MOU - CSO and SUSI

Memorandum Of Understanding between the CSO and the Student Universal Support Ireland

This Memorandum of Understanding is made on the 23rd of August 2024 between The Central Statistics Office, Skehard Road, Cork, T12 X00E, (the CSO) and Student Universal Support Ireland, Shelbourne House, Shelbourne Road, Dublin 4, D04 H6F6, (SUSI).

List of abbreviations

Establishment of the Parties

The Central Statistics Office was established in 1949 and became a statutory body in 1994, under the Statistics Act, 1993.

Student Universal Support Ireland was established in 2012. SUSI is a business unit of City of Dublin ETB and administers funding in line with the legislation as set out in the Student Support Act 2011 and the annual Student Grant Scheme and Student Support Regulations. 

The Role of the Parties

The functions of the Central Statistics Office are set out in the Statistics Act, 1993. In particular Section 10 states that the functions of the Office are the collection, compilation, extraction and dissemination for statistical purposes of information relating to economic, social and general activities and conditions in the State. The Office has the authority to coordinate official statistics compiled by public authorities to ensure, in particular, adherence to statistical standards and the use of appropriate classifications and has the authority to assess the statistical potential of the records maintained by public authorities and to ensure that the potential is realised. Furthermore, the CSO has legal obligations regarding the development, production and dissemination of European statistics under Regulation (EC) No. 223/2009 of 11 March 2009.

Student Universal Support Ireland (SUSI) is Ireland’s national awarding authority for further and higher education grants. SUSI offers funding to eligible students in approved full-time courses at PLC, undergraduate and postgraduate levels in Ireland and in some cases, to students studying in the UK or EU. All types of students, from school leavers to mature students returning to education can apply for funding.

Context and Background

Data provided to the CSO under this agreement shall be treated as strictly confidential, and used solely for statistical purposes. This shall be done in accordance with the Statistics Act, 1993, in particular section 30 which deals with access to and use of the records of ublic Authorities for statistical purposes.

Purpose of the Memorandum of Understanding
The purpose of this MoU is to clarify the roles and responsibilities of, as well as the areas of cooperation between, CSO and SUSI with regard to SUSI sharing data with the CSO.

This agreement is a MoU and is not intended to create binding or legal obligations on either Party. The MoU is entered into on the understanding that it is subordinate to the relevant legislation governing each Party.

This MoU also sets out a shared understanding of the parties in relation to data protection issues that may arise and roles relating to the compilation, transfer and use of this data. The processing of personal data of data subjects is governed by the Statistics Act, 1993 and the Data Protection Acts 1988-2018 and the General Data Protection Regulation.

Responsibilities of each Party

The data controller for personal data is SUSI. When the data is transferred to the CSO, the CSO becomes the data controller. It follows then that it is the responsibility of the CSO to report any data breaches relating to the data, once it is in their possession.

In the event of a breach relating to data the CSO will inform the Data Protection Officer of SUSI and also inform SUSI of the breach through the JLG. This notification will be made within 24 hours. In addition, the CSO will refer to their own data breach procedures and may report the breach to the Data Protection Commission as appropriate. SUSI will not be held responsible for any loss, damage or injury caused as a result of such a breach.

In the event of a breach relating to data the CSO will inform SUSI through the JLG, in advance, of any decision to issue a public statement in relation to the breach. Similarly, SUSI will inform the CSO through the JLG, in advance, of any decision to issue a public statement in relation to the breach. SUSI will not provide additional data or operational support in respect of the notification of data subjects in the event of a breach relating to CSO data.

Legal Background

Transfer and processing of the data shall be done in accordance with the Statistics Act, 1993, the Data Protection Acts 1988 - 2018, the General Data Protection Regulation, EU law and in accordance with the CSO’s Code of Practice, in particular its protocol on data matching where one or more datasets originate from outside of the CSO. The transfer and processing of the data is covered by, inter alia, the following provisions: 

• Section 13 of the Statistics Act, 1993, concerning the statistical independence of the Director General of the CSO; 
• Sections 30 and 31 of the Statistics Act, 1993 concerning the use of the records of public authorities for statistical purposes; 
• Sections 32 and 33 of the Statistics Act, 1993, concerning the protection of information; 
• Section 24(2) of the Statistics Act, 1993 (as amended by Section 178 of the Data Protection Act), concerning the provision of information to the CSO; 
• Article 6(1)(c) of the General Data Protection Regulation; 
• Article 6(1)(e) of the General Data Protection Regulation; 
• Article 89 of the General Data Protection Regulation; 
• Section 42 of the Data Protection Act 2018; 
• Article (9)(2)(j) of the General Data Protection Regulation; 
• Section 54(c) of the Data Protection Act 2018. 

Data Transfer, Security and Data Storage

A delivery is scheduled to be received by the CSO in August of each year in relation to information currently collected by SUSI for operational purposes. The files will first be encrypted then loaded to a password-protected Secure File Transfer Protocol (SFTP) server maintained by the CSO. Data will be retained, securely stored and processed by the CSO in accordance with CSO and ADC Data Policies. SUSI will provide the CSO with the data in an agreed format. Information on data formats and delivery frequency shall be provided by SUSI in respect of the data files schedule. In accordance with CSO policies on the control of data the CSO will not copy this data onto removable media (including laptop computers) unless appropriate security provisions are in place (i.e., encryption and password access) and there is an agreed business need to do so, in which case the CSO will inform SUSI of such need via the JLG. 

Joint Liaison Group

A SUSI and CSO Joint Liaison Group (JLG) will be convened, in accordance with the CSO’s standard Data Governance Framework. The JLG will oversee the data sharing as agreed between the parties and summarised in this MoU. 

The Terms of Reference (ToR) for the JLG will be agreed between the Student Universal Support Ireland and Central Statistics Office. The ToR will cover, amongst other things, membership of the JLG, frequency of meetings and scope of the JLG. Changes to the ToR must be jointly agreed by both parties. 

Duration and Review of the Memorandum of Understanding

This MoU will be published on the CSO website (www.cso.ie) and the SUSI website.

This MoU will remain in force until a new one is entered into or either the CSO or SUSI revoke it. Depending on events, this MoU may be amended, subject to the mutual agreement of SUSI and CSO. 

This MoU will be reviewed biennially by the both SUSI and the CSO. Any changes to the MoU shall only be made with the mutual agreement of the SUSI and CSO.