In a 69-page report published today, legal experts recommend the government should adopt an overarching instrument that contains the blueprint for data processing for pandemics current and future, map how health data is shared between public bodies, and clarify if personal data on vaccination is being transferred to third countries and on what basis.

The report’s 13 recommendations also include a recommendation that policymakers make greater effort in discussing due diligence concerning the uptake of technologies for continued tele-working, both from a health and safety and cybersecurity perspective, and in promoting transparency, public consultation and engagement when developing projects that involve large-scale processing of personal data, such as the contact tracing app.

Maria Grazia Porcedda, assistant professor in Trinity’s School of Law, said: “Since the beginning of the pandemic policymakers have adopted several data-driven measures to contain the spread of Covid-19.

“With the exception of the Covid Tracker App, which received great publicity, other mandatory, and therefore commonplace data-driven measures such as the Covid-19 Contact Management Programme and the Vaccine Information System have largely gone under the radar, and consequently eschewed much public scrutiny.

“While we find that the rationale of most data-related decisions made during the Covid-19 pandemic in Ireland is fully justifiable, the delivery does not always appear to have been sound.

“A systematic reading of the applicable law in light of fundamental rights suggests that data-driven measures that process data without necessary safeguards could amount to undue restrictions and could be challenged on rule of law grounds.”

Róisín Costello, assistant professor at Dublin City University, added: “The ongoing public health context generated by Covid-19 has drawn particular attention to the issue of data sharing as both State departments as well as public bodies like the HSE seek to co-ordinate data collection and to map vectors for disease transmission and service need.

“In the context of the existing legal landscape, however, the extent to which data has been shared among public bodies, and which public bodies shared such data during the Covid-19 pandemic is difficult to gauge for those not actively involved in the system. We hope moving forwards that there will be far greater transparency in this regard.”