Health Research Regulations 2018 FAQ

Disclaimer

All content related to GDPR and health research was created in close collaboration with the Department of Health. The responsiblity for compliance with the GDPR, the Data Protection Acts and the Health Research Regulations 2018 lies solely with the data controller or joint-data controllers.

The HRB’s “Guidance for health researchers” aims to assist research organisations and researchers who are processing personal data for the purposes of health research understand and implement their data protection obligations under GDPR, the Data Protection Act 2018 and the new Health Research Regulations 2018.

While the HRB’s guidance has been prepared with the utmost care and aims to be as accurate as possible, it should be noted that this is not legal advice.  The information provided here is strictly for guidance purposes only and the HRB is not liable for any erroneous, obsolete or incomplete information. 

It should also be noted that these are new legal instruments, and therefore, in many instances, it is not possible to provide definitive guidance at this point in time. 

The HRB is not in a position to provide project specific guidance or advice. 

Individual researchers who are processing personal data for the purposes of health research should seek project specific advice from their organisations’ Data Protection Officer before relying upon any information provided.

NEW 29/08/2018 Case Study 2

I have a group of young people who are part of an ongoing follow-up research study - this is now their 4th follow-up. Ethics permission and funding has been obtained for this study since 2017. The letters of invitation to participate in the research study were posted out prior to 25th May.

Can I issue reminders or continue to contact those who have not responded.


The following general points may be noted:

For the purposes of the Health Research Regulations 2018, health research will be considered to be already underway where it has been approved by a research ethics committee on or before 7 August 2018.  The reference date is the date of the letter from the REC granting ethical approval to the research project.

In the case of a current or ongoing health research project, there is transitional period (up until 30 April 2019) to allow data controllers ensure that any processing of personal data for health research purposes complies with the suitable and specific measures mandated by the Health Research Regulations 2018 including the requirement for explicit consent. 

Except where the deletion of the personal data within a particular timeframe is an express element of the consent given by a data subject, a data controller can continue to hold the personal data concerned as long as s/he is compliant with:

  • all the appropriate requirements of the GDPR,
  • the applicable provisions of the Data Protection Act 2018 and any other laws relevant to the processing of the personal data of minors, 
  • the suitable and specific measures required under the new Health Research Regulations 2018 including the requirement for the explicit consent of the individuals whose data are being processed,
  • established ethical considerations.

While not mandatory, it is in the interests of a data controller maintaining good relations with a data subject to explicitly say that there may be follow up contact with the data subject at some future date regarding further or alternative uses of their data. 

During the transitional period, the data controller has the opportunity to contact the individuals involved to obtain their GDPR required explicit consent and to ensure compliance with:  

  • all the appropriate requirements of the GDPR,
  • the applicable provisions of the Data Protection Act 2018 and any other laws relevant to the processing of the personal data of minors, 
  • the suitable and specific measures required under the new Health Research Regulations 2018 including the requirement for the explicit consent of the individuals whose data are being processed,
  • established ethical considerations.

Silence or no response from the data subject may not be construed as consenting to the data processing in the consent request (i.e. in this instance, participation in the new study). 

If a significant cohort of the individuals do not respond, then the data controller may consider whether the data processing in question meets the eligibility criteria to apply for a consent declaration from the Health Research Consent Declaration Committee under the transitional arrangements (Regulation 6).


Other important considerations:

Consent of young people under GDPR

“Young people” has no legal meaning under GDPR or the Health Research Regulations 2018. 

The critical distinction in GDPR is between adults (persons aged 18 and over) and minors (persons under the age of 18). 

Data controllers processing Article 9 type data in relation to minors – including for the purposes of health research - need to be especially aware of applicable ethical and legal considerations including, where relevant, capacity to consent issues.

Consideration should also be given to putting in place processes to seek the explicit consent a data subject that transitions from a minor to an adult, in order to continue using their personal data, if and when this becomes necessary.

Transparency

When personal data is being collected from data subjects for research, or any purpose, the data subjects must be provided with information in relation to the purpose of purposes for which the data is going to be used. 

It is recommended that, at all times, the data controller be as transparent as possible in respect of the information that they provide to the data subject when seeking their explicit consent to process personal data for health research purposes under GDPR, the Data Protection Act 2018 and the new Health Research Regulations 2018. 

In preparing this information, the data controller should refer to the HRB’s GDPR Guidance for Researchers and also to the Article 29 Working Group guidance documents on Consent and Transparency, which can be found in Information resources for health researchers