Office of the Revenue Commissioners

Data Exchange Agreement between the Central Statistics Office and the Office of the Revenue Commissioners

Introduction

This document constitutes an agreement between Revenue and the Central Statistics Office (CSO).  The agreement is to transfer specified Revenue data to the CSO in accordance with the law and in a manner which satisfies Revenue information security and data protection standards. The requirement to share data arises from legislation referenced in the following section.

Legal Basis

Transfer and processing of the data shall be done in accordance with the Act, the Data Protection Act 2018, the GDPR, EU law and in accordance with the CSO’s Code of Practice, in particular its protocol on data matching where one or more datasets originate from outside of the CSO.

The transfer and processing of the data is covered by, inter alia, the following provisions:

• Section 10 of the Act, concerning the functions of the CSO;
• Section 13 of the Act, concerning the statistical independence of the Director General of the CSO;
• Sections 30 and 31 of the Act, concerning the use of the records of public authorities for statistical purposes;
• Sections 32 and 33 of the Act, concerning the protection of information;
• Section 851(A)(2) of the Taxes Consolidation Act, 1997, concerning Revenue’s disclosure of taxpayer information in accordance with statutory provisions;
• Article 6(1)(c) of the General Data Protection Regulation;
• Article 6(1)(e) of the GDPR concerning processing necessary for the exercise of official authority;
• Article 9(2)(j) of the GDPR, concerning processing necessary for statistical purposes;
• Article 89 of the GDPR concerning safeguards and derogations relating to processing for statistical purposes, and;
• Section 42 of the Data Protection Act, 2018, concerning processing for statistical purposes.

The details of the transfer (as well as the personal data covered) are specified in Annex A which forms an integral part of this Agreement.

Obligations of Revenue (the ‘Data Provider’)

The CSO warrants and undertakes that:

• It will have in place technical and organisational security measures to protect the personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, and which provides a level of security appropriate to the risk represented by the processing and the nature of the data to be protected;
• It will have in place procedures so that any third party it authorises to have access to the personal data, including processors, will respect and maintain the confidentiality and security of the personal data. Any person acting under the authority of the data recipient, including a processor, is obligated to process the personal data only on instructions from the data recipient.  This provision does not apply to persons authorised or required by law or regulation to have access to the personal data;
• It will process the personal data for purposes described in Annex A and has the legal authority to give the warranties and fulfil the undertakings set out in this Agreement;
• It will identify to the data provider a contact point within its organisation authorised to respond to enquiries concerning processing of the personal data and will cooperate in good faith with the data provider, the data subject and the DPC concerning all such enquiries without undue delay;
• It will process the personal data in accordance with national and EU data protection legislation.

Description of the Transfer

The details of the transfer and of the personal data are specified in Annex A. 

Variation of this Agreement

The Parties may modify this Agreement if required, provided they update the information in Annex A where required.

Responsibility for the data

The Parties agree that ownership of the data is transferred from the data provider to the data recipient when the data is successfully delivered under the Revenue File Transfer System and the associated notification email is acknowledged by the data recipient.  The data recipient is then considered to be the data controller of the information.

Termination

This Agreement will remain in force until a new one is entered into or until it is revoked.

Duration of the Agreement

This DEA will remain in force until a new one is entered into or until it is revoked.  Depending on events, this DEA may be amended, subject to the mutual agreement of the Parties.

This DEA will be reviewed biennially by the Parties.  Any changes to the DEA shall only be made with the mutual agreement of the Parties.