A memorandum of understanding (MOU) is an agreement between two parties that is not legally binding, but which outlines the responsibilities of each of the parties to the agreement.
Memorandum of Understanding (MoU) between the Office of the Ombudsman and the Health Information and Quality Authority
1. Background
1.1 The Office of the Ombudsman (OO), established under the Ombudsman Act 1980, as amended, and the Health Information and Quality Authority (HIQA) established under the Health Act 2007 as amended (“the Parties”), wish to establish a framework for cooperation and information sharing about those elements of health and social care services which fall within their respective remits, and to establish effective procedures for signposting members of the public to each other's services.
1.2 The OO examines and/or investigates complaints against certain public bodies, including all hospitals providing public health services as well as publicly provided social care services (including residential services for older persons and persons with disabilities) and private nursing homes whose residents are in receipt of state support or subvention. Bodies providing health or personal social services for or with the assistance of the HSE under Sections 38 and 39 of the Health Act 2004 are also subject to the Ombudsman's remit. The Ombudsman decides if complainants have been dealt with fairly and properly. He may recommend redress for complainants, if appropriate, and may make recommendations for systemic improvements arising from individual complaints and complaints generally.
1.3 HIQA is an independent statutory authority established to promote safety and quality in the provision of health and social care services for the benefit of the health and welfare of the public. HIQA’s mandate to date extends across a wide range of public, private and voluntary sector services. Reporting to the Minister for Health and engaging with the Minister for Children and Youth Affairs, HIQA has responsibility for setting standards for health and social services, regulating social care services (Office of the Chief Inspector within HIQA is responsible for registering and inspecting residential services for older people, people with a disability and children’s special care units), regulating health services (medical exposure to ionising radiation), monitoring health services and children’s social services, evaluating the clinical and costs effectiveness of health technologies, advising on the efficient and secure collection and sharing of health information and carrying out national services-user experience surveys in conjunction with the Department of Health and the HSE through the National Care Experience Programme.
1.4 In broad terms, the primary role of the OO is to examine individual complaints, provide individual redress where appropriate and use complaint outcomes to improve public administration. In the case of HIQA, the primary role is to drive high quality and safe care for people using health and social care services rather than the investigation of individual complaints.
2. Objectives
2.1 While operating separate and distinct mandates, the overall objectives of the Parties are to ensure that:
3. The Purpose of the Memorandum
3.1 Consistent with the overall objectives set out in the MOU, this agreement is designed to:
4. Areas of Cooperation
4.1 The following specific actions will be considered by the Parties:
In accordance with the attached Schedule (Operating Protocol for the Transfer of Relevant Complaints), where HIQA receives a complaint by phone or in person, from a service user, which is within HIQA’s remit and has already been dealt with by the relevant service provider and may be within the Ombudsman's remit, it will, provided consent from the service user has been received, transfer personal data in respect of relevant complaints, in accordance with the attached Schedule directly to the OO. Where consent is not provided, HIQA will provide full contact details for the OO to the service user so that a complaint can be made directly to the OO.
4.2 Where HIQA receives a complaint from a third party, on behalf of a service user, by telephone or in person, which is within HIQA’s remit and has already been dealt with by the relevant service provider and may be within the OO’s remit, it will, provided consent from the third party complainant has been received, transfer personal data in respect of relevant complaints, in accordance with the attached Schedule directly to the OO. No personal data in respect of the service user will be transferred to the OO if the complaint has been made by a third party on their behalf. Where consent is not provided, HIQA will provide full contact details for the OO to the third party complainant so that a complaint can be made directly to the OO.
4.3 Where HIQA receives a complaint by email or letter, HIQA will provide a written response to the complainant which will set out the option of referring a complaint to the OO, a brief note of the remit of the OO and the contact details for the OO.
4.4 HIQA may use any information received in furtherance of its own regulatory and monitoring functions.
4.5 If the OO receives information, including information/concerns arising from the consideration of complaints, that may be of relevance to HIQA, it will transfer this information to HIQA through the relevant contact persons identified in clause 9. The OO will also provide HIQA’s contact details to members of the public as and when appropriate.
4.6 This MOU will be published on each party’s website together with the respective roles of each party and how each party may be of service to prospective complainants.
4.7 Joint initiatives such as projects, research, presentations to public bodies, or investigations will be considered by the Parties.
5. Confidentiality
5.1 Before transferring any information or personal data, each party will satisfy itself that any such transfer is not in breach of its own legislative provisions regarding confidentiality and/or secrecy, or in breach of any other relevant statutory provisions, including the Data Protection Acts 1988 to 2018 and the General Data Protection Regulation 2016/679 (GDPR). Where information can usefully be anonymised before being transferred, each party will do that. Both Parties recognise the importance of protecting service users and thus want to facilitate effective and timely information exchange designed to secure this outcome where appropriate.
5.2 Each party will, to the greatest extent possible, respect the confidentiality and/or secrecy of information exchanged under this MOU.
5.3 No personal data, as defined in the GDPR and Data Protection legislation, will be shared by either party unless there is a lawful basis to do so under GDPR Article 6.
5.4 Both Parties have agreed to enter into a Data Sharing Agreement with each other which will be published on each party’s website.
6. Financial Arrangements
Each party will be solely responsible for the administration and expenditure of its own resources associated with activities conducted under this MOU.
7. Variation
Any provision of this MOU may be amended at any time by mutual consent in writing by each office via the respective signatories.
8. Effective Date and Review
8.1 This MOU will come into effect upon the date of signature of both signatories and will continue in effect until its termination in accordance with clause 11.
8.2 This MOU will be subject to a formal review every two years from the date of its signing or otherwise as requested by a party to this MOU. The content of the MOU will be reviewed to ensure that it remains relevant, fit for purpose and up to date.
8.3 This review, which should be conducted by both Parties, will be carried out by the person holding the position of Chief Executive Officer of HIQA and the person holding the position of the Ombudsman. Following the review, any required variations arising therefrom will be made in accordance with clause 7.
9. Contact Persons
9.1 The contact persons responsible for the operation of this MOU are:
9.2 Upon signing this MOU, each party will ensure that the identity and contact details (email and telephone number) of the persons referred to in clause 9.1 will be exchanged with the other party. In the event there is a change in the identity of a contact person referred to above during the term of this MOU. The relevant party will inform the other party of same and will forward the contact details of the replacement contact person.
10. Status of Memorandum of Understanding
This MOU reflects the intentions of each party to the MOU. The MOU is not intended to create legally binding obligations of any nature, save for the obligations to maintain the confidentiality of information set out in clause 5.
11. Termination
_________________ ______________________
Peter Tyndall Phelim Quinn
Ombudsman Chief Executive Officer
Health Information and Quality Authority
Date: 9 July 2019 Date: 9 July 2019
Schedule
Operating Protocol for the Transfer of Relevant Complaints
1. In cases where HIQA is in receipt of a complaint, by telephone or in person, which is within HIQA’s remit and which may be appropriate for examination by the OO (see section 1.2 of the MOU) and HIQA believes the complainant has exhausted the relevant service provider’s complaints mechanism, the following procedure will be followed:
2. HIQA, through its Information Handling Centre, shall seek the verbal consent of the complainant (in person or over the phone) to transfer the complaint to the OO.
3. If consent is given, HIQA will explain to the complainant that it is entirely a matter for OO to decide in any given case if it is proper for it to pursue the complaint with the body in question.
HIQA will transfer the following personal data in respect of relevant complaints to the OO:
4. On a monthly basis, the above complaints information will be compiled and sent electronically by the person holding the position of Higher Executive Officer in HIQA’s Information Handing Centre, to the OO contact person identified in clause 9 of the MOU.
5. In the event that there is no complaints information to be transferred to the OO in any given month, a NIL return will be made following the same steps as outlined in point 4 above.
6. The OO will be responsible for screening any potential complaints received from HIQA.
7. Following the normal OO screening process, the OO will inform HIQA (by emailing concerns@hiqa.ie) if an investigation is being carried out by the OO in respect of any designated centre or institution that may fall within HIQA’s remit. This information will then be escalated to the relevant case-holder within HIQA.
8. If an OO report is due to be published following such an investigation, a copy of this report should be provided to HIQA (by emailing concerns@hiqa.ie) in advance of its publication. This information will then be escalated to the relevant case-holder within HIQA.
Memorandum of Understanding (MoU) concerning co-operation in the public interest between the Office of the Ombudsman and the Medical Council
Published March 2017
1. Background
1.1 The Office of the Ombudsman, established under the Ombudsman Act 1980, as amended, and the Medical Council, established under the Medical Practitioners Act 1978 (repealed and replaced by the Medical Practitioners Act 2007), wish to establish a framework for cooperation and information sharing about those elements of health care services which fall within their respective remits, and to establish effective procedures for signposting members of the public to each other’s services.
1.2 The Office of the Ombudsman examines and/or investigates complaints against certain public service providers, including all public hospitals providing health services and public and private nursing homes. Bodies providing health services for or with the assistance of the HSE under Sections 38 and 39 of the Health Act 2004 are also subject to the Ombudsman's remit. The Ombudsman decides if complainants have been dealt with fairly and properly. He may recommend redress for complainants, if appropriate, and may make recommendations for systemic improvements arising from individual complaints and complaints generally. In examining complaints against the HSE or private nursing homes the Ombudsman is legally prevented from examining complaints which, in the opinion of the Ombudsman, relate to clinical judgement.
1.3 The principal functions of the Medical Council are to establish and maintain the register of medical practitioners; approve and review programmes of education and training necessary for the purposes of registration and continued registration; specify and review the standards required for the maintenance of the professional competence of registered medical practitioners; specify standards of practice for registered medical practitioners including providing guidance on all matters related to professional conduct and ethics; and conduct disciplinary procedures.
1.4 In broad terms the primary role of the Office of the Ombudsman is to examine individual complaints, provide individual redress where appropriate and use complaint outcomes to improve public administration. In the case of the Medical Council, the primary role is to promote and ensure high standards of professional conduct and professional education, training and competence amongst registered medical practitioners.
1.5 While operating separate and distinct mandates, the two offices act in the public interest to ensure that -
2. The Purpose of the Memorandum
Consistent with the overall objectives set out in this MoU, this agreement is designed:
a) to promote cooperation between the two offices in areas of strategic and high level operational interest
b) to facilitate co-operation on cross referral of concerns where one organisation believes it falls within the remit of the other;
c) to collaborate on communication and information sharing activities
This MOU represents the understanding reached by the Medical Council and the Office of the Ombudsman, in particular:
3. Areas of Co-Operation
Consistent with the overall objectives and purpose of the MoU, the following specific actions will be undertaken/considered by the two offices:
A. Where the Medical Council is informed of a complaint which has already been dealt with at local level and may be more appropriate to the Office of the Ombudsman, it will, where possible, further to the determination of the matter by the Preliminary Proceedings Committee (PPC) direct the complainant directly to the Office of the Ombudsman.
B. If, during the course of an examination or investigation of a complaint, the Office of the Ombudsman receives information that may be of relevance to the Medical Council, it will transfer the complaint (or elements of the complaint, where applicable) to the Medical Council with the consent of the complainant, where applicable. Where consent is not provided, the Office of the Ombudsman will provide, to the complainant, full contact details for the Medical Council.
C. The content of each office's website dealing with the respective roles of each office and how each office may be of service to prospective complainants/ service users / members of the public will be agreed and links will be provided to facilitate members of the public;
D. The wording to be used when signposting individuals who contact either office and who may more appropriately, at a later stage, have their concerns/complaints dealt with by the other office will be agreed;
E. Joint training initiatives for staff of each office may be considered;
F. Joint initiatives such as projects, research and presentations to relevant bodies on improving the quality and safety of patient care may be considered;
G. Formal arrangements may be put in place, where practicable, for the sharing of investigation reports, complaint data and statistical information or other relevant information produced by each office in the interests of improving patient safety.
4. Confidentiality
4.1 Nothing in this MoU requires either party to this agreement to release confidential information to the Office of the Ombudsman except in accordance with law.
4.2 Unless otherwise required by law, the parties will not disclose any information received from the other under this MoU, except with the written consent of the other party. If disclosure is required by law, each party will take all reasonable measures to ensure that the information received from the other will be disclosed in a manner that protects the information from any disclosure that is not required or authorised by law.
4.3 Unless otherwise required by law, neither party will use the information disclosed to it under this MoU for any other purpose than the performance of its regulatory activities/statutory functions.
4.4 Before transferring any information, each office will satisfy itself that any such transfer is not in breach of its own legislative provisions regarding confidentiality and/or secrecy, or in breach of any other relevant statutory provisions. Both offices shall also have regard to protecting the source of the information (as may be necessary) and the best interests of public health and patient safety.
4.5 Each office will respect the confidentiality and/or secrecy of information exchanged under this MoU and which has been obtained under the statutory powers of the other office.
5. Consultation and Liaison between the Offices
5.1 Senior officials from the two Offices shall meet at least once annually to discuss issues arising from the operation of this MoU.
5.2 Officials from the two Offices will meet from time to time, possibly twice yearly or as necessary at the request of either office, to discuss trends, individual case-related or other operational matters.
5.3 Each Office will nominate two liaison persons at an appropriate grade in their respective Offices to operate and monitor the cooperative arrangements entered into under the MoU.
5.4 The Office of the Ombudsman will inform the Medical Council of any concerns arising from the consideration of complaints which may need to be taken into account in any future activity of the Medical Council.
6. Financial Arrangements
Each Participant/Party will be solely responsible for the administration and expenditure of its own resources associated with activities conducted under this MoU.
7. Variation
Any provision of this MoU may be amended at any time by the mutual consent in writing of the Participants via the respective signatories.
8. Operative Date and Review
8.1 The provisions of this MoU will take effect from the date of signing.
8.2 The MoU will be reviewed by the two offices after 12 months or otherwise as requested by the Ombudsman or the Chief Executive.
9. Agency Contact
The liaison officers responsible for the administration of this MoU are:
9.1 for the Medical Council, the persons holding the position of Chief Executive and Director of Regulation.
9.2 for the Office of the Ombudsman, the Ombudsman will nominate two liaison persons of at least investigator level.
10. Termination
10.1. Either Participant may, at any time, give written notice of termination to the other Participant. This MoU (excepting clause 4 Re Confidentiality) will terminate six months after the date of receipt of the notice of termination.
10.2 The termination of this MOU will not affect the confidentiality undertakings expressed by the Participants in this MoU and any commitments given under or as a consequence of this MOU in respect of any arrangement or action taken during the period before the termination takes effect.
Signed
Peter Tyndall
Ombudsman
Bill Prasifka
Chief Executive / Registrar
Professor Freddie Wood
President
Memorandum of Understanding (MoU) between the Office of the Ombudsman and the Ombudsman for Children
1. Background
1.1 The parties to this MoU are:
1.2 The OO operating under the Act of 1980, investigates complaints against certain public bodies. The OCO, operating under the Act of 2002, investigates complaints against certain public bodies including schools and voluntary hospitals.
1.3 Under the Act of 1980 and the Act of 2002, investigations arise where the action complained of "has or may have adversely affected" a person. In the case of the OCO, the person adversely affected must be a child; in the case of the OO, the person adversely affected is a "person" in the wider sense of any natural person or any corporate entity. However, the Act of 2002 amends the Act of 1980 to provide that the OO shall not investigate any action which is one to which section 8 of the Act of 2002 applies, that is, an action which has, or may have, adversely affected a child. It is clear that the intention of the Oireachtas is that where an action of a public body has, or may have, adversely affected a child then any investigation of that action will be a matter for the OCO rather than the OO.
1.4 There will be instances, however, in which an action of a public body has, or may have, adversely affected both a child and an adult. This MoU provides the basis for enhanced cooperation to address and deal with such instances appropriately. It builds on the engagements and consultations about complaints which have previously taken place between the two Offices on an informal basis. The two Ombudsmen have entered into this MoU in order to further their shared commitment to working together as effectively as possible in the public interest.
2. The Purpose of the Memorandum
2.1 This MoU is designed to promote inter agency consistency between the two Offices in examining and investigating complaints in respect of which either or both Offices have a jurisdiction. In order to minimise duplication of effort and assist speedy and efficient examination and investigation of complaints, under the MoU both Offices will:
3. Scope of the MoU
3.1 This MoU covers joint or linked jurisdictions related to the complaints investigation functions of the OO and the OCO where a decision will be needed on whether the alleged action taken in the performance of an administrative function should be examined /investigated under the Act of 1980 or under the Act of 2002.
3.2 The factors that the OO and OCO would expect to take into account in deciding which one of them will investigate the complaint will include:
3.3 The OO and OCO agree to continue, under this MoU, the current arrangement between the Offices that the OO may examine and investigate individual complaints relating to the payment of certain allowances and grants made to parents/guardians in respect of children, for example - statutory or discretionary payments of child benefit, domiciliary care allowance, exceptional needs payments under the supplementary welfare allowance scheme, payments under the back to school clothing and footwear scheme, carer's allowance/benefit, adoptive benefit, guardian's payment contributory, maternity benefit and health & safety Benefit.
3.4 Notwithstanding the general statutory jurisdiction of the OCO and in the interests of clarity the OO and OCO have previously agreed that among the schemes which are to be examined and investigated by the OCO are those which involve direct payment to children such as the following:
4. Consultation and Liaison between the Offices
4.1 The OO and OCO are committed to ensuring that any question about which Office has jurisdiction in a particular case shall be dealt with speedily, cooperatively and with the best interest of the complainant in mind.
4.2 Where either the OO and OCO receive a complaint which falls within the jurisdiction of the other Office to investigate, it shall, with the consent of the complainant, be re-directed to the appropriate office.
4.3 Where the OO and OCO, following consultation, determine that it is more appropriate for the other Office to proceed with an examination/ investigation of a complaint which falls within the jurisdiction of either of them to investigate then the referring Office shall seek the consent of the complainant to processing the complaint accordingly.
4.4 In exceptional cases where each Ombudsman finds it necessary to undertake an investigation arising from a particular aspect of one complaint, both Ombudsmen are committed to mutual cooperation to the extent that is possible within the governing ombudsman legislation. Where information or documentation may be shared between the Offices, for the purposes of examining or investigating such cases, the material involved shall be treated as confidential. In such instances, it shall be the practice of each Office to advise the public body or third party concerned of an intention to share information or documentation in this manner.
4.5 Each Office will respect the confidentiality and/or secrecy of information exchanged under this MoU and which has been obtained under the statutory powers of the other Office and which relates to any person contemplated within either the Act of 1980 or the Act of 2002. Each Office will comply with any non-disclosure obligations that are binding on the other and with due regard to the requirements of secrecy in the conduct of an investigation pursuant to Section 9 of the Act of 1980 and Section 16 of the Act of 2002 . Otherwise such material shall be treated as confidential.
4.6 A decision as to whether the OO or OCO should deal with a particular complaint would normally be taken soon after receipt of a complaint or after receipt of any further information that may be necessary to provide a clear understanding of the administrative action that is the subject of complaint. The OO and OCO will aim to be in a position to make decisions on jurisdiction within a period of 3 weeks from receipt of the complaint. In all instances, a letter of hand-over will issue between Offices to mark decisions involving the transfer of complaints documentation for processing purposes.
4.7 If, during the lifetime of this MoU, a decision of major significance is made in relation to which of the Offices will take responsibility for a particular class of cases (being a class of cases not already covered explicitly by this MoU) then the decision will be agreed in writing by the two Offices and an Appendix will be added to this MoU stating the precise nature of the decision and its implications.
4.8 Senior officials from the two Offices shall meet at least once annually to discuss issues of mutual concern.
4.9 Each Ombudsman will nominate two liaison persons, of at least Investigator level or equivalent, in their respective Offices to operate and monitor the cooperative arrangements entered into under the MoU.
5. Operative Date and Review
5.1 The provisions of this MoU will take effect from 5 September 2014.
5.2 The MoU will be reviewed by the two Ombudsmen after 12 months or otherwise as requested by either Ombudsman.
Peter Tyndall, Ombudsman
Emily Logan, Ombudsman for Children
Northern Ireland Public Services Ombudsman Marie Anderson and Irish Ombudsman Peter Tyndall have signed a Memorandum of Understanding to provide for ongoing co-operation on complaints about North-South Implementation Bodies.
The MoU will ensure that users of the services of these bodies, both north and south of the border, will be able to have complaints investigated efficiently by the appropriate independent Ombudsman.
Memorandum of Understanding (MoU) between the Office of the Ombudsman and the Office of the Planning Regulator
1. Background
The parties to this MoU are:
Summary of respective planning roles as they relate to this MoU:
2. The Purpose of the MoU
This MoU is designed to promote inter-agency consistency between the two Offices in examining complaints in respect of which either or both Offices may have a jurisdiction. In order to minimise duplication of effort and assist speedy and efficient examination of complaints, under this MoU both Offices will:
Consistent with the overall objectives and purpose of this MoU, the following specific actions will be considered and / or undertaken by the two Offices:
3. Determining the appropriate Office
Given the respective roles of the OO and the OPR, a decision will be needed on whether the alleged action taken in the performance of an administrative function should be examined under the Ombudsman Act 1980 as amended or under the Planning and Development Act 2000, as amended.
The factors that the OO and OPR would expect to take into account in deciding which one of them will examine the complaint will include:
4. Liaison arrangements
Before transferring any information, each Office will satisfy itself that any such transfer is not in breach of its own legislative provisions regarding confidentiality and / or secrecy, or in breach of any other relevant statutory provisions, including the Data Protection Acts 1988 to 2018. Both Offices recognise the prime importance of protecting service users and thus
want to facilitate effective and timely information exchange designed to secure this outcome. Accordingly, all such information transfers will be in accordance with the Data Sharing Agreement between the two Offices, which is at Appendix 2.
As such:
5. Operative Date and Review
The provisions of this MoU will take effect from the date of signing. The MoU will be reviewed by the two Offices after 12 months or otherwise as requested by the Ombudsman or the Planning Regulator.
______________ ________________
Niall Cussen,
Planning Regulator Ombudsman
Peter Tyndall,
Ombudsman
Date: 7 October 2019
Appendix 1
Practical Arrangements for Transfer of Potential Complaints from the OPR to the OO
1. Where the OPR is informed of a complaint or certain elements of the complaint, as appropriate, (either verbally or in writing) which has already been dealt with at local level and may be within the OO’s remit, it will transfer the complaint directly to the OO, with the consent of the complainant.
2. Where consent is not provided, the OPR will provide full contact details for the OO to the complainant. OPR staff will advise members of the public of their right to complain to the OO as and when appropriate. If the OO receives information that may be of relevance to the OPR, it will transfer this information to the OPR. The OO will also provide contact details for the OPR to members of the public, as and when appropriate.
3. A decision as to whether the OO or OPR should deal with a particular complaint would normally be taken soon after receipt of a complaint or after receipt of any further information that may be necessary to provide a clear understanding of the administrative action that is the subject of complaint.
4. The OO and the OPR will aim to be in a position to make decisions on jurisdiction within a period of 3 weeks from receipt of the complaint. In all instances, a letter/ email of hand-over will issue between Offices to mark decisions involving the transfer of complaints documentation for processing purposes.
Specifically the transfer procedure will be as follows:
5. The OPR shall seek the consent of the complainant (in writing or verbally as the case may be) to transfer the complaint to the OO.
6. If consent is forthcoming the OPR will explain to the complainant that it is entirely a matter for the OO to decide in any given case if it is proper for it to pursue the complaint with the LA in question.
7. The OPR will transfer any information it has received to the OO together with confirmation of consent and the full contact details for the complainant in the following format (or as close as is reasonably possible):
8. The OO will provide the direct contact details for two of its staff members to the OPR who will be designated to receive such material from the OPR on an on-going basis. These staff will arrange normal screening of any potential complaints.
9. Following the normal screening processes the OO will inform the OPR if the complaint is being pursued in whole or in part and if the complaint or elements of the complaint are not being pursued, the OPR will be informed as to the reasons.
10. Nothing in this arrangement shall prevent the OPR from using the complaint information in furtherance of its own regulatory role.
Appendix 2
and
DATA SHARING AGREEMENT
THIS AGREEMENT is made the 7th of October 2019
1. BETWEEN
2. DEFINITIONS
The following definitions apply in this Agreement:
“Agreement” shall mean this data sharing agreement, including these definitions and its recitals and schedules, which is a free standing document that does not incorporate commercial business terms established by the Parties under separate commercial agreements.
“Commencement Date” has the meaning given to it at the beginning of the Agreement
“Data” shall mean personal data as defined in the GDPR and the DPA
“Data Controller” shall have the meaning as defined in the GDPR and the DPA
“Data Processor” shall have the meaning as defined in the GDPR and the DPA
“DPA” or“Data Protection Act” means the Data Protection Acts 1988 to 2018
“Data Protection Authority” means the relevant data protection authority in the territories where the Parties to this Agreement are established (in Ireland this is the Data Protection Commission
“Data Security Breach” shall mean a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to shared personal data
“Data Subject” shall have the meaning as set out in the GDPR and the DPA
“Delete” shall mean to remove or obliterate Personal Data such that it cannot be recovered or reconstructed. “GDPR” General Data Protection Regulation (EU) 2016/679.
“Joint Controllers" shall have the meaning given to such term at Article 26 of the GDPR.
“Parties” shall mean the Office of the Ombudsman and OPR
“Processing” shall have the meaning given to such term in the GDPR and the DSA
“Privacy and Data Protection Requirements” means the Data Protection Acts 1988 to 2018, the EU Data Protection Directive 95/46/EC, the ePrivacy Regulations 2011 (SI336/2011), the ePrivacy Directive 2002/58/EC, the General Data Protection Regulation (EU) 2016/679 and all applicable laws and regulations relating to the processing of personal data and privacy, including where applicable the guidance and codes of practice issued by the Data Protection Commissioner
“Shared Personal Data” the Personal Data to be shared between the Parties under clause 4 of this Agreement.
“Subject Access Request” has the same meaning as “right of access to Personal Data” in Article 15 of the GDPR
“Technical and Organisational Measures” means those measures aimed at protecting personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access and against all other unlawful forms of processing (including, as appropriate, the measures referred to in Article 32(1) of the GDPR)
3. PURPOSE
This agreement sets out the framework for the sharing of data between the Parties as Data Controllers under the DPA, the GDPR and any guidance issued by the Data Protection Commission. It defines the principles and procedures that the Parties shall adhere to and the responsibilities the Parties owe each other.
4. SCOPE
4.1 In consideration of sharing data with each other, the Parties agree that they will comply fully with their obligations as Data Controllers under the DPA, the GDPR and any guidance issued by the Data Protection Commission.
4.2 The Parties agree to co-operate in respect of the sharing of data in compliance with their proposed respective statutory functions under the Planning and Development (Amendment) Act 2018 and the Ombudsman Act 1980 as amended.
4.3 The Parties consider this data sharing agreement necessary to facilitate the sharing of data and other information pursuant to the MOU 7th October 2019 entered into between the Parties. The MOU is designed to promote cooperation between the Parties in areas of strategic and high level operational interest that is to the benefit of service users and to ensure that relevant information which becomes available to
one party and which may assist the other party in the performance of its functions is shared between the Parties. One of the specific purposes of the MOU is to allow for the sharing of data in respect of relevant complaints, in areas which may be within the others remit, to the other party. This data will be shared on a consensual basis (as provided for by Article 6(a) of the GDPR).
4.4 The Parties agree that this data sharing agreement will serve to benefit the public interest by facilitating the sharing of data as set out in Section 4.3. and other information about elements of the Irish planning system which fall within the remits of the OPR and the Office of the Ombudsman.
4.5 The Parties agree to only share data for the purpose set out in Section 4.3.
4.6 The Shared Personal Data must not be irrelevant or excessive with regard to the purpose set out at 4.3.
4.7 The Parties shall ensure compliance with applicable national data protection laws at all times during the terms of the agreement.
4.8 The Parties shall ensure that this agreement remains fit for purpose, accurate and up to date and it will be reviewed as is required by the Parties. Such a review may be necessary to comply with the Parties obligations under Data Protection legislation. Any amendments to the agreement shall be signed by the Parties.
4.9 The Parties agree to comply with their responsibilities outlined in Schedule 1 of this Agreement with regard to the sharing of data. The Parties agree that Schedule 1 of this Agreement shall form part of this Agreement and shall have the effect as if it was set out in full in the body of this Agreement.
4.10 The Parties agree that all the required data transfers between the Parties will comply with the Parties’ policies and procedures for data transfer. Both Parties will install technical and organisational measures and shall be responsible for the secure and appropriate storage of all data records in their own computing infrastructures. In this regard, both Parties to the Agreement agree to comply with relevant requirements in relation to the processing, keeping, use and disclosure of data under the DPA and in particular to keep such information confidential and to take appropriate security measures against unauthorised access to, or unauthorised alteration, disclosure or destruction of data.
4.11 The Parties shall appoint a single point of contact (SPoC) who will work together to reach an agreement with regards to any issues arising from the data sharing and to actively improve the effectiveness of the data sharing agreement. The points of contact for each of the Parties are the person holding the position of Data Protection Officer in each organisation.
5. FAIR AND LAWFUL PROCESSING
5.1 The Parties shall ensure that they process the data fairly and lawfully in accordance with and during the term of the agreement.
5.2 The Parties will only request data that is adequate and not excessive to the purpose of the agreement as set out in Section 4.3.
5.3 Data will be retained by the Parties for no longer than is necessary for the purpose of this agreement as referred to in Section 4.3.
5.4 The Parties agree that they must confirm that any third party Data Processor is GDPR compliant.
5.5 The Parties agree to implement appropriate technical and organisational measures to protect against unauthorised access, accidental loss, destruction, damage, alteration or disclosure of data.
6. DATA QUALITY
6.1 Each party shall be responsible for the quality and accuracy of the data they share with the other party.
6.2 The Parties agree that any data discovered to be inaccurate or inadequate for the specified purpose as defined in Section 4.3 will be brought to the notice of the party that supplied the data. The party that supplied the data shall be responsible for correcting the data and notifying the other Party of the correction.
7. DESCRIPTION OF DATA TO BE TRANSFERRED
7.1 OPR agrees to supply the Office of the Ombudsman with the following data, which is provided on the basis of consent, in respect of relevant complaints:
7.2 The Parties also agree to share data where it is necessary for the performance of a task carried out in the public interest.
7.3 The Parties agree to share other information they deem relevant and necessary for the discharge of their statutory functions, in addition to the data specified in Section 7.1 of this agreement.
8. PROCEDURES FOR TRANSFER OF DATA
8.1 The Parties agree the following procedures for the transfer of data;
OPR will create an electronic data file containing the information as set out in section 7.1.
The data file will be transferred to the Office of the Ombudsman.
The data transfer will be implemented by means of an electronic file transfer protocol over a secure and robust connection.
Acknowledgement of receipt of the data file will be provided by the Office of the Ombudsman.
8.2 The Parties agree that all data transfers between the Parties will comply with the Parties’ policies and procedures for data transfer, and will ensure secure transfer of data between organisations. Both Parties will install technical and organisational measures and shall be responsible for the secure and appropriate storage of all data records in their own computing infrastructures.
8.3 All data transferred under this agreement will be used solely for the purpose and to the extent specified in this agreement.
9. RESTRICTION ON USE OF DATA
9.1 All data and other information shared by the Parties to this Agreement, must only be used for the reason(s) specified in the Agreement at the time of disclosure(s) and as set out in Section 4 of this Agreement. The data must not be used for any other purpose without the permission of the party who supplied the data, unless an exemption applies within the DPA, GDPR or the data is required to be provided under the terms of the Freedom of Information Acts 1997, 2003 & 2014 or under the instructions of a court of law.
10. LEGAL BASIS FOR DATA SHARING
10.1 All data shared under this Agreement is done so on the basis of data subject consent or where the sharing of data it is necessary for the performance of a task carried out in the public interest as permitted by GDPR Article 6(a) and 6(e).
10.2 The purpose of this processing is to enable the Parties to perform their functions under the following legislation:
The Planning and Development Act 2000, as amended
The Ombudsman Act 1980 as amended
11. DATA SECURITY BREACHES
11.1 The Parties shall have in place their own guidance and policy that must be followed in the event of a data security breach.
11.2 The Parties shall appoint a single point of contact (SPoC) for data security breach who shall;
1. maintain records in relation to data protection requests, decisions made and information exchanged
2. maintain records of any data breach
3. notify each other of the breach within 24 hours of its discovery
4. inform the Data Protection Commission within the relevant statutory timeframe when a breach has occurred
The single points of contact for each of the Parties are the persons holding the position of Data Protection Officer in each organisation.
11.3 The Parties agree to notify any potential or actual loss of data to each SPoC as soon as possible to enable the parties to consider what action is required to resolve the issue in accordance with the data protection laws and guidance.
11.4 The Parties agree to provide reasonable assistance as is necessary to each other to facilitate the handling of any data security breach in an expeditious and compliant manner.
12. DATA SUBJECTS’ RIGHTS
12.1 Data subjects who are European citizens (European Data Subjects) have the following rights under Data Protection Legislation:
12.1.2 right of access (Article 15 GDPR);
12.1.3 right to rectification (Article 16 GDPR);
12.1.4 right to erasure (Article 17 and 19 GDPR);
12.1.5 right to restriction of processing (Article 18 GDPR);
12.1.6 right to data portability (Article 20 GDPR); and
12.1.7 the right to complain to the relevant Data Protection Authority if the EU Data Subject believes that the Data Controller has not handled the EU Data Subject’s Personal Data in accordance with Data Protection Requirements.
12.2 The Parties agree to provide reasonable assistance as is necessary to each other to enable them to comply with a request for any of the actions listed in clause 12.1 and respond to any other queries or complaints from data subjects.
12.3 If one party to this Agreement receives a data subject access request, and the personal data is subsequently identified as having originated from the other party, it will be the responsibility of the receiving party to contact the party that supplied the data to determine whether the supplier wishes to claim an exception under the provisions of either the Data Protection Acts 1988 & 2003 or Freedom of Information Acts 1997, 2003 and 2014.
12.4 SPOCs are responsible for maintaining a record of individual requests for information, the decisions made and any information that was exchanged. Records must include copies of the request for information, details of the data accessed and shared and where relevant, notes of any meeting, correspondence or phone calls relating to the request. The Points of Contact for each Party are detailed in clause 4.11.
13. INDEMNITY
13.1 The Parties to this Agreement, agree to indemnify each other, against any action arising out of their failure to act within the terms of this Agreement, or in relation to wrongful or negligent disclosure of data generally relating to actions taken in the context of this Agreement.
14. RESOLUTION OF DISPUTES WITH DATA SUBJECTS OR THE DATA PROTECTION AUTHORITY
14.1 In the event of a dispute or claim brought by a Data Subject or a Data Protection Authority concerning the Processing of Shared Personal Data against either or both or all Parties (“a Claim”), the Parties will inform each other about any such disputes or claims.
14.2 The Parties agree the following:
14.2.1 assist in the investigation and defence of such Claim; and
14.2.2 take all reasonable steps to mitigate any loss or liability in respect of any such Claim.
14.3 Each Party shall abide by a decision of a competent court or of the Data Protection Commission which is final and against which no further appeal is possible.
15. GOVERNING LAW
15.1 This Agreement will be governed by and construed in accordance with the laws of Ireland, and the Parties submit to the exclusive jurisdiction of the Irish courts for all purposes Connected with this Agreement, including the enforcement of any award or judgement made under or in connection with it.
16. WARRANTIES AND UNDERTAKINGS
16.1 Each Party warrants and undertakes that it will:
16.1.1 Process the Shared Personal Data in compliance with all applicable laws, enactments, regulations, orders, standards and other similar instruments that apply to its Personal Data processing operations including Data Protection Requirements.
16.1.2 Notify promptly each other of any Data Subject Request.
16.1.3 Notify promptly each other of any Data Security Breach.
16.1.4 Assist the other party in complying with its obligations under Data Protection Requirements in relation to any Data Security Breach.
17. SEVERANCE AND UNENFORCEABILITY
17.1 If any provision, or part thereof, of this agreement shall be, or is found by any authority, administrative body or court of competent jurisdiction to be, invalid,
unenforceable or illegal, such invalidity, unenforceability or illegality shall not affect the other provisions, or parts thereof of this Agreement, and of which shall remain in full force and effect.
17.2 If any invalid, unenforceable or illegal provision, or part thereof, would be valid, enforceable or legal if some part were deleted, the provision, or part thereof, will apply with whatever modification is necessary to give effect to the intention of the Parties as appears from the terms of this agreement.
18. TERMINATION
18.1 This agreement shall remain in force from the commencement date unless it is superseded by the provisions of a further written agreement concluded between the Parties or is terminated by either party by notice in writing of one month to the other party.
18.2 Where this agreement is terminated by either party, the Parties shall ensure that any shared personal data is returned or destroyed in a secure manner.
19. CHANGES TO THE APPLICABLE LAW
In case the applicable data protection and ancillary laws change in a way that the Agreement is no longer adequate for the purpose of governing lawful data sharing exercises, the Parties agree that the SPOCs will negotiate in good faith to review the Agreement in light of the new legislation.
SCHEDULE 1
RESPONSIBILITIES OF PARTIES WHEN SHARING DATA
In consideration of the parties sharing data with each other, the Parties agree to:
1. The Parties shall request data that is adequate and not excessive to the purpose of this agreement as set out in Section 4.3.
2. The Parties shall ensure that they process the data fairly and lawfully in accordance with and during the term of the agreement.
3. The data will be retained by the parties for no longer than is necessary to in accordance with the discharge of their respective statutory functions.
4. The Parties agree to keep the data secure and confidential.
5. To ensure data is adequately safeguarded, the parties agree that any third party processing will be covered by contract appointing the third party as Data Processor and the contract will stipulate the following:
6. The Parties will ensure the security of all data stored on all fixed and mobile devices, including desktop computers, servers and mobile computer devices (i.e. laptops, notes, tablets, personal data assistants, Blackberry enabled devices, iPads, iPhones and other smart type devices etc.) and removal storage devices (i.e. CD, DVD, portable hard drives, USB memory keys, Diskettes, ZIP disks, Magnetic tapes etc.).
7. The Parties will ensure that non-electronic data is managed and stored securely.
8. The Parties agree to implement appropriate technical and organisational measures to protect against unauthorised access, accidental loss, destruction, damage, alteration or disclosure of personal data.
9. The Parties will ensure that all relevant staff are appropriately trained to handle and process shared personal data in accordance with the technical and organisational measures in their own computing infrastructures. The Parties shall ensure that all relevant staff are aware and act in compliance with the Agreement and this will be supported by the implementation of appropriate policies and procedures.
10. The Parties agree not to transfer data outside the European Economic Area (EEA) except with the prior written consent of the party who supplied the personal data.
11. The Parties will ensure that all data (irrespective of the format that the data is held, i.e. paper, electronic or otherwise) that is no longer necessary, is deleted and disposed of in a secure manner.
12. The Parties agree to comply with the provisions of Section 11 of this Agreement in the event of any accidental or unauthorised data security breach.
13. The Parties agree to comply with the provisions of Section 12 of this Agreement in the event of a data subject request.
14. Where this agreement is terminated by either party, the Parties shall ensure that that any shared personal data is returned or destroyed in a secure manner.