S.I. No. 752/2024 - Data Protection Act 2018 (Control of Data for the Inquiry into the Historical Licensing and Use of Sodium Valproate) Regulations 2024

Notice of the making of this Statutory Instrument was published in

“Iris Oifigiúil” of 7th January, 2025.

The Minister for Health, in exercise of the powers conferred on me by sections 38 (4) of the Data Protection Act 2018 (No. 7 of 2018), having duly complied with section 38 (4)(b) and (5) thereof, hereby make the following regulations:

Citation

1. These Regulations may be cited as the Data Protection Act 2018 (Control of Data for the Inquiry into the Historical Licensing and Use of Sodium Valproate) Regulations 2024.

Interpretation

2. In these Regulations—

“Act of 2018” means the Data Protection Act 2018 (No. 7 of 2018);

“aims of the inquiry” means the aims as set out in the agreement between the inquiry chair on 17 June 2024;

“General Data Protection Regulation” means Regulation (EU) 2016/679 of the of the European Parliament and of the Council of 27 April 2016¹ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);

“inquiry” means the non-statutory inquiry into the licensing and use of sodium valproate in women of child-bearing potential in the State approved by decision of the Government on 11 July 2024;

“inquiry candidate” means a person, including a child, who wishes to become an inquiry participant;

“inquiry chair” means the person appointed by the Minister to conduct the inquiry and provide a final report to the Minister;

“inquiry participant” means a person, including a child, who is participating in the inquiry whether due to their status as a person with a diagnosis of foetal valproate spectrum disorder, the mother or other family member of a person with that diagnosis, or otherwise;

“Minister” means the Minister for Health;

“personal data” means personal data as defined in Article 4 of the General Data Protection Regulation;

“relevant party” means a natural or legal person, association, body, entity or stakeholder, who the inquiry chair considers relevant to the aims of the inquiry.

“special category personal data” means personal data which is subject to additional protection under Article 9(1) of the General Data Protection Regulation.

Legal basis and scope

3. These Regulations—

(1) are made pursuant to sections 38(4) of the Act of 2018, the processing of personal data in pursuit of the aims of the inquiry being necessary for the performance of a task carried out in the public interest, and

(2) apply to personal data and, provided that it is prescribed in Regulations made under section 51 of the Act of 2018, may also apply to special category personal data.

Designation

4. For the purposes of these Regulations and within the meaning of the General Data Protection Regulation and the Act of 2018—

(1) the Minister and the inquiry chair are joint controllers of personal data provided to the inquiry; and

(2) persons, including children, whose personal data is provided to the inquiry are data subjects.

Provision of personal data

5. (1) Subject to paragraph (3), personal data may be accepted by the inquiry chair in accordance with paragraph (2), from—

(a) inquiry candidates,

(b) inquiry participants, and

(c) relevant parties,

for the purposes of achieving the aims of the inquiry.

(2) The inquiry chair may invite the persons or parties referred to in paragraph (1), their parents or guardians, to provide personal data to the inquiry for the purposes specified in paragraph (1) and, where such an invitation issues, the inquiry chair—

(a) shall fix a time period within which that data must be provided and communicate that time period at the occasion of the invite; and

(b) may fix a time period outside of which further data will not be accepted which, if fixed, shall be communicated at the occasion of the invite.

(3) The inquiry chair shall ignore any personal data which is provided to the inquiry by persons or parties other than persons or parties referred to in paragraph (1), their parents or guardians and, subject to paragraph (4), return to the sender any such data received.

(4) If it is not possible to return personal data under paragraph (3), the inquiry chair shall—

(a) destroy the data, if he or she is satisfied that it would not involve the destruction of original documents, or

(b) if he or she has reasonable grounds to believe that original documents would be destroyed under paragraph (a), take such steps as he or she considers appropriate to prevent the further processing of such data and to attempt to return any original documents to the sender, author or, if appropriate, the person most concerned thereby.

Processing of personal data

6. (1) Without prejudice to Regulation 7 and subject to paragraphs (2) and (3), personal data provided to the inquiry may be processed only to the extent that such processing is necessary and proportionate to the aims of the inquiry.

(2) The inquiry chair shall take measures to safeguard the fundamental rights and freedoms of data subjects in processing personal data which is received under these Regulations including in relation to—

(a) right of access to data;

(b) right to rectify;

(c) right of erasure;

(d) right to restrict processing; and

(e) right to be notified regarding the erasure or rectification of data.

(3) The inquiry chair shall prepare and implement policies and procedures to provide for the processing of personal data which—

(a) shall be proportionate to the aims of the inquiry and have regard to—

(i) the nature, scope and purposes of the processing, enabling the processing of such data only in so far as is necessary and proportionate to the aims of the inquiry;

(ii) the nature of the substantial public interest concerned;

(iii) any benefits likely to arise for the data subjects concerned;

(iv) any risks arising for the rights and freedoms of such subjects, and

(v) the likelihood of any such risks arising and the severity of such risks.

(b) make provision for—

(i) the use of secure storage, passwords, encryption and other methods to ensure personal data can only be accessed by the inquiry chair or by persons authorised by the inquiry chair to access that data;

(ii) the use of controls to ensure that personal data is only disclosed to the inquiry chair or persons authorised thereby, or entitled or permitted by law, to receive that personal data;

(iii) processes to ensure the accuracy of the personal data, that it is kept up to date and accurate, and that an accurate record of the data provided to the inquiry chair is kept;

(iv) appropriate storage periods for personal data or classes thereof;

(v) expiry periods and the treatment of personal data or classes thereof at the expiry of the storage periods;

(vi) data minimisation, including the use of anonymisation and pseudonymisation where possible or appropriate, and especially with reference to special categories of personal data;

(vii) the keeping of records to demonstrate compliance with data protection.

(c) shall be reviewed by the inquiry chair on a regular basis, and updated, if he or she considers it appropriate to do so.

Interaction with other law

7. Nothing in these Regulations shall be read in manner which conflicts with the General Data Protection Regulation or the Act of 2018 and, in particular, shall not affect the processing of personal data provided to the inquiry, for archiving purposes in the public interest in accordance with section 61 of the Act of 2018.

Communications with data subjects

8. The inquiry chair shall ensure that all information provided under these Regulations to the persons or parties referred to in Regulation 5(1), their parents or guardians, is concise, intelligible and made available in easily accessible format using clear and plain language.

GIVEN under the Official Seal of the Minister for Health,

23 December, 2024.

STEPHEN DONNELLY,

Minister for Health.

EXPLANATORY NOTE

(This note is not part of the Instrument and does not purport to be a legal interpretation.)

These Regulations are made under s. 38(4) of the Data Protection Act 2018 in order to regulate the provision, control and processing of personal data (and may apply to special category personal data if prescribed in Regulations made under s. 51 of the Act of 2018) which is provided to the non-statutory inquiry into the historical licensing and use of sodium valproate in women of child-bearing potential in the State, for the purpose of that inquiry.

1 OJ No. L 119, 4.5.2016, p.1