What GDPR and the Health Research Regulations (HRRs) mean for Ireland: “explicit consent”—a legal analysis

Abstract

Background Irish Health Research Regulations (HRRs) were introduced following the commencement of the General Data Protection Regulation (GDPR) in 2018. The HRRs set out supplementary regulatory requirements for research. A legal analysis presented under the auspices of the Irish Academy of Medical Sciences (IAMS) on April 8 and November 25, 2019 at the Royal College of Surgeons in Ireland welcomed the introduction of GDPR and the HRRs. The analysis found the GDPR "explicit consent" introduced by the HRRs is problematic. A call was made to regulate informed consent in line with the common law as an achievable alternative safeguard, bringing Ireland in line with other EU Member States. Aims This article aims to review academic papers, legal opinion, EU opinion and advice and data protection law in relation to research and explicit consent, in order to examine the legal burden of GDPR and the HRRs on health research in Ireland and to determine whether the analysis presented at the IAMS meetings is reflected more widely in legal text. Methods Legal literature review of academic papers, legal opinion, EU opinion and advice and data protection legislation. Results The legal literature review overwhelmingly supports the concerns raised. Conclusions Our results confirm the GDPR explicit consent requirement of the HRRs is having had a significantly negative and far-reaching impact on the conduct of health research in Ireland. Urgent review of the HRRs and meaningful engagement between the health research community and legislators in healthcare is required.

Exploring the prevalence and profile of epilepsy across Europe using a standard retrospective chart review: Challenges and opportunities

“…Ireland, for example, have created significant problems for research, including chart review studies, prompting researchers to argue whether, without intervention, Ireland may face exclusion from European-wide research consortia. 21 Without a broader interpretation of the current regulations of retrospective chart review studies, there is concern that epidemiological studies, of low risk to participants and high public benefit, will be severely hampered. Note: In cells with fewer than five persons, we have used "<5".…”

Recommendations for Creating Codes of Conduct for Processing Personal Data in Biobanking Based on the GDPR art.40

“…Others argue that due to the concept of data used by the GDPR, it is impossible to identify biological material with data ( Hallinan and De Hert, 2016 ). Code development can be of pivotal importance for such countries as Ireland, where the previous health research laws were more liberal than the GDPR ( Kirwan et al, 2021 ).…”

General data protection regulations (2018) and clinical research: perspectives of patients and doctors in an Irish university teaching hospital

“…These prove to be worrying findings; initial aspirations for GDPR were 'to provide rules for the protection of the personal data of natural persons and the processing of their personal data', and the current study highlights only a moderate awareness of GDPR among both patients (63%) and doctors (73%). With this in mind, the anticipated obstruction to clinical research seems to be of secondary importance as it remains crucial that doctors and patients are careful to protect data in the clinical setting, in order to prevent data breaches [4,8,9,13].…”