All content related to GDPR and health research was created in close collaboration with the Department of Health. The responsiblity for compliance with the GDPR, the Data Protection Acts and the Health Research Regulations 2018 lies solely with the data controller or joint-data controllers.
The HRB’s “Guidance for health researchers” aims to assist research organisations and researchers who are processing personal data for the purposes of health research understand and implement their data protection obligations under GDPR, the Data Protection Act 2018 and the new Health Research Regulations 2018.
While the HRB’s guidance has been prepared with the utmost care and aims to be as accurate as possible, it should be noted that this is not legal advice. The information provided here is strictly for guidance purposes only and the HRB is not liable for any erroneous, obsolete or incomplete information.
It should also be noted that these are new legal instruments, and therefore, in many instances, it is not possible to provide definitive guidance at this point in time.
The HRB is not in a position to provide project specific guidance or advice.
Individual researchers who are processing personal data for the purposes of health research should seek project specific advice from their organisations’ Data Protection Officer before relying upon any information provided.
In the event that a funded research project requires a consent declaration, but the consent declaration application is refused by the Health Research Consent Declaration Committee and the research work must stop, who is contractually liable for incurred costs?
Researchers and host institutions are reminded that the decision to grant or not grant a consent declaration by the Health Research Consent Declaration Committee should always be a position of last resort. There is a positive responsibility on host research institutions (and by extension on researchers) to ensure that all other avenues of compliance with the GDPR and the Health Research Regulations 2018 such as anonymisation, seeking explicit consent, data minimisation, data purging etc. are considered in detail before applying to seek a consent declaration from the Health Research Consent Declaration Committee.
Researchers are recommended to seek project specific advice in relation to data processing for health research purposes from their organisation’s DPO.
In general, the onus is on a host research institution solely to ensure that the research being conducted by its researchers is legal and is being conducted in a lawful manner.
In the case of the GDPR and the Health Research Regulations 2018, it is the sole responsibility of the data controller (or joint data controllers) to ensure that they are compliant with the regulations.
However, host research institutions should refer to individual research contracts in order to determine their contractual liabilities in specific circumstances.
HRB Terms and Conditions (October 2017 Edition) for Research Awards
In the case of the HRB, some relevant clauses in the HRB Terms and Conditions (October 2017 Edition) for Research Awards are as follows:
Warranties (Clause 6) and Termination (Clause 16)
In the case of the Health Research Board, research funding contracts are subject to the host research institution obtaining ‘all of the relevant permits, approvals, permissions or consents necessary for the carrying out of the funded research activities or any part of them’ (Clause 6.1.3 and Clause 16.2.10).
Responsibilities of the Host institution (Clause 7)
The Host Institution shall ‘comply with all relevant statutory requirements, regulatory requirements, regulations and bye-laws relating to the Grant and the Grant Funded Activities including without limitation all such relating to the employment, involvement or engagement of the members of the Team’ (Clause 7.2.12).
The Host Institution shall ‘take all necessary steps to ensure that the Principal Investigator and the members of the Team are aware that the contract under which they are employed or otherwise engaged is with the Host Institution and not with the HRB and indemnify the HRB against any claim by the Principal Investigator or the members of the Team that they are an employee of or have otherwise been engaged by the HRB’ (Clause 7.5.8).
Liabilities and indemnities (Clause 9)
Host research institutions should also refer to Clause 9 of the HRB Terms and Conditions (October 2017 Edition) for Research Awards explicitly warrants, inter alia, that the host institution is “wholly responsible for the conduct of the Grant Funded Activities and the HRB shall have no obligation, responsibility or any liability financial or otherwise of any kind to the Host Institution, the Principal Investigator or any member of the Team or any third party arising directly or indirectly from the Grant or the Grant Funded Activities or payment of the Grant or any part thereof or any representation or other act or omission connected with the Grant save and except the payment of the Grant in accordance with the terms and conditions of the Grant.”
Variations and No Cost Extensions
Clause 20.4 allows a host research institution to request the HRB to consider a variation of the funded grant. The Host Institution Variation Notice should contain full details of the proposed variation and reasons for the Variation which will be given reasonable consideration by the HRB. The HRB may also approve a no cost extension to extend the duration of the grant for up to 12 months (Clause 16.3) in order to obtain the required consents or otherwise comply with the requirements of GDPR and the Health Research Regulations 2018.
 Host research institutions should refer to the full HRB Terms and Conditions (October 2017 Edition) for Research Awards in order to determine all of their contractual obligations and liabilities.