The CDC Process

What has not existed in Irish law until the Health Research Regulations was any mechanism to cover the scenario where a health research project cannot obtain the consent of data subjects. Some Research Ethics Committees (RECs) may have believed that they had a power to give consent waivers. Those waivers had no legal standing. The amount of detail required in the Regulations to establish a lawful consent declaration process is a clear indication of just how rigorous the consent declaration process has to be to be lawful.

The new statutory mechanism covers a situation where the research is of high public importance and obtaining consent for the use of the information is not possible.

It is important to say that no one is being required to apply to the Committee. Any decision to apply to the Committee is for a data controller to make having carefully assessed whether or not they are likely to meet the criteria and conditions set out in the Regulations.

Moreover, the Committee is not there as an alternative to seeking consent. Quite the opposite, the Committee will need, as a starting point, tangible evidence to support a claim that obtaining consent is not possible. For that reason, the Committee should never be the first option. It is the last.

Further, the Committee is not intended to take over the functions of Research Ethics Committees. RECs play a separate, distinct and important role in the health research process.

While the Regulations are focussed on new research, the Committee can also consider applications in relation to research currently underway in two situations: (a) where explicit consent was obtained in line with the requirements of the EU Data Protection Directive and the Data Protection Acts 1988 & 2003 but where such explicit consent would fail the more rigorous test of the GDPR and (b) the more problematic ones where consent has not been obtained for such research or where there is no record of the consent obtained.
Decisions on who gets a consent declaration are not made by the Minister, the Department or the HRB –they are made solely by the independent Consent Declaration Committee with an appeal process to another equally independent panel (appointed by the Minister).
“While the Regulations are focussed on new research, the Committee can also consider applications in relation to research currently underway in two situations: (a) where explicit consent was obtained in line with the requirements of the EU Data Protection Directive and the Data Protection Acts 1988 2003 but where such explicit consent would fail the more rigorous test of the GDPR and (b) the more problematic oneswhere consent has not been obtained for such research or where there is no record of the consent obtained.”

It is, therefore, for applicants to make the case and satisfy the Committee: including, for example, demonstrating the reasonable efforts they made for re-consenting which will necessarily be considered on a case by case basis. The best guidance that be offered is to make as complete and convincing a case as possible.

Read more

Decision Tree

The HRB has developed the following decision tree to help researchers assess:

  • Whether they might be eligible to submit an application to the Health Research Consent Declaration Committee to obtain a consent declaration, and
  • Whether such an application should be made under the transitional arrangements or as a new research project.

This decision tree also outlines a number of important preliminary steps that must be completed by researchers prior to the submission of any application to the Health Research Consent Declaration Committee.

However, we strongly recommend that you also contact your institution’s DPO in order to get specific advice.

Download Form

Frequently Asked Questions

What is a consent declaration?

consent declaration is a declaration made by the Health Research Consent Declaration Committee that the explicit consent of the data subject is not required.

Who grants a consent declaration?

The Health Research Consent Declaration Committee, once established, will have the authority to grant a consent declaration.

I have a consent waiver from my REC, is this the same as a consent declaration under the Health Research Regulations 2018?

No. A consent waiver issued by a Research Ethics Committee under the HSE’s National Consent Policy 2017 is not the same as a consent declaration granted under the Health Research Regulations 2018.

Consent waivers do not have, and never had, any legal standing in the context of the previous Data Protection Directive nor in the context of GDPR and the new Health Research Regulations 2018.

Is there a transitional period?

The EU Council and EU Parliament signed off on the GDPR in April 2016 with a two year period before it became effective on 25 May 2018.  That was the transition period for preparing for GDPR compliance.

During that period, health researchers should have made sure that the processing of personal data for health research that was ongoing after 25 May (whether it was commenced before or after that date) was in line with the GDPR.

In the context of the Health Research Regulations 2018, an additional transitional period (up to 30 April 2019) was incorporated to allow health research involving the use of personal data that was ongoing on 8 August 2018 become compliant with the requirements of GDPR and the new Regulations.

When is the deadline for submitting a consent declaration application for current research?

For current research, researchers must submit an application for consideration by the consent declaration to the Health Research Consent Declaration Committee no later than 30 April 2019 (refer to transitional arrangements).

What are the steps that need to be addressed before submitting an application for a consent declaration?
  • Consult the HRB’s GDPR guidance for researchers.
  • Consult the HRB’s consent declaration decision tree.
  • Determine whether your research project is a new project or if it is current.
  • Undertake a data protection impact assessment.
  • Ensure you have research ethics approval.
  • Consider whether or not the personal data can be anonymised.
  • For current research, determine if you have consent and whether or not the consent meets the standard of the previous Data Protection Directive 95/46/EC.
  • If yes, make reasonable efforts to contact the data subject who previously provided consent for the health research for the purposes of reobtaining consent from that data subject.
  • If not, consider if the data can be anonymised. Alternatively, consider if you can make a case that the public interest in continuing to carry out the health research significantly outweighs the public interest in requiring the explicit consent of the data subject together with a statement setting out the reasons why it is not proposed to seek the consent of the data subject for the purposes of the health research.
  • For new research, consider if you can make a case that the public interest in carrying out the health research significantly outweighs the public interest in requiring the explicit consent of the data subject together with a statement setting out the reasons why it is not proposed to seek the consent of the data subject for the purposes of the health research.
Do I have to have all of the other suitable and specific measures to safeguard to fundamental freedoms and rights of individuals in place if I have a consent declaration?

Yes. A consent declaration refers only to the requirement to have obtained the suitable and specific measure of explicit consent (Regulation 3(1)(e)) from the data subject.

All of the other suitable and specific measures to safeguard the fundamental rights and freedoms of the data subject described in Regulation 3(1)(a)-(d) must be in place.