Róisín Shortall (Dublin North West, Social Democrats)
Link to this: Individually | In context | Oireachtas source

1012. To ask the Minister for Health if he conducted patient and public engagement prior to enacting SI No. 18/2021 Data Protection Act 2018 (section 36(2)) (Health Research) (Amendment) Regulations 2021; and if he will make a statement on the matter. [12160/21]

Stephen Donnelly (Wicklow, Fianna Fail)
Link to this: Individually | In context | Oireachtas source

Since the Data Protection Act 2018 (section 36(2)) (Health Research) Regulations (SI 314 of 2018) were made in August 2018, my Department has engaged widely and publicly on the amendments that have now been set out in SI 18 of 2021. It had due regard to all the views put forward which came from a range of groups and individuals, including groups like the Medical Research Charities Group which plays an important role in highlighting patient perspectives on research and in ensuring that the patient voice is central to decisions made about health research. That engagement is reflected in the balanced nature of the amendments.

Giving an ongoing tangible voice to patients and the public is ensured in the amendments where it is expressly provided that the consultations to be undertaken by a researcher making an application for a consent declaration are not just with data subjects but now extend to patients and the public too.

Further, the appeals mechanism in the Health Research Regulations has been strengthened to allow the appeal panel to invite submissions from any person that it considers appropriate and consult with any person who it believes could assist in the consideration of an appeal. This will allow patients and the public to be heard in the appeals process.

Róisín Shortall (Dublin North West, Social Democrats)
Link to this: Individually | In context | Oireachtas source

1013. To ask the Minister for Health if section 3B(1) of the Data Protection Act 2018 (section 36(2)) (Health Research) (Amendment) Regulations 2021 applies to genomic research in circumstances in which there are implications for relatives of the data subject (details supplied); and if he will make a statement on the matter. [12161/21]

Róisín Shortall (Dublin North West, Social Democrats)
Link to this: Individually | In context | Oireachtas source

1014. To ask the Minister for Health the position in respect of deferred consent of personal data in circumstances in which an individual dies without capacity to give explicit consent for research purposes; and if there is an ethical framework or policy to deal with this matter. [12162/21]

Róisín Shortall (Dublin North West, Social Democrats)
Link to this: Individually | In context | Oireachtas source

1015. To ask the Minister for Health if a deceased person’s personal data may be used in genomic research if consent was not obtained while the data subject was alive in view of the implications for relatives of the deceased. [12163/21]

Róisín Shortall (Dublin North West, Social Democrats)
Link to this: Individually | In context | Oireachtas source

1016. To ask the Minister for Health if a controller may use a patient’s data for research purposes in circumstances in which the patient lacks the capacity to consent and his or her next of kin ​and or power of attorney objects; and if he will make a statement on the matter. [12164/21]

Stephen Donnelly (Wicklow, Fianna Fail)
Link to this: Individually | In context | Oireachtas source

I propose to take Questions Nos. 1013 to 1016, inclusive, together.

The Health Research Regulations, which are derived from GDPR and are made under the Data Protection Act 2018, apply where there is processing of personal data for health research purposes. Where the health research does not involve, give rise to or become associated with personal data the Regulations, the Act and GDPR do not apply. In that same context, the Health Research Regulations do not change the law on, for example, taking or using bio-samples for research purposes. That is very important to bear in mind.

As with all aspects of data protection law and across all sectors, it is for the data controller to determine whether personal data is involved and, if so, whose personal data. The definition of personal data is set out in Article 4 of the GDPR as is the definition of genetic data. Those definitions are binding on the Health Research Regulations and those involved in genetic and genomic research should make sure that they are fully conversant with those definitions, compliant with the law in this area and also adhere to international best ethical practice.

I will deal now with the specifics of Regulation 3B of the Health Research Regulations. Emergency care and treatment is a real-life reality that saves lives. It is also an internationally recognised reality that the only way to develop new emergency care treatments and procedures is through research studies that are carried out side by side with the care being provided to the patient. That is what Regulation 3B of the Health Research Regulations is designed to help facilitate to the extent that it can do so as secondary legislation that deals only with information processing.

The amendment is a tightly drawn provision that allows for deferred consent of the data subject for the processing of his or her personal data in health research in limited and specified circumstances subject to safeguards.

In fact, it is expressly provided in Regulation 3B that the circumstances must be exceptional and that the principal purpose of the processing or further processing of the personal data concerned by the data controller is necessary for the provision of health care to an individual and necessary to protect the vital interests of the individual. It is further expressly provided that the research must be “related health research” which means research that is related to the care and treatment being provided to the individual. It is difficult to see how genomic research, given its nature, would fall under this provision.

On the question of the processing of personal data of a deceased individual, the provisions of data protection law apply only to the personal data of living individuals. That rule is applicable equally in the limited cases covered by Regulation 3B. Ethical matters associated with health research are considered by RECs and Regulation 3B requires REC approval.

Where an individual is alive, the GDPR does not give consent rights to other individuals to act on behalf of an adult data subject where the data subject lacks capacity to consent so the question of next of kin is moot and enduring powers of attorney are not generally viewed as extending into the health-related realm.

However, the duty of confidentiality survives death so health professionals holding the medical records of deceased individuals should exercise considerable care in releasing that information to a third party. In that regard, the Medical Council’s advice to doctors is “if it is unclear whether the patient consented to the disclosure of information after their death, you should consider how the disclosure might benefit or cause distress to the deceased’s family or carers. You should also consider the effect of the disclosure on the reputation of the deceased and the purpose of the disclosure.”

Given that the thrust of these questions relates to protecting the privacy of individuals in the complex area of genomic research, I want to take the opportunity afforded by the Deputy’s questions to provide some contextual elaboration. Genomics is applied to health, especially within rare disease and cancer, to provide diagnosis, prognosis and uncover links between genetic variation and disease. Genomics can bring significant benefits to healthcare systems, by accelerating clinical research and drug development, personalizing treatment regimens, improving patient outcomes, and reducing the cost of care.

While genomic research opens up exciting possibilities such research also poses particular societal, ethical and regulatory challenges. From a privacy perspective, one of the ways that genomic data are special is in their potential to yield information that relates to more than one individual. This means that genome sequence data should be handled carefully even if, for example, it is derived from a deceased individual, and otherwise out of scope of the GDPR. It could be argued that aspects of the genome that are highly likely to be shared with living family members will constitute ‘personal data’ if they can be connected with those data. For example, if a tissue block or sample from a deceased relative is analysed to inform the treatment of a living individual, the data should be treated as ‘personal data’ relating to the living individual because the GDPR does not regulate based on the source of the information but focuses on its content.

While those matters are for the Data Protection Commission to determine and are likely to feature in the European Data Protection Board Guidelines on processing personal data for scientific research purposes (currently in preparation and due sometime this year) I will conclude by repeating a point I made at the beginning of this answer: namely, that those involved in genetic and genomic research should make sure that they look very carefully at the relevant definitions in Article 4 of GDPR, comply fully with the law in this area and meet international best ethical practice in the conduct of their research. Such an approach will be critical to achieving the necessary public support for such research.

Róisín Shortall (Dublin North West, Social Democrats)
Link to this: Individually | In context | Oireachtas source

1017. To ask the Minister for Health the reason explicit consent or ethical approval is not required when a controller obtains personal data to establish if a person may be suitable or eligible for inclusion in research; the criteria used to ascertain if research is preliminary or substantive (details supplied); and if he will make a statement on the matter. [12165/21]

Stephen Donnelly (Wicklow, Fianna Fail)
Link to this: Individually | In context | Oireachtas source

The Health Research Regulations include explicit consent as a safeguard when an individual’s personal data is being processed for health research. However, before health research can be carried out it is invariably critical to establish whether there would be enough potential suitable or eligible research participants for the study to proceed. It seems reasonable to allow that process to be undertaken without explicit consent and that is what the pre-screening amendment to the Health Research Regulations allows subject to very clear rules and safeguards. Moreover, the requirement for explicit consent is still applicable for the substantive research if the pre-screening process indicates a sufficient number of potential participants for the study to commence.

The same logic applies to the research ethics committee (REC) condition for the pre-screening process and REC approval is still required should the research proceed following the pre-screening.

The Guidelines prepared by my Department, in collaboration with the HSE, Health Research Board and Health Research Consent Declaration Committee, in consultation with the Data Protection Commission set out the actions that are to be regarded as pre-screening actions. They are:

(a) reviewing the personal data of a data subject in order to assess whether he or she might be suitable or eligible for inclusion in a health research study.

(b) analysing the pre-screening data and documenting the findings,

(c) sharing the findings (in a non-identifiable way) with others involved in the research team.

(d) approaching an individual found to be eligible or suitable to determine their interest in participation in the study and it is considered best practice that the approach to the prospective research subject to establish their interest should always be done only by a health practitioner.

(e) sharing the identity of the individual with the research team on a confidential basis where the individual has consented to be contacted by the research team.