO with the data in an agreed format. Information on data formats and delivery frequency shall be provided by CORU in respect of the data files schedule. In accordance with CSO policies on the control of data the CSO will not copy this data onto removable media (including laptop computers) unless appropriate security provisions are in place (i.e., encryption and password access) and there is an agreed business need to do so, in which case the CSO will inform CORU of such need via the JLG.

The CSO will ensure appropriate safeguards are applied to outputs before dissemination. Statistical Disclosure Control methodology will be used to ensure outputs are anonymous.

Joint Liaison Group

A CORU and CSO JLG will be convened, in accordance with the CSO’s standard Data Governance Framework. The JLG will oversee the data sharing as agreed between the parties and summarised in this MoU. 

The Terms of Reference (ToR) for the JLG will be agreed between CORU and the CSO. The ToR will cover, amongst other things, membership of the JLG, frequency of meetings and scope of the JLG.  Changes to the ToR must be jointly agreed by both parties.

Duration and Review of the MoU

This MoU will be published on the CSO website (www.cso.ie) and the CORU website.

This MoU will remain in force until a new one is entered into or either the CSO or CORU revoke it. Depending on events, this MoU may be amended, subject to the mutual agreement of CORU and the CSO.

This MoU will be reviewed biennially by both CORU and the CSO.  Any changes to the MoU shall only be made with the mutual agreement of CORU and the CSO.

Signed                                                                        Signed              

CSO                                                                            CORU

Jennifer Banim                                                           Claire O’Cleary                                                     

Director General                                                        CEO                                               

Date:   24/08/2026                                                    Date:  14/09/2026