Dáil Éireann Debate, Wednesday - 3 March 2021
1013. Deputy Róisín Shortall asked the Minister for Health if section 3B(1) of the Data Protection Act 2018 (section 36(2)) (Health Research) (Amendment) Regulations 2021 applies to genomic research in circumstances in which there are implications for relatives of the data subject (details supplied); and if he will make a statement on the matter. [12161/21]
View answer1014. Deputy Róisín Shortall asked the Minister for Health the position in respect of deferred consent of personal data in circumstances in which an individual dies without capacity to give explicit consent for research purposes; and if there is an ethical framework or policy to deal with this matter. [12162/21]
View answer1015. Deputy Róisín Shortall asked the Minister for Health if a deceased person’s personal data may be used in genomic research if consent was not obtained while the data subject was alive in view of the implications for relatives of the deceased. [12163/21]
View answer1016. Deputy Róisín Shortall asked the Minister for Health if a controller may use a patient’s data for research purposes in circumstances in which the patient lacks the capacity to consent and his or her next of kin and or power of attorney objects; and if he will make a statement on the matter. [12164/21]
View answerI propose to take Questions Nos. 1013 to 1016, inclusive, together.
The Health Research Regulations, which are derived from GDPR and are made under the Data Protection Act 2018, apply where there is processing of personal data for health research purposes. Where the health research does not involve, give rise to or become associated with personal data the Regulations, the Act and GDPR do not apply. In that same context, the Health Research Regulations do not change the law on, for example, taking or using bio-samples for research purposes. That is very important to bear in mind.
As with all aspects of data protection law and across all sectors, it is for the data controller to determine whether personal data is involved and, if so, whose personal data. The definition of personal data is set out in Article 4 of the GDPR as is the definition of genetic data. Those definitions are binding on the Health Research Regulations and those involved in genetic and genomic research should make sure that they are fully conversant with those definitions, compliant with the law in this area and also adhere to international best ethical practice.
I will deal now with the specifics of Regulation 3B of the Health Research Regulations. Emergency care and treatment is a real-life reality that saves lives. It is also an internationally recognised reality that the only way to develop new emergency care treatments and procedures is through research studies that are carried out side by side with the care being provided to the patient. That is what Regulation 3B of the Health Research Regulations is designed to help facilitate to the extent that it can do so as secondary legislation that deals only with information processing.
The amendment is a tightly drawn provision that allows for deferred consent of the data subject for the processing of his or her personal data in health research in limited and specified circumstances subject to safeguards.
In fact, it is expressly provided in Regulation 3B that the circumstances must be exceptional and that the principal purpose of the processing or further processing of the personal data concerned by the data controller is necessary for the provision of health care to an individual and necessary to protect the vital interests of the individual. It is further expressly provided that the research must be “related health research” which means research that is related to the care and treatment being provided to the individual. It is difficult to see how genomic research, given its nature, would fall under this provision.
On the question of the processing of personal data of a deceased individual, the provisions of data protection law apply only to the personal data of living individuals. That rule is applicable equally in the limited cases covered by Regulation 3B. Ethical matters associated with health research are considered by RECs and Regulation 3B requires REC approval.
Where an individual is alive, the GDPR does not give consent rights to other individuals to act on behalf of an adult data subject where the data subject lacks capacity to consent so the question of next of kin is moot and enduring powers of attorney are not generally viewed as extending into the health-related realm.
However, the duty of confidentiality survives death so health professionals holding the medical records of deceased individuals should exercise considerable care in releasing that information to a third party. In that regard, the Medical Council’s advice to doctors is “if it is unclear whether the patient consented to the disclosure of information after their death, you should consider how the disclosure might benefit or cause distress to the deceased’s family or carers. You should also consider the effect of the disclosure on the reputation of the deceased and the purpose of the disclosure.”
Given that the thrust of these questions relates to protecting the privacy of individuals in the complex area of genomic research, I want to take the opportunity afforded by the Deputy’s questions to provide some contextual elaboration. Genomics is applied to health, especially within rare disease and cancer, to provide diagnosis, prognosis and uncover links between genetic variation and disease. Genomics can bring significant benefits to healthcare systems, by accelerating clinical research and drug development, personalizing treatment regimens, improving patient outcomes, and reducing the cost of care.
While genomic research opens up exciting possibilities such research also poses particular societal, ethical and regulatory challenges. From a privacy perspective, one of the ways that genomic data are special is in their potential to yield information that relates to more than one individual. This means that genome sequence data should be handled carefully even if, for example, it is derived from a deceased individual, and otherwise out of scope of the GDPR. It could be argued that aspects of the genome that are highly likely to be shared with living family members will constitute ‘personal data’ if they can be connected with those data. For example, if a tissue block or sample from a deceased relative is analysed to inform the treatment of a living individual, the data should be treated as ‘personal data’ relating to the living individual because the GDPR does not regulate based on the source of the information but focuses on its content.
While those matters are for the Data Protection Commission to determine and are likely to feature in the European Data Protection Board Guidelines on processing personal data for scientific research purposes (currently in preparation and due sometime this year) I will conclude by repeating a point I made at the beginning of this answer: namely, that those involved in genetic and genomic research should make sure that they look very carefully at the relevant definitions in Article 4 of GDPR, comply fully with the law in this area and meet international best ethical practice in the conduct of their research. Such an approach will be critical to achieving the necessary public support for such research.
