What GDPR and the Health Research Regulations (HRRs) mean for Ireland: "explicit consent"-a legal analysis.
Common law
Consent declaration
Explicit consent
GDPR
Health research
Informed consent
Ireland
Irish health regulations
Research
Journal
Irish journal of medical science
ISSN: 1863-4362
Titre abrégé: Ir J Med Sci
Pays: Ireland
ID NLM: 7806864
Informations de publication
Date de publication:
May 2021
May 2021
Historique:
received:
15
07
2020
accepted:
23
07
2020
pubmed:
31
7
2020
medline:
1
5
2021
entrez:
31
7
2020
Statut:
ppublish
Résumé
Irish Health Research Regulations (HRRs) were introduced following the commencement of the General Data Protection Regulation (GDPR) in 2018. The HRRs set out supplementary regulatory requirements for research. A legal analysis presented under the auspices of the Irish Academy of Medical Sciences (IAMS) on April 8 and November 25, 2019 at the Royal College of Surgeons in Ireland welcomed the introduction of GDPR and the HRRs. The analysis found the GDPR "explicit consent" introduced by the HRRs is problematic. A call was made to regulate informed consent in line with the common law as an achievable alternative safeguard, bringing Ireland in line with other EU Member States. This article aims to review academic papers, legal opinion, EU opinion and advice and data protection law in relation to research and explicit consent, in order to examine the legal burden of GDPR and the HRRs on health research in Ireland and to determine whether the analysis presented at the IAMS meetings is reflected more widely in legal text. Legal literature review of academic papers, legal opinion, EU opinion and advice and data protection legislation. The legal literature review overwhelmingly supports the concerns raised. Our results confirm the GDPR explicit consent requirement of the HRRs is having had a significantly negative and far-reaching impact on the conduct of health research in Ireland. Urgent review of the HRRs and meaningful engagement between the health research community and legislators in healthcare is required.
Sections du résumé
BACKGROUND
BACKGROUND
Irish Health Research Regulations (HRRs) were introduced following the commencement of the General Data Protection Regulation (GDPR) in 2018. The HRRs set out supplementary regulatory requirements for research. A legal analysis presented under the auspices of the Irish Academy of Medical Sciences (IAMS) on April 8 and November 25, 2019 at the Royal College of Surgeons in Ireland welcomed the introduction of GDPR and the HRRs. The analysis found the GDPR "explicit consent" introduced by the HRRs is problematic. A call was made to regulate informed consent in line with the common law as an achievable alternative safeguard, bringing Ireland in line with other EU Member States.
AIMS
OBJECTIVE
This article aims to review academic papers, legal opinion, EU opinion and advice and data protection law in relation to research and explicit consent, in order to examine the legal burden of GDPR and the HRRs on health research in Ireland and to determine whether the analysis presented at the IAMS meetings is reflected more widely in legal text.
METHODS
METHODS
Legal literature review of academic papers, legal opinion, EU opinion and advice and data protection legislation.
RESULTS
RESULTS
The legal literature review overwhelmingly supports the concerns raised.
CONCLUSIONS
CONCLUSIONS
Our results confirm the GDPR explicit consent requirement of the HRRs is having had a significantly negative and far-reaching impact on the conduct of health research in Ireland. Urgent review of the HRRs and meaningful engagement between the health research community and legislators in healthcare is required.
Identifiants
pubmed: 32728835
doi: 10.1007/s11845-020-02331-2
pii: 10.1007/s11845-020-02331-2
pmc: PMC7391042
doi:
Types de publication
Journal Article
Langues
eng
Sous-ensembles de citation
IM
Pagination
515-521Références
The EU General Data Protection Regulation (GDPR) is the most important change in data privacy regulation in 20 years.eugdpr.org . EU: c2019 [cited 20 April 2020]. Available from: https://eugdpr.org/
General Data Protection Regulation (GDPR). Recitals. Key Issues. gdpr-info.eu. EU: c2019 [cited 20 April 2020]. Available from: https://gdpr-info.eu/
Clarke N, Vale G, Reeves EP, Kirwan M, Smith D, Farrell M, Hurl G, McElvaney NG (2019) GDPR: an impediment to research? Ir J Med Sci 188:1129–1135. https://doi.org/10.1007/s11845-019-01980-2
doi: 10.1007/s11845-019-01980-2
pubmed: 30734900
Data Protection Act (2018) (Section 36(2)) (Health Research) Regulations 2018. irishstatutebook.ie. Ireland:c2019 [cited 20 April 2020].Available from: http://www.irishstatutebook.ie/eli/2018/si/314/made/en/pdf
Health Research Consent Declaration Committee. Hrcdc.ie. Ireland: c2019 [cited 20 April 2020]. Available from: https://hrcdc.ie/
Health Research Board Decision Tree. hrb.ie. Ireland: c2019 [cited 20 April 2020]. Available from: https://www.hrb.ie/fileadmin/user_upload/Decision_Tree_30072018.pdf
Guidance notes to support and application to process or further process personal data for the purposes of health research commencing before 8 August 2018 (re-consenting). hrcdc.ie. Ireland. c2019 [cited 20 April 2020]. Available from: https://hrcdc.ie/wp-content/uploads/2018/12/HRCDC-Guidance_Re-consenting.pdf
Woods K (2015) Researchers: consent rules put future medical trials at risk. Sunday Business Post (Ireland). Sect. A:6 (col. 1)
Declaration of Helsinki, Article 40.3 Bunreacht Na hEireann, the common law, European Convention for the Protection of Human Rights and Fundamental Freedoms 1950, European Convention on Human Rights Act 2003, Various Data Protection Acts, HSE National Consent Policy (revised 2019), Guide to Professional Conduct and Ethics for Registered Medical Practitioners (Amended) 8
Health Service Executive (2019). National Quality Improvement Division. National Consent Policy – Quality Improvement Programmes. HSE. https://www.hse.ie/eng/about/who/qid/other-quality-improvement-programmes/consent/ . Accessed 20 Apr 2020
European Parliament and of the Council of 24 October 1995 (2018) Article 29 working party guidelines on consent under regulation 2016/679. European Commission. https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=623051 . Accessed 20 Apr 2020
European Data Protection Board. Opinion 3/2019 concerning the Questions and Answers on the interplay between the Clinical Trials Regulation (CTR) and the General Data Protection regulation (GDPR)(art. 70.1.b)). European Commission https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_opinionctrq_a_final_en.pdf . Accessed 20 Apr 2020
European Commission Directorate-General for Health and Food Safety. Question and Answers on the interplay between the Clinical Trials Regulation and the General Data Protection Regulation. European Commission. https://ec.europa.eu/health/sites/health/files/files/documents/qa_clinicaltrials_gdpr_en.pdf . Accessed 20 Apr 2020
European Data Protection Supervisor. A preliminary opinion on data protection and scientific research. European Commission. https://edps.europa.eu/sites/edp/files/publication/20-01-06_opinion_research_en.pdf . Accessed 20 Apr 2020
Fitzgerald McCann (2019) EDPB opinion raises questions over Irish Health Research Regulations. McCann Fitzgerald. https://www.mccannfitzgerald.com/knowledge/technology-and-innovation/edpb-opinion-raises-questions-over-irish-health-research-regulations . Accessed 20 Apr 2020
Donnelly M, McDonagh M (2019) Health research, consent and the GDPR exemption. Eur J Health Law 26(2):97–119. https://doi.org/10.1163/15718093-12262427
doi: 10.1163/15718093-12262427
pubmed: 31059476
Dove ES, Chen J (2019) Should consent for data processing be privileged in health research? A comparative legal analysis. Int Data Priv Law. https://doi.org/10.1093/idpl-ipz023
Wallace R, Greene E (2020) Survey of NCHDs in Ireland to assess their views and opinions in relation to participation in health research and the impact of new Irish data protection regulations. Ir J Med Sci 189:783–789. https://doi.org/10.1007/s11845-020-02185-8
doi: 10.1007/s11845-020-02185-8
pubmed: 32034653
Voigt P, von dem Bussche A The EU General data protection regulation. Springer
National Health Service. Health Research Authority. Consent in Research. https://www.hra.nhs.uk/planning-and-improving-research/policies-standards-legislation/data-protection-and-information-governance/gdpr-guidance/what-law-says/consent-research/ . Accessed 20 Apr 2020
National Health Services Act (2006) And The Health Service (Control of Patient Information) Regulations 2002; The Ethical Review of Research Involving Humans (SFS 2003: 460) Act
National Committee on Vital and Health Statistics, Subcommittee on Privacy and Confidentiality. Susan Ehringhaus’s testimony on behalf of the Association of American Medical Colleges. 2003 November 19
Deapen D (2006) Negative impact of HIPAA on population-based cancer registry research: a brief survey. Springfield: North American Association of Central Cancer Registries
Ness RB, Joint Policy Committee, Societies of Epidemiology FT (2007) Influence of the HIPAA privacy rule on Health Research. JAMA 298(18):2164–2170. https://doi.org/10.1001/jama.298.18.2164
doi: 10.1001/jama.298.18.2164
pubmed: 18000200
Nass SJ, Levit LA, Gostin LO, Editors; Committee on Health Research and the Privacy of Health Information: The HIPAA Privacy Rule; Institute of Medicine (2009) Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. In: National Academies Press. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research, Washington DC https://www.ncbi.nlm.nih.gov/books/NBK9573/ . Accessed 20 Apr 2020
Health Research Authority (2020) Guidance for using data in health research in the context of COVID-19 research. National Health Service. https://www.hra.nhs.uk/covid-19-research/guidance-using-patient-data/ . Accessed 20 Apr 2020
Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak. https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-032020-processing-data-concerning-health-purpose_en . Accessed 27 Apr 2020