James Reilly (Dublin North, Fine Gael) | Oireachtas source

This group comprises amendments Nos. 3 and 4. The Bill provides that the individual health identifier and its related identifying particulars, called relevant information, can be used for relevant purposes, namely, primary and secondary purposes. The amendments relate to a better focusing of the secondary purposes in the Bill. Consequently, I will report on them together.

In the Bill as passed by the Seanad in February, one of the permitted secondary purposes as per paragraph (d) of the definition of secondary purposes is the carrying out of health research that is governed by an enactment or a European Act prescribed for the purposes of that paragraph. Consistent with the objective of focusing the use of the identifier and its data set, the intention had been that the provision would cover health research that had been the subject of research ethics approval under national or EU law, for example, clinical trials of medicinal products for human use. In addition, paragraph (d) was also intended to encompass other health research that would come through the voluntary but governed research ethics approval arrangements to be provided for in the forthcoming health information Bill. However, the legal view was that the wording was too broad to achieve the intended objective. Hence, amendment No. 3 provides an explicit reference to the carrying out of health research that is the subject of a research ethics approval, or any cognate expression, under an enactment or European Act where the Minister has prescribed that enactment or European Act for the purposes of paragraph (d).

This issue was the subject of some discussion in the Dáil, where concerns were raised that the inclusion of the reference to research in the definition of secondary purposes might somehow suggest that private bodies that carried out research, such as research institutes and pharmaceutical companies, would have access to a person's personal health data that they did not have previously. I want to make it clear that the Bill does not change the current law on the collection, use and disclosure of personal data for any purpose including health research. If, for example, a person wants to participate in an ethically approved clinical trial, it will still be for him or her to allow the researcher access to his or her medical records. In that situation, a researcher might wish to associate the person's individual health identifier with such a record to ensure that each person voluntarily participating in the trial is uniquely identified. Accordingly, it is most important to note that allowing the use of the identifier for research purposes is tightly controlled in the Bill. Even in the limited circumstances where it is allowed, the Bill in and of itself does not confer a right of access to anyone's medical records. Any disclosure of personal health data, those being, patient identifiable information, by a health care provider, for example, the HSE, a hospital or a general practitioner, GP, to a third party for any purpose not connected with patient care is governed by data protection legislation, the common law duty of confidentiality that a health care provider owes to a patient and professional ethical rules.

Amendment No. 4 relates to paragraph (g) of the definition of secondary purposes, which initially referred to "any processing of personal data that is in accordance with the Data Protection Acts 1988 and 2003." Paragraph (g) was potentially broad and could have allowed the use of the identifier and the disclosure of identifying particulars beyond what was intended. Consistent with our desire to control and limit the use of the identifier and its data set, the original paragraph (g) was replaced with a more specific provision allowing the processing of the identifier and its data set under the Bill where required to protect or prevent injury or other damage to the health or safety of an individual, where required under the law or by order of a court or where the processing was in accordance with the Data Protection Acts and necessary for obtaining legal advice or for the purposes of legal proceedings or alternative dispute resolution procedures. As some flexibility may be desirable, the Minister will be able to prescribe other health-related processing of the identifier and its identifying particulars not already covered under secondary purposes, should it be necessary. This will only be done where the Minister is satisfied that it is in the public interest to do so and he or she has also consulted the Data Protection Commissioner.

For completeness, I should add that amendments Nos. 3 and 4 have been positively discussed with the Office of the Data Protection Commissioner. In fact, this is an appropriate point to acknowledge the constructive engagement with the commissioner and his officials on this Bill generally. That engagement has ensured that the commissioner plays an important role under the Bill, as is expressly evident in numerous provisions. It also reflects my desire that privacy protection considerations should underpin the Bill.