This post exposes how Ireland has regulated the field of health research, and if the Irish model has leaned towards the right to data protection of participants, having this act a negative effect on Irish health research. In order to achieve this goal, the work is divided into four points.
1. WHICH IS THE IRISH LAW THAT IS APPLIED FOR THE PROCESSING OF HEALTH DATA FOR HEALTH RESEARCH?
The GDPR was created to harmonize the data protection law in Europe, but, in the field of scientific research, the European legislator abandoned this objective by introducing clauses that allow Member States to regulate the legal basis for the processing of health data for research purposes.
The particularity of the Irish regulations is that the Minister of Health, in exercise of the powers conferred by section 36.2 of the DPA, and having duly complied the points 5.b) and 6 of section 36 of the same regulation, created the Irish regulation for the processing of personal data for health research purposes “Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018”, commonly known as “HRR”, which entered into force on 8 August 2018. Therefore, Ireland has specific regulations in this field, differing, for example, from Spain, which has regulated this area in the Seventeenth Additional Provision of its Organic Law LOPDGDD, being this option really criticable.
2. EXPLICIT CONSENT: THE RULE
The HRR identifies in its Regulation 3.1.e) the explicit consent of the data subjet as the only legitimate basis for the processing of personal data for health research purposes. That is, in Ireland explicit consent is required as a requirement for primary and secondary research. Interestingly, for the purposes of the HRR, “explicit consent” is defined as consent obtained pursuant to article 4 of the GDPR. This is anomalous since article 4 of the GDPR establishes the definition of “ordinary” consent instead of the necessary explicit consent for the treatment of health of the article 9.2. a) of the GDPR.
The introduction of explicit consent as the only legal base for the processing of personal data for health research purposes alarmed the researchers, since they conceived it as a barrier or obstacle to the exercise of scientific research. The Irish position contrasts markedly with that taken in the UK. Thus, we see two neighboring jurisdictions, both from the common law tradition, with completely different approaches to the role of consent and the application of the research exemption. On the contrary, the importance of consent in health research has been defended, alleging that it empowers the data subject, generates trust in the data subject and makes society trust in health research.
3. EXCEPTION TO THE RULE
Notwithstanding the foregoing, the HRR introduced for the first time a lawful mechanism that allows, in exceptional circumstances, the processing of personal data for health research purposes without the explicit consent of the data subject, having to make an application to the Declaration of Consent Committee of Health Research (HRCDC), who must grant a declaration of consent that allows that treatment.
A data controller may request a statement from the Committee when the public interest in conducting health research significantly outweighs the public interest in obtaining the explicit consent of the data subject. Consequently, in order to limit the data subject’s consent, there must be a strong public interest. The declaration of consent is the first legal alternative to consent that exists in Ireland. The HRRs does not include other alternatives to explicit consent in health research.
To obtain such statement, the data controller must make an “application” based on the provisions of Regulation 5 of the HRR. Thus, the applicant must carry out a data protection impact assessment in accordance with article 35.1 of the GDPR; obtain ethical approval from the Research Ethics Committee and submit a written request to the HRCDC demonstrating that the public interest in conducting the health research significantly outweighs the public interest in requiring the explicit consent of the data subject.
Applications are evaluated by a minimum of seven members of the Committee, of which at least one will be the president or vice president. After analyzing the controller’s application, the Committee has six different options: to make a declaration of consent, to make a declaration of consent with conditions, to refuse to make a declaration of consent, revoke a declaration, request additional information, or consult with anyone you believe may assist in the deliberation.
Before granting a declaration, the HRCDC must consider that the requirements established in the HRR have been met and that the public interest in carrying out the research significantly outweighs the public interest in requiring the explicit consent of the data subject. The Committee may introduce certain conditions that it considers necessary to protect the interests of the data subject that may be affected by the declaration. In turn, the Committee may request additional information from the data controller. This information must be provided by the applicant within 15 business days of making the request or the request will be denied.
Where the Committee refuses to grant a declaration, attaches conditions to a declaration, or revokes a declaration for non-compliance with any condition, the applicant may appeal the decision to the Minister of Health, provided that they notify their intention to appeal within 30 working days. from receipt of the Committee’s decision. The Minister must establish an independent appeal panel within 40 working days so that the appeal can be heard. No member of the Health Research Consent Statement Committee will serve on the appeals panel.
4. BRIEF CONCLUSIONS
It is said that the procedures and requirements of the HRR are likely to quell the enthusiasm of even the most enthusiastic researcher. Although it is not a perfect system, it is necessary to underline that through the requirement of explicit consent introduced in the Irish regulation, it has been intended that the data subjects continue to have control over their health data, which will make society trust in health research.
It will be necessary to analyze if, in practice, these requirements have a negative impact on health research in Ireland, or if a balance is struck between research and the right to the protection of personal data. For that purpose, it will be necessary to analyze how the HRCDC interprets the public interest exception, and if all this will result in fewer research projects being submitted than in other countries with less restrictive regulations.