Applying for a consent declaration during the transitional period

Health Research Regulations 2018, Regulation 6

If a researcher:

  • believes that the public interest in carrying out the health research significantly outweighs the public interest in requiring the explicit consent of the data subject whose personal data is being processed for the purposes of the research ( Regulation 6(4)(a))

or

  • has obtained the explicit consent of the individual(s) to use his or her data for the purpose of the health research in accordance with previous EU Data Protection Directive (95/46/EC) and the previous Data Protection Acts 1988 and 2003 ( Regulation 6(4)(b))

then the researcher may apply to the Health Research Consent Declaration Committee to make a declaration that the explicit consent of the data subject is not required.

    Applications for a consent declaration for current health research projects during this transitional period

    Where the application relates to the grounds specified in Regulation 6(4)(a) the application must:

    • demonstrate that the public interest in carrying out the health research significantly outweighs the public interest in requiring the explicit consent of the data subject

    and

    • provide a statement setting out the reasons why it is not proposed to seek the consent of the data subject for the purposes of the health research

    or

    Where the application relates to the grounds specified in Regulation 6(4)(b) the application must demonstrate that:

    • reasonable efforts were made to contact the individual(s) who previously provided consent for the health research in accordance with Directive 95/46/EC of the European Parliament and of the Council of 24 October 19952 and the Data Protection Acts 1988 and 2003 for the purposes of reobtaining their consent

    Prior to making an consent declaration application under the transitional arrangements, the researcher must have:

    Applications to obtain a consent declaration under the Regulation 6 transitional arrangements must provide the following written information:

    1. clearly identifying the valid and lawful basis for the processing of the personal data
    and  
      clearly identifying that the proposed data processing meets one of the conditions in GDPR's Article 9(2) for special category personal data
    2. clearly identifying the data controller and, where there are joint data controllers, the division of responsibilities between them
    3. that the health research requires that personal data of a type specified be obtained and processed rather than anonymised data
    4. that the personal data will not be processed in such a way that damage or distress is, or is likely to be, caused to the individual(s) concerned
    5. that the collection and use of the personal data will go no further than is necessary for the attainment of the research objective (data minimisation)
    6. that there will be no disclosure of the personal data unless that disclosure is required by law or the individual(s) has given his or her explicit consent to the disclosure
    7. that the suitable and specific measures referred to in Regulation 3(1)(b)(iv) to (vii), 3(1)(c)(iii) to (viii) and 3(1)(d) have been identified and will be put in place before the health research commences. These include:
      ensuring that the proposed data processing is only that which is necessary to achieve the objectives of the research
      ensuring that the proposed data processing does not and will not cause damage or distress to the individual(s) to whom the data relates
      measures that demonstrate compliance with the data minimisation principle in GDPR's Article 5(1)(c)
      appropriate governance structures in place
      appropriate processes and procedures in place
      appropriate transparency arrangements are in place
    8. that a data protection officer has been or will be appointed in relation to the health research before it commences
    9. that ethical approval from a research ethics committee has been received
    10. „a copy of the data privacy impact assessment (DPIA) with particular references to the possibility of data linkages and details of any consultations undertaken with potential Individual(s) (data subjects)
    11. demonstrating that the public interest in carrying out the health research significantly outweighs the public interest in requiring the explicit consent of the data subject together with a statement setting out the reasons why it is not proposed to seek the consent of the data subject for the purposes of the health research (for applications under Regulation 6(4)(a))
    or  
      demonstrating that the data controller has previously obtained consent from the data subject for the health research in accordance with Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 and the Data Protection Acts 1988 and 2003 and that reasonable efforts have been made to contact the data subject for the purposes of reobtaining explicit consent from that data subject in line with the GDPR requirements (for applications under Regulation 6(4)(b))

    Conditional

    If a consent declaration is made, it may be subject to any such conditions deemed necessary to protect the data privacy interests of data subjects involved.

    Where do I find "transitional arrangements" in Irish legislation?

    Health Research Regulations 2018, Regulation 6 applies to health research that is currently underway and that commenced on or before 7 August 2018

    Disclaimer

    This guidance has been prepared by the HRB to help researchers in the health domain comply with GDPR requirements.

    It is intended to be general guidance for educational and informational purposes only.

    It is not legal advice.