Health Research Regulations 2018 FAQ

The Health Research Regulations 2018 are formally called the Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018.

They were made by the Minister for Health under section 36 of the Data Protection Act 2018 and came into effect on 8 August 2018.

The Health Research Regulations 2018 govern the use of personal data for health research purposes. These important new regulations outline mandatory suitable and specific measures that ensure that health research in Ireland is conducted using best practice principles of information governance in line with new GDPR requirements.

The regulations protect the rights of participants while at the same time they promote and facilitate the conduct of high quality research in the public interest.

The regulations also introduce for the first time a lawful mechanism that allows the processing of personal data for health research purposes in exceptional circumstances without the explicit consent of the individual concerned.

The Health Research Regulations 2018 can be viewed in full here.

Close

A consent declaration is a declaration made by the Health Research Consent Declaration Committee that the explicit consent of the data subject is not required.

Close

Health research falls under scientific research in the GDPR where it is not defined.

Health research is defined for the purposes of the Health Research Regulations 2018 in Regulation 3(2). 

You can find more information on the definition of health research for the purposes of the Health Research Regulations 2018 here.

Close

Not yet.

The HRB and the Department of Health are currently in the process of establishing the Health Research Consent Declaration Committee and its secretariat. The secretariat will be responsible for putting in place an application process to enable researchers seek a consent declaration from the Health Research Consent Declaration Committee. This application process will be announced as soon as possible and by no later than 1st November 2018. 

In the meantime, the HRB strongly recommends that researchers evaluate carefully (in consultation with their host organisation’s Data Protection Officer) whether or not any processing of personal data that they have undertaken or which they are planning to undertake for the purposes of health research complies with all of the mandatory suitable and specific measures outlined in the Health Research Regulations 2018. 

Where the data processing does not have the required consent in place or where this consent cannot be obtained, and where the data involved cannot be fully anonymised, the researcher should consider whether or not s/he can apply to the Health Research Consent Declaration Committee to obtain a consent declaration. This is a declaration by the Committee that explicit consent from a data subject is not required by a controller.

For new research, a researcher may apply for a consent declaration if:

  • s/he believes that the public interest of the research outweighs to a significant degree the public interest in requiring the explicit consent of the individual whose data is being processed. 

For current research (transitional arrangements), a researcher may apply for a consent declaration if:

  • s/he believes that the public interest of the research outweighs to a significant degree the public interest in requiring the explicit consent of the individual whose data is being processed (Regulation 6(4)(a))

or

  • the researcher has previously obtained the explicit consent of the individual(s) to use his or her data for the purpose of the health research in accordance with previous EU Data Protection Directive (95/46/EC) and the previous Data Protection Acts 1988 and 2003 (Regulation 6(4)(b))
Close

We recommend speaking to your institutional DPO to determine if your project meets the standards required by current and/or previous data protection legislation.

Close

No. A consent waiver issued by a Research Ethics Committee under the HSE's National Consent Policy 2017 is not the same as a consent declaration granted under the Health Research Regulations 2018.

Consent waivers do not have, and never had, any legal standing in the context of the previous Data Protection Directive nor in the context of GDPR and the new Health Research Regulations 2018.

Close

Current research is any research that has commenced on or before the 7th of August 2018.

New research is any research that commenced on or after the 8th of August 2018. Please refer to the consent declaration decision tree.

A research project is deemed to have commenced on the day that the research receives ethical approval from a research ethics committee.

Close

The EU Council and EU Parliament signed off on the GDPR in April 2016 with a two year period before it became effective on 25 May 2018.  That was the transition period for preparing for GDPR compliance. 

During that period, health researchers should have made sure that the processing of personal data for health research that was ongoing after 25 May (whether it was commenced before or after that date) was in line with the GDPR.  

In the context of the Health Research Regulations 2018, an additional transitional period (up to 30 April 2019) was incorporated to allow health research involving the use of personal data that was ongoing on 8 August 2018 become compliant with the requirements of GDPR and the new Regulations. 

You can find more information on this transitional period here.

Close

For current research, researchers must submit an application for consideration by the consent declaration to the Health Research Consent Declaration Committee no later than 30 April 2019 (refer to transitional arrangements).

 

Close
  • Consult the HRB’s GDPR guidance for researchers.
  • Consult the HRB’s consent declaration decision tree.
  • Determine whether your research project is a new project or if it is current.
  • Undertake a data protection impact assessment.
  • Ensure you have research ethics approval.
  • Consider whether or not the personal data can be anonymised.
  • For current research, determine if you have consent and whether or not the consent meets the standard of the previous Data Protection Directive 95/46/EC.
    • If yes, make reasonable efforts to contact the data subject who previously provided consent for the health research for the purposes of reobtaining consent from that data subject.
    • If not, consider if the data can be anonymised. Alternatively, consider if you can make a case that the public interest in continuing to carry out the health research significantly outweighs the public interest in requiring the explicit consent of the data subject together with a statement setting out the reasons why it is not proposed to seek the consent of the data subject for the purposes of the health research.
  • For new research, consider if you can make a case that the public interest in carrying out the health research significantly outweighs the public interest in requiring the explicit consent of the data subject together with a statement setting out the reasons why it is not proposed to seek the consent of the data subject for the purposes of the health research.
Close

The HRB cannot advise researchers when the public interest in carrying out the health research significantly outweighs the public interest in requiring the explicit consent of the data subject. This will be the remit of the Health Research Consent Declaration Committee once in place.

Close

Yes. 

A consent declaration refers only to the requirement to have obtained the suitable and specific measure of explicit consent (Regulation 3(1)(e)) from the data subject.

All of the other suitable and specific measures to safeguard the fundamental rights and freedoms of the data subject described in Regulation 3(1)(a)-(d) must be in place. 

Close