MoU between the CSO & the HSE

Memorandum of Understanding between the Central Statistics Office and the Health Service Executive.

 PREAMBLE

Health Service Executive (HSE) Mandate and Mission

The HSE provides all of Ireland's public health services in hospitals and communities across the country. Its vision is: a healthier Ireland, with the right care, at the right time and in the right place.  Its aim is an Irish health service where:

• You can access the right care, at the right time and in the right place and you feel empowered, listened to and safe.
• You are supported to live well and you feel connected with your community.
• You can have trust and confidence that the organisation is run well.
• We will work as one team, supported to do the best we can for patients, service users, their families and the public.

Central Statistics Office (CSO) Mandate and Mission

The CSO’s mandate, as set out under section 10 of the Statistics Act 1993 includes:

"the collection, compilation, extraction and dissemination for statistical purposes of information relating to economic, social and general activities and conditions in the State"

The same section further empowers the CSO to co-ordinate official statistics compiled by other public authorities, including but not limited to ensuring adherence to statistical standards and the use of appropriate classifications as well as to assess the statistical potential of administrative records and to ensure that such potential is realised.

The work of the CSO is undertaken in the European context under EU Regulation 223/2009, which provides for the development, production and dissemination of European statistics.

The Vision of the CSO is to provide “Independent Insight for All” and we aim to describe Ireland, it’s people, economy, society and environment through verifiable data and accurate information.

Memorandum of Understanding (MoU)

At the onset of the COVID 19 pandemic, both HSE and CSO quickly mobilised to ensure that Ireland could effectively manage its journey through the pandemic. As part of this mobilisation, HSE and CSO, collaborated to ensure the statistical capacity and capability was put in place to inform Government decision making in the face of the pandemic.

Furthermore, HSE and CSO leveraged statistical infrastructure at CSO to provide a COVID-19 Data Research Hub for the purposes of COVID 19 health research in compliance with relevant statistical, privacy and health research regulations.

The primary driver behind the success of this collaboration is the use and re-use of existing and new administrative data sources for statistical purposes. The administrative data sources are sourced in a safe and secure manner from different existing and new information systems managed by the HSE.

The Statistics Act, 1993, provides for the collection, compilation, extraction, and dissemination of official statistics. Sections 30 and 31 of the Act set out provisions relating to access by the CSO to records of public authorities in the exercise of its functions and to co-operation by public bodies with the CSO for those purposes. Section 30 prescribes a specific requirement attaching to access to medical records that are not publicly available, which requires the agreement of the Minister for Health.

Recognising the benefit of the collaboration between CSO and HSE in response to the COVID 19 pandemic, HSE and CSO will now build on these experiences to broaden the scope of this collaboration to inform decision making with respect to the Health sector and more generally with respect to the Irish economy and society.

Broadening the scope of this collaboration will deliver significant benefits in enabling HSE and CSO deliver on their mandates. This MoU will also serve as a basis for strengthening the relationship between the two organisations.

This MoU also sets out a shared understanding of the parties in relation to data protection issues that may arise and roles relating to the compilation, transfer and use of this data. The processing of personal data of data subjects by the HSE and the CSO in the context of this MOU is governed by the Statistics Act, 1993 and the Data Protection Law. “Data Protection Law” for the purposes of this MoU mean any law, statute, regulation, byelaw or subordinate legislation in force form time to time, any binding court order or judgment and applicable guidance, guidelines or codes of practice issued by the Data Protection Commission relating to the processing, privacy and/or use of personal data as applicable to either party or the subject matter of this MoU, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Data Protection Acts 1988 to 2018; the Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018 (S.I. 314 of 2018); the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336 of 211) and any laws which replace, extend, re-enact, consolidate or amend any of the foregoing.

The parties are independently responsible for their processing of personal data, and due to nature of the relationship wherein the HSE is compelled by a legal obligation to provide the CSO with the requested data pursuant to the Statistics Act, 1993 and the Ministerial letters agreeing to the sharing of medical records, a joint-controller relationship is not capable of being formed.

AGREEMENT

General

1. HSE shall continue to provide data to the CSO for statistical purposes in accordance with the terms of the Statistics Act, 1993. A number of data flows are currently provided by HSE to the CSO for both general statistical purposes and for informing Government decision making in response to the pandemic. A list of these files, with delivery frequency, shall be maintained by both Offices. HSE acknowledges the requirement by the CSO to continue to receive these files and undertakes to provide these data at the required frequency. HSE and the CSO agree that this list of data files shall be periodically reviewed, and amendments thereto shall be made with the consent of the Liaison Officers (see Paragraph 12 below).
2. The CSO shall use the data provided by HSE for statistical purposes only, in accordance with the Statistics Act, 1993, EU statistical law, Data Protection Law, EU law in accordance with the CSO’s Code of Practice.
3. The CSO shall ensure that all linking of HSE data with other data sources, both CSO and non-CSO, will be carried out in accordance with the CSO Data Protocol.
4. HSE acknowledges a stakeholder role for the CSO in those HSE data holdings required as inputs into statistical processing. At the same time, the CSO acknowledges that the primary purpose of HSE data is the delivery of a high-quality health service to ensure a healthy Ireland.
5. Should HSE propose to make significant changes to any system for the storage and retrieval of information or to make a statistical survey that could affect the CSO’s ability to carry out its mandate it shall consult with the CSO as required under section 31 of the Statistics Act 1993.
6. As part of its mandate, the CSO serves the specialist needs of the research and academic community. Research Microdata Files (RMFs) access via the Research Data Governance Board (RDGB) process are the means through which the CSO grants access to pseudonymised data for the purposes of statistical analysis to support health research. RMFs are made available to persons authorised to access such files under section 20, the Statistics Act, 1993 and for health research purposes in compliance with the Health Research Regulation 2018. This access is strictly governed by internal CSO protocols and in certain circumstances other governance structures such as the Health Research Consent Declaration Committee (HRCDC).
7. Subject to resource availability in the respective Offices, HSE and the CSO will work collaboratively to ensure that access to microdata through the strictly controlled RDGB process is maximised. This approach supports the integrity and confidentiality of HSE data provided to the CSO under the Statistics Act. It also enhances opportunities to maximise the value and utility of data to support evidence-based policy making, reduce the cost of research and avoid duplicate data collections.
8. The parties will observe and give due respect to the agreed provisions of this MoU. This MOU does not give rise to legally binding or enforceable obligations on the part of either party save for the provisions in respect of data protection and confidentiality in Paragraphs 22 to 34 inclusive, which are legally binding and the parties agree to be bound by them.

HSE / CSO Liaison Group

9. The HSE / CSO Liaison Group shall be the formal, high-level mechanism for consultation and communication between both Offices.
10. The Terms of Reference (ToR) for the Liaison Group will be agreed between the HSE and CSO. The ToR will cover, amongst other things, membership of the Liaison Group, frequency of meetings and scope of the Liaison Group. Changes to the ToR must be jointly agreed by both parties.
11. It shall be the responsibility of the Liaison Group to consider all data matters and related issues of mutual interest.
12. The Liaison Group shall make recommendations to the HSE CEO and CSO DG on the sign-off authority on transfers of data between the two Organisations. The two Offices shall maintain a delivery schedule of data files currently provided by HSE to the CSO. The data files in the delivery schedule and any amendments to that list are being requested by the CSO under Section 30 of the Statistics Act 1993. Where necessary, the written permission of the Minister of Health shall be obtained. This MoU serves as a notice request for the purposes of that section of the Act. Changes to this list, and the composition of the data files thereon, shall be agreed between the HSE Liaison Officer and the CSO Liaison Officer referred to in Paragraph 18 here under, subject to the approval of the Liaison Group.
13. HSE shall inform the CSO as early as possible of any proposed changes including legislative changes in availability/scope of HSE data which could potentially impact on the CSO in carrying out its mandate. Any proposed changes shall be discussed by the Liaison Group.
14. The Liaison Group shall address matters of data protection, in accordance with the Statistics Act, health sector specific legislation and the relevant data protection legislation and health research regulations. The liaison group will be supported in these activities by its respective Governance teams.
15. The Liaison group will regularly review the security of data transfer between both Organisations and the related storage mechanisms. Responsibility for approving data transfer mechanisms between both Organisations shall rest with the Liaison Group.
16. The Liaison Group shall appoint, as required, ad hoc working groups to progress issues arising; such working groups shall report to the Liaison Group.
17. The Liaison Group shall meet on at least two occasions each year and shall be chaired alternately by HSE and the CSO at Assistant Secretary/National Director level.
18. In the event of a dispute arising under this MoU, the Liaison Group will meet and use all reasonable endeavours to resolve the dispute.

Liaison Officers

19. The CSO shall appoint a Liaison Officer as the main point of contact with HSE; this role shall encompass a Data Custodian function, with responsibility for the management and use of HSE data by the CSO. HSE shall likewise appoint a Liaison Officer as the main point of contact with the CSO.
20. All current data transfers between the two Organisations are considered authorised by the HSE / CSO Liaison Officers and approved by the Liaison Group and shall continue to take place between the relevant areas of HSE and the CSO Liaison officer (or delegated official by the CSO Liaison officer).
21. All new requests for data transfer and amendments to existing data transfers between the two Organisations shall be submitted through, and considered by, the Liaison Officers. Any changes reviewed by the Liaison Officers and proposed to the DAIM for approval shall take into account the relevant resource implications and shall be subject to the approval of the Liaison Group. When authorised by the DAIM on behalf of the HSE, the data transfer shall take place between the relevant area of HSE and the CSO Liaison Officer or a nominated deputy of the CSO Liaison Officer. The delivery schedule of data files provided to the CSO shall be updated by the Liaison Officers.

Data Protection & IT Security

22. The CSO shall ensure that any personal data or documents containing personal data requested shall be adequate, relevant and limited to what is necessary to meet its statutory statistical objectives.
23. The data controller for personal data at first instance is the HSE. When the data is transferred to the CSO, the CSO becomes the data controller. Each party is responsible for complying with their obligations as data controllers under the data protection legislation. It follows then that the CSO shall be responsible to report any data breaches relating to the data, once it is in their possession.
24. In the event of a breach relating to any personal data shared under this MoU the CSO shall inform the Data Protection Officer of the HSE and also shall inform the HSE of the breach through the Liaison Group. This notification shall be made within 24 hours. In addition, the CSO shall refer to their own data breach procedures and shall report the breach to the Data Protection Commission as appropriate. The HSE shall not be held responsible for any loss, damage or injury caused as a result of such a breach.
25. In the event of a breach relating to any personal data shared under this MoU the CSO shall inform the HSE through the Liaison Group, in advance, of any decision to issue a public statement in relation to the breach. Similarly, the HSE shall inform the CSO through the Liaison Group, in advance, of any decision to issue a public statement in relation to the breach.
26. The CSO and HSE shall maintain the appropriate infrastructure to ensure the secure transfer of data between the two Organisations. In particular, data will first be encrypted before being uploaded to a password-protected Secure File Transfer Protocol (SFTP) server maintained by the CSO.
27. The transfer and processing of the data is covered by, inter alia, the following provisions:

• Section 13 of the Statistics Act, 1993, concerning the statistical independence of the Director General of the CSO;
• Sections 30 and 31 of the Statistics Act, 1993, concerning the statistical independence of the Director General of the CSO;
• Sections 32 and 33 of the Statistics Act, 1993, concerning the protection of information;
• Section 24(2) of the Statistics Act, 1993 (as amended by Section 178 of the Data Protection Act), concerning the provision of information to the CSO;
• Article 6(1)(c) of the General Data Protection Regulation;
• Article 9(2)(i) of the General Data Protection Regulation;
• Article 9(2)(j) of the General Data Protection Regulation;
• Article 89 of the General Data Protection Regulation;
• Section 38(1)(a) of the Data Protection Act 2018;
• Section 42(1)(c) of the Data Protection Act 2018;
• Section 53 of the Data Protection Act 2018;
• Section 54(c) of the Data Protection Act 2018

Any processing of data, in particular medical records, pursuant to Section 30 of the Statistics Act, 1993 must comply with the formalities of that provision. In particular, the request for access to HSE data must come from the Director General of the CSO and fall within the existing Ministerial agreement to access medical records for one of the following purposes:

(i)   The purpose of assisting the CSO in the exercise of its functions in general as set out under Section 10(1) of the Statistics Act, 1993, or

(ii)   The purpose of supporting the analysis of Covid-19 related issues.

Where the CSO require access to HSE data containing medical records not falling within the current agreement of the Minister for Health, the CSO shall seek agreement of the Minister pursuant to Section 30(2) (b) of the Statistics Act, 1993 prior to requesting access to the records from the HSE.

Personal data containing medical records shared under the MoU must only be processed pursuant to Section 30 of the Statistics Act, 1993. Personal data containing medical records must not be used for any other reason(s) without the written agreement of the Minister for Health, unless an exemption applies within the data protection legislation or the data is required to be provided under the terms of any enactment, rule of law or by order of a court.

28. The CSO undertakes that all data received from HSE shall be treated as strictly confidential, shall be used for statistical purposes only, in accordance with national and EU statistical law, and relevant data protection and health research legislation. In particular, treatment of data shall be subject to the CSO’s Code of Practice on Statistical Confidentiality (as per attached Appendix 1). There is an obligation on the CSO to notify the HSE of any material changes to the Code.
29. The CSO shall maintain the appropriate infrastructure to ensure the secure storage of, and controlled access to, all data received from HSE.
30. HSE shall maintain the appropriate infrastructure to ensure the secure storage of, and controlled access to, all data required by the CSO.
31. Each party shall ensure that (where applicable), they update their individual Privacy Notice / Privacy Statement to take into account the sharing of any Personal Data and Special Categories of Personal Data under this Agreement.
32. The parties each agree to provide such assistance as is reasonably required to enable the other Party to comply with requests from data subjects to exercise their rights under, within the time limits imposed by, Data Protection Law.
33. Each party will inform the other party as soon as possible of any requests from data subjects regarding rectification or erasure of the personal data, or restriction of or objection to the processing of the personal data the subject of this MoU. Each party shall, to the extent that such a request affects the processing of such personal data, provide reasonable assistance to the other party to enable compliance with Data Protection Law. Notwithstanding the foregoing, each party shall remain responsible itself for dealing with requests from data subjects in respect of the personal data the subject of this MoU, to the extent that such requests are directed by the data subject to it (or any of its agents, employees or sub-contractors).
34. All data shared under this MoU shall be retained in accordance with that party’s respective data retention policy.

Statistical quality

35. Data files shall be accompanied by the relevant metadata, where available.
36. HSE and the CSO agree to cooperate in examining the quality and appropriateness of HSE data for statistical purposes. Recommendations towards improvement in the statistical quality of HSE data will be considered by the Liaison Group and implemented where feasible.

HSE requirements

37. The CSO acknowledges that HSE and the broader Health Sector has statistical requirements, and agrees, where feasible and in line with the Statistics Act, 1993, to try to meet these requirements by providing statistical analyses of CSO data and other administrative data holdings in the form of non-confidential, aggregate-level data.

Review

38. The MoU will be reviewed biennially by the Liaison Group but may be reviewed at any time at the request of either party. Any changes to the MoU shall be effected only with the mutual agreement of HSE and the CSO. This MoU will continue in force until it is terminated by either party by giving to the other not less than six months prior notice in writing.

Communication

39. The approval of this MoU and its content and procedures shall be communicated within the CSO and HSE; such communication shall include publication on the respective websites.

Signatures

Signed: Jennifer Banim, Director General, Central Statistics Office, Skehard Road, Cork, T12 X00E.

Date:     07 September 2026. 

Signed: Anne O’Connor, Chief Executive Officer, Health Services Executive, Dr Steevens Hospital, Dublin 8, D08 W2A8.

Date:    02 October 2026.