Click here to view this briefing in PDF format

 

Applying for a Consent Declaration

The Standard Process
Since their introduction in late 2018, the Data Protection Act 2018 (Section 36(2)) (Health Research) Regulation 2018 (S.I. 314/2018) (“the Regulations”) have materially changed how health research can be conducted in Ireland. Among other requirements, the Regulations have most notably imposed an obligation on data controllers to obtain the explicit consent of data subjects to process their personal data for the purposes of specified health research. As outlined in our previous article (available here), where it is not feasible to obtain such explicit consent, an application may be made to the Health Research Consent Declaration Committee (the “HRCDC”) to obtain a declaration that explicit consent is not required. The HRCDC will only grant a declaration where it is satisfied that the requirements of the Regulations have been met, and where the applicant has demonstrated that the public interest in carrying out the research significantly outweighs the public interest in requiring the explicit consent of the data subject.

Over time, it has become clear that there is scope for some refinements to be made to the consent declaration process. For example, the application process is entirely separate from the process by which researchers must obtain ethical approval from a research ethics committee. Further, the process is relatively time-consuming, requiring the applicant to answer a number of in-depth questions about its research and provide extensive supporting documentation.   

Some of these topics are apparent from a review of the HRCDC’s first Annual Activities Report, which was published on 27 April 2020 (the “Report”). The Report states that in 2019, the HRCDC received 86 applications, met on 9 occasions (on average, every five weeks), and made 23 decisions. Of its decisions, 3 resulted in unconditional declarations, 17 declarations were granted with conditions attached, 2 applications were deferred with additional information requested (and ultimately withdrawn), and 1 application was refused (although this decision was overturned on appeal, resulting in the grant of a conditional declaration by an independent appeal panel). In acknowledging the significant number of 2019 applications, the Chairperson noted that the HRCDC will prioritise applications for new research, but that the HRCDC hopes “to clear the backlog of existing research applications during 2020.”

The NREC/HRCDC Covid-19 Application Process
As the public interest in the swift conduct of effective health research cannot be understated in the context of the COVID-19 pandemic, it was clear that all of the typical regulatory hurdles that are faced by researchers would need to be adjusted. In this regard, the Minister for Health has exercised his powers under the Clinical Trials on Medicinal Products for Human Use Regulations 2004 (S.I. 190/2004) (as amended) to establish a temporary National Research Ethics Committee for COVID-19 (the “NREC COVID-19”).

The NREC COVID-19 will review all COVID-19-related studies that have secured funding or conditional funding and that involve “health research” within the meaning of the Regulations. In doing so, it will engage with other relevant bodies, including the Health Products Regulatory Authority (“HPRA”) and the HRCDC, with the objective that researchers can receive all necessary decisions within an accelerated timeline. In this regard, the NREC COVID-19 is aiming to deliver decisions within 7 days of confirmation of a validated application.

Although separate applications will need to be made to the HPRA where the study involves a clinical investigation of a medical device or a clinical trial of a medicinal product, the process is streamlined where the research requires a consent declaration. In this regard, the NREC COVID-19 application form (available here) contains mandatory questions on compliance with the Regulations, and an optional section that poses queries related to a consent declaration. Where the applicant seeks a consent declaration, the NREC-COVID-19 will forward the application to the HRCDC to enable contemporaneous evaluation. The HRCDC Secretariat will, however, continue to act as the point of contact for all queries on the consent declaration, and will directly communicate HRCDC decisions to applicants.

The Minister will commence a review of the NREC COVID-19 within three months of its establishment, with the objective of shifting responsibility back to the existing distributed research ethics committee system when the majority of applications have been processed and projects have been commenced.

Broader Learnings for the Standard Consent Declaration Process?
The integrated review process for COVID-19 research studies is a very welcome development. From a data protection perspective, this process highlights how the current consent declaration process could be improved. In its annual report, the HRCDC committed to adopting a new application form and updated guidance on the consent declaration process, stating that it will work closely with the Department of Health and the Data Protection Commission, particularly in respect of expected amendments to the Regulations by the Department of Health. It remains to be seen if prospective changes will result in a streamlined consent declaration process for research studies that are unrelated to COVID-19.

The European Perspective

Although the Regulations are very prescriptive in outlining what is required of researchers from a data protection perspective, the EDPB’s timely Guidelines serve as a helpful reminder that it is important to maintain full compliance with data protection law in the context of research related to COVID-19.

In particular, the EDPB has stressed the significance of adhering to the data protection principles contained in Article 5 of the GDPR. In addition to being transparent, ensuring that all processing of personal data is compatible with the purposes for which it was collected, and processing no more personal data than is necessary, the EDPB has noted that researchers must pay particular attention to the principles of integrity and confidentiality and storage limitation. In this regard, the EDPB has concluded that the principle of integrity and confidentiality must be read in conjunction with the requirements of Articles 32(1) and 89(1) of the GDPR, and that the technical and organisational measures that are adopted to guarantee a sufficient level of security “should at least consist of pseudonymisation, encryption, non-disclosure agreements and strict access role distribution, restrictions as well as logs.”

The EPDB has also noted that proportionate periods for the retention of personal data must be set, having regard to the length and purpose of
the research.

The EDPB has further stressed the importance of having a valid lawful basis for research, and highlighted the difficulties that arise in relying on consent, although the options available to Irish researchers to address these issues are obviously further restricted as a result of the Regulations.

The EDPB has indicated that it intends to issue more detailed guidance on the processing of health data for scientific research as part of its annual work plan.

The authors would like to thank Lorraine Sheridan for her contribution to this article.