What has not existed in Irish law until the Health Research Regulations was any mechanism to cover the scenario where a health research project cannot obtain the consent of data subjects. Some Research Ethics Committees (RECs) may have believed that they had a power to give consent waivers. Those waivers had no legal standing. The amount of detail required in the Regulations to establish a lawful consent declaration process is a clear indication of just how rigorous the consent declaration process has to be to be lawful.
The new statutory mechanism covers a situation where the research is of high public importance and obtaining consent for the use of the information is not possible.
It is important to say that no one is being required to apply to the Committee. Any decision to apply to the Committee is for a data controller to make having carefully assessed whether or not they are likely to meet the criteria and conditions set out in the Regulations.
Moreover, the Committee is not there as an alternative to seeking consent. Quite the opposite, the Committee will need, as a starting point, tangible evidence to support a claim that obtaining consent is not possible. For that reason, the Committee should never be the first option. It is the last.
Further, the Committee is not intended to take over the functions of Research Ethics Committees. RECs play a separate, distinct and important role in the health research process.
While the Regulations are focussed on new research, the Committee can also consider applications in relation to research currently underway in two situations: (a) where explicit consent was obtained in line with the requirements of the EU Data Protection Directive and the Data Protection Acts 1988 & 2003 but where such explicit consent would fail the more rigorous test of the GDPR and (b) the more problematic ones where consent has not been obtained for such research or where there is no record of the consent obtained.
Decisions on who gets a consent declaration are not made by the Minister, the Department or the HRB –they are made solely by the independent Consent Declaration Committee with an appeal process to another equally independent panel (appointed by the Minister).
“While the Regulations are focussed on new research, the Committee can also consider applications in relation to research currently underway in two situations: (a) where explicit consent was obtained in line with the requirements of the EU Data Protection Directive and the Data Protection Acts 1988 2003 but where such explicit consent would fail the more rigorous test of the GDPR and (b) the more problematic oneswhere consent has not been obtained for such research or where there is no record of the consent obtained.”
It is, therefore, for applicants to make the case and satisfy the Committee: including, for example, demonstrating the reasonable efforts they made for re-consenting which will necessarily be considered on a case by case basis. The best guidance that be offered is to make as complete and convincing a case as possible.Read more
The HRB has developed the following decision tree to help researchers assess:
This decision tree also outlines a number of important preliminary steps that must be completed by researchers prior to the submission of any application to the Health Research Consent Declaration Committee.
However, we strongly recommend that you also contact your institution’s DPO in order to get specific advice.Download Form
Consent waivers do not have, and never had, any legal standing in the context of the previous Data Protection Directive nor in the context of GDPR and the new Health Research Regulations 2018.
The EU Council and EU Parliament signed off on the GDPR in April 2016 with a two year period before it became effective on 25 May 2018. That was the transition period for preparing for GDPR compliance.
During that period, health researchers should have made sure that the processing of personal data for health research that was ongoing after 25 May (whether it was commenced before or after that date) was in line with the GDPR.
In the context of the Health Research Regulations 2018, an additional transitional period (up to 30 April 2019) was incorporated to allow health research involving the use of personal data that was ongoing on 8 August 2018 become compliant with the requirements of GDPR and the new Regulations.
For current research, researchers must submit an application for consideration by the consent declaration to the Health Research Consent Declaration Committee no later than 30 April 2019 (refer to transitional arrangements).
Yes. A consent declaration refers only to the requirement to have obtained the suitable and specific measure of explicit consent (Regulation 3(1)(e)) from the data subject.
All of the other suitable and specific measures to safeguard the fundamental rights and freedoms of the data subject described in Regulation 3(1)(a)-(d) must be in place.