Amendments to the Health Research Regulations

The Department of Health announced amendments to the Health Research Regulations 2018 in January 2021 - see announcement, including guidance here (link to Department of Health website)

These amendments took effect on the 21st January 2021.

The Statutory Instrument was published on the 29th January 2021.

S.I. No. 18/2021 - Data Protection Act 2018 (Section 36(2)) (Health Research) (Amendment) Regulations 2021 (link to Irish Statute Book website)

Training on the Amendments

The Trinity Centre for Ageing and Intellectual Disability hosted: -

• A Roundtable on the Amendments to the Health Research Regulations on the 21 April 2021; and


• A Masterclass on Consent on the 28 April 2021

Recordings of these events are made available on the Trinity College Dublin website (link to TCD website) on the 17 May 2021.

The following disclaimers apply when viewing this material: -

1. 'explicit consent' relates to the processing of personal data and differs from informed consent to take part in research;


2. there are a number of criteria which need to be met to reach the threshold for 'explicit consent' for processing of personal data under GDPR -
• the 'documenting and recording' of consent is one of these criteria only - see graphic for all criteria, and relevant context piece (drafted BH Ethics) ;


3. the 'data controller' must be able to demonstrate that all of the criteria have been met;


4. the maximum fine for the hospital in event of failure to meet all of the criteria is one million euro - a higher fine applies for organisations which are not public bodies;


5. one of the criteria which needs to be met is 'unbundled' i.e. consents not being bundled together but being kept separate and distinct. As such, it is advisable to keep 'explicit consent' for the processing of personal data 'separate and distinct' from informed consent to take part in research;


6. the term 'freely given' in the context of 'explicit consent' for the processing of personal data has a specific meaning under GDPR;


7. 'consent' for processing of personal data for research purposes was not an absolute requirement under the Data Protection Directive 1995: -
   • Section 2(1) of Data Protection Acts 1988 and 2003 (the Acts) permitted the further or secondary use of data for research purposes with appropriate safeguards. The Acts deemed research compatible with the original purpose.
   • The Acts also contained an exemption to the requirement to notify the data subject of the secondary use of data for research set out at 2(D)(4) where it would be impossible or involve disproportionate effort.
   • In terms of consent Section 2A-D sets out a research exemption to consent. Processing was permitted for 'medical purposes' by a health professional or someone who owes a duty of confidentiality to the data subject. 'Medical purposes' was defined in the Acts as including research.

(- legal analysis of 1988 and 2003 Acts
courtesy of
Mary Kirwan, Barrister-at-Law)