(1) The processing of personal data shall be lawful to the extent that such processing is necessary and proportionate for -
(a) the performance of a function of a controller conferred by or under an enactment or by the Constitution, or
(b) the administration by or on behalf of a controller of any non-statutory scheme, programme or funds where the legal basis for such administration is a function of a controller conferred by or under an enactment or by the Constitution.
(2) Subject to subsection (3), the processing of personal data and disclosure of that data to a person for the purposes of preserving the Common Travel Area, or any part of that Area, shall be lawful where the controller is an Irish air carrier, an air carrier or a sea carrier.
(3) The Minister shall, following consultation with such other Minister of the Government as he or she considers appropriate and the Commission, make regulations for the purposes of subsection (2) specifying -
(a) the part of the Common Travel Are
…