Ensuring we involve seldom heard voices in supporting the Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018

General comments
As the Introduction makes clear, the stated purpose of the article is to raise concerns with regard to five issues concerning the Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018. 
 
These concerns are addressed to the Department of Health and the Consent Declaration Committee (to be appointed by the Minister) as the Regulations, commonly referred to as the Health Research Regulations, were made by the Minister for Health in August of this year. While raising legitimate issues about patient voices, especially in a health system where there has been a publicly stated intention by Government to improve patient involvement, some of the issues raised are not relevant to the Regulations. Furthermore, where the concerns are relevant to the Regulations the authors place the whole responsibility on the Department of Health or the Committee to initiate and drive the requested patient involvement. It is submitted for consideration by the authors that they take the opportunity presented by the article to frame more clearly what those initiatives might or should be and identify the range of stakeholders, both statutory and non-statutory, who might be involved in advancing this important collective agenda.
 
It is also suggested that the article would benefit from setting out the background to and the purpose of the Regulations – in particular that they are “suitable and specific safeguards” for data subjects as required under the General Data Protection Regulation (GDPR). Contextualising the Regulations within the broad legal framework that gave rise to them would help the reader better understand their individual and collective provisions. This framework includes the General Data Protection Regulation (GDPR) and legislation giving effect to it in Ireland including the Data Protection Act 2018 and the Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018 but it also includes the Irish Constitution and its right to privacy, the common law duty of confidentiality which is at the heart of the health professional-patient relationship and the rights of individuals in relation to their health information under the European Convention on Human Rights and the related case law of the European Court. Consent and confidentiality in relation to personal health data are very much to the fore in each of the above.
 
Specific comments on each of the 5 concerns raised are included below.
 
Issue 1: The Health Research Consent Declaration Committee - how seldom heard voices will be involved
The article outlines the importance of the Committee and its membership. It notes that no one has, as yet, been appointed to the Committee and strongly urges that the Department outline in detail how they will include public and patient organisations in the membership of this committee. It also requests details as to how seldom heard voices will contribute to this committee and how they will be supported and resourced.
While there are no specific provisions on patient involvement in the GDPR, the Department of Health is strongly of the view that ensuring the voice of patients is heard when it comes to matters of personal data protection, privacy and sharing of data is essential and it is for this reason that explicit reference is made to this in the Health Research Regulations. As a natural follow-on to the Department’s support for the PPI initiatives advanced by its key health research agency, the Health Research Board in recent years, and a track record of close engagement with the Medical Charities Research Group, IPPOSI and the Irish Health Research Forum, the Department is committed to including patient and public voices on the Consent Declaration Committee. However, it is clear that this is not an insignificant challenge to get right, either at the outset or over time. Since no one has been appointed yet, it is suggested that the article provides a timely opportunity to suggest tangible proposals for consideration by the Department to achieve the objective sought. Such proposals could usefully inform other research-related initiatives into the future, such as the recruitment, training and support for public and patient representation in a national system of research ethics committees. 
 
Issue 2: Co-design of participation information leaflet templates
The second specific point requests the Health Research Consent Declaration Committee (when established) to develop a suite of short accessible participant information templates that are co-designed with all relevant stakeholders. It would be very helpful if the article could clarify who the envisaged “participants” and “all the relevant stakeholders” are. Further, while it does not appear in the Regulations that there is a direct link between the Committee and research ethics committees -apart from the requirement that applicants to the Committee have REC approval- the article’s suggestion that the Committee work with RECs on its documentation might usefully have been broadened to request a two-way process where the Committee and RECs develop and harmonise their applications and operational processes, as far as possible. Again it would be helpful to set out ideas in the article on how this might be done and what it might involve. The Department has engaged with members from a large number of RECs in recent months, and it is clear that much good work is being done by REC members in drafting template information leaflets and consent forms. Perhaps institutional PPI teams could engage with their institutional RECs to advance this work in a way that maximises accessibility with transparency for data subjects.
 
It is also worth noting that Article 40 of GDPR encourages association and other bodies representing categories of controllers or processors to draw up codes of conduct as a way to help them apply the GDPR effectively and to allow them to demonstrate compliance. As an example of this, the Biobanking and Biomolecular Resources Research Infrastructure (BBMRI), a distributed research infrastructure of biobanks and biomolecular resources, is currently developing a “Code of Practice for Health Research” and the Department of Health welcomes this and similar developments, and encourages the active participation of researchers, institutions and those representing the voice of the patient and the public to become actively involved in these deliberations.
 
Finally, the fact that consent under GDPR must be freely given, specific, informed and unambiguous is not unique to Ireland, but is a Europe wide requirement (and indeed was a requirement under the previous Data Protection Directive). Therefore, there are ever increasing instances of useful guidance and templates being made available online, both in respect of consent and transparency arrangements.
 
Issue 3: Conflict between open data, data sharing (FAIR principles) and purpose-bound consent
The third specific point concerns what is described as a conflict between open data, data sharing and purpose-bound consent. The article references Regulation 3(1)(e) of the Health Research Regulations which sets out the requirement for explicit consent. As the article correctly states, that consent can be for the purpose of specified health research, either in relation to a particular area or more generally in that area or a related area of health research, or part thereof. The article calls for clarification on how specific consent –which is not the same as consent for a specified purpose or purposes as per the Regulations - “relates to the requirement for researchers to meet FAIR (Findable, Accessible, Interoperable, Reusable) data principles”. 
 
The first important point to make is that the purpose limitation of consent was introduced by the GDPR rather than the Health Research Regulations, so the issue raised by the authors is one that needs to be addressed at a European and global level, and not just in Ireland.
 
Secondly, the Department, working with the HRB, remains committed to ensuring that the research it funds is as open, accessible and usable as possible so it can have the greatest impact. The benefits from opening up research data for scrutiny and reuse are potentially very significant including economic growth, increased resource efficiency and securing public trust in research. The development of the FAIR principles, the focus on Open Science by the EU Commission and the establishment of the EU High Level Expert group, the Open Science Policy Platform, are all to be welcomed. However, while the FAIR principles have pointed a way forward for facilitating data sharing more systematically, it is important that ethical, legislative, methodological, and organisational challenges are addressed as well. How the different considerations should be interpreted and weighed together will likely remain the subject of discussion and debate for some time to come, not least at groups such as the Open Science Policy Platform. Endeavours in this area, such as the drafting of a code of conduct led by BBMRI-ERIC, are much to be welcomed in this respect as a means of ensuring that all the necessary partners input to the deliberations.
In particular, the voice of the public and the patient will be important in these discussions as it could be argued that the FAIR data principles seem at variance with the general theme of the article that patient voices should be heard if the idea being proposed is that data can be shared and used by researchers for other purposes than those covered by the initial consent. It is submitted that it is important that the article reconciles that apparent inconsistency which arises again in another guise in the next specific point. 
 
Issue 4: The ‘burden”’ of reconsenting
The fourth specific point relates to “the burden of re-consenting” individuals regarding the further processing of their personal data for health research purposes. The burden appears to be two-fold falling on both the researcher and the data subject. It is stated that “a researcher must attempt to contact and re-consent participants before submitting an application to the Health Research Consent Declaration Committee”.
 
It would be important for the article to point out that no one is being required to go to the Committee. The Consent Declaration process is an innovation in Irish law to facilitate important health research that might otherwise not be undertaken or continued but it is only available in certain and limited circumstances when it is not possible to hear the voice of the data subject/s through consent or re-consent or where anonymization is not a feasible solution. 
 
Further and importantly, the need to re-consent was not created by the Health Research Regulations but by the GDPR itself. That requirement was referenced in the Article 29 Working Party Guidelines on Consent under Regulation 2016/679 (April 2018) which advised that “if a controller finds that the consent previously obtained under the old legislation will not meet the standard of GDPR consent, then controllers must undertake action to comply with these standards, for example by refreshing consent in a GDPR-compliant way”. It seems reasonable to anticipate that reconsent is likely not to be required in the vast majority of instances for the use of data collected prior to 25 May 2018 provided that the way consent was previously given is in line with the conditions of GDPR. The focus here rests on whether the older consents meet the requirements for consent under the GDPR- freely given, informed, specific and unambiguous by a clear statement or affirmative action of consent. Older consents meeting these requirements are likely to be considered valid, even when the data privacy notification was not originally included.

Therefore, the article might helpfully make the point that the Regulations actually provide a lawful mechanism for ongoing research to continue–through the Consent Declaration Committee- which otherwise might have had to cease.

As for the burden that re-consenting places on data subjects, no concrete evidence is offered and the higher standard of consent required in the GDPR is designed to increase patients’ rights to be heard in relation to their personal data which is the main focus of the article. It is worth noting that in their formal position paper on the GDPR, the European Patient’s Forum welcomed the notion of explicit consent for the processing of sensitive data, they stressed that inactivity cannot be considered as consent and they welcomed the right of the data subject to withdraw their consent. They also acknowledged that the GDPR provided for the processing of identifiable data without consent in exceptional cases but stated that “while asking for consent may represent an excessive burden in certain exceptional cases, we believe that the current provisions are too vague and need to be more detailed. The need to lift consent should be assessed on a case by case basis. Patient representatives should be involved in examining these cases”. This is provided for through the Consent Declaration Committee in Ireland. Furthermore, the EPF highlighted that “consent forms should be clear about potential future use of patients’ data. Patients should be informed of the possibility that their data may be re-used, and it should be clarified if by giving their consented they agree to the re-use of their data by the same research team for the continuity of the study, or broader consent for secondary use by other researchers and/or for other purposes. If the original consent form is not clear on the future use of patients’ data, then consent should be as a rule sought again”.

Issue 5: Linking the Health Research Regulations with the Assisted Decision-Making (Capacity) Act 2015 and development of codes of practice
The fifth point relates to linking the Health Research Regulations with the Assisted Decision-Making (Capacity) Act 2015. While there is no question that capacity to consent is important in the context of the Regulations’ requirement for explicit consent, it is suggested that the article should set out the broader backdrop to this issue.
 
First, the relevant provisions in the Assisted Decision-Making (Capacity) Act 2015 –which as the article correctly states outlines the guiding principles of the presumption of capacity- have not, as yet been fully commenced. Second, since it is the stated view of the Data Protection Commission that informed consent was required prior to the Regulations, it is not the Regulations that have created difficulties with capacity to consent in processing personal data for health research. Further, as the Regulations are secondary legislation and the consent related provisions in the 2015 Act are primary legislation not yet commenced the legislative ability of the Minister to include provisions on capacity to consent in the Health Research Regulations was limited. However, it is the case that the Department of Health have already publicly stated that they are actively seeking to work with others to prepare best practice guidance in this area for the purposes of matters covered by the Health Research Regulations. The article could helpfully set out what some ideas on what might be included in that guidance.

Summary:
This open letter addresses a number of specific concerns of the authors in relation to the implementation new Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018. 
These concerns are as follows: 
a) The authors seek clarification on how the new statutory consent declaration committee will involve public and patient representation. In particular, how will the committee take into account the opinions of seldom heard voices? 
b) The authors are concerned that patient information leaflets and consent forms will be lengthy and complicated and will discourage patient participation. They request that a suite of templates are co-designed by the consent declaration committee in conjunction with all relevant stakeholders.
c) The authors seek clarification in respect of how the new regulations will interface with FAIR data principles (which promote findable, accessible, interoperable and reusable data principles)
d) The authors are concerned that the process of re-consenting is burdensome on both data subjects and researchers.
e) The authors note that, where a data subject has impaired capacity, the new regulations will interact with the Assisted Decision-Making (Capacity) Act 2015 and they request the development of codes of practice to support and integrate assisted decision-making into the regulations.

Overall Comments: 
This open letter raises important practical points regarding the implementation of the Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018. In particular, the authors emphasise the importance of including the opinions and viewpoints of the public and patient representatives including those of seldom heard voices.  

These points are clearly articulated and the authors propose recommendations where possible.

When considering the health research regulations, it is important to remember that the requirement for explicit consent is not new. The previous 1995 Data Protection Directive also required consent to be freely given, specific, informed and unambiguous and this should already be a part of good health research practice. 

Although the authors highlight their concern that regulation 3(1)(e) restricts the re-use of data under the FAIR principles, it is important to note that the purpose limitation of consent was introduced by GDPR rather than the new health research regulations. Thus, consent for unspecified future purposes (or blanket consent) is not valid under GDPR. Arguably, the wording used in regulation 3(1)(e) is slightly broader than that used in GDPR. 

The authors highlight the burden of re-consenting for both researchers and data subjects. While there is no doubt that this is a burden on researchers in the short to medium term particularly where research is ongoing, the authors do not support their contention that all or even most data subjects do not wish to be contacted again to be re-consented. Also, it ignores the viewpoint of other data subjects who may wish to be re-consented. In this regard, it should also be borne in mind that the right to privacy, while not absolute, is a right under the Irish Constitution and is also an international human right. Consequently, strong arguments supported by evidence are required when proposing to limit fundamental personal rights for the greater societal good.  

The authors also highlight the issue of consenting individuals who's capacity to consent is impaired. The authors refer to the Assisted Decision-Making (Capacity) Act 2015 which was enacted in December 2015. It is noted, that while this Act has indeed been enacted, it is not yet commenced and it is not known when this will occur.  

I think this open letter initiates a very worthwhile discussion on the operation of the new health research regulations. It highlights legitimate concerns on the part of many stakeholders in the health research process (including patient advocacy groups) and highlights the need to ensure that the opinions of seldom heard voices are included in the process. It also offers practical solutions to some of the issues raised.  

Specific comments:

1. Reference 3 is not a 2018 publication, but is from 2007 which predates the introduction of the GDPR and the Health Research Regulations.  
    
2. Under the numbered paragraph 1, the authors indicate that the Regulations "make reference to "the establishment of a Health Research Consent Declaration Committee. I think this significantly understates the effect of the Regulations. The Regulations in fact establish a statutory committee which, for the first time, has the authority to legally make a consent declaration that the explicit consent of the data subject is not required. 
    
3. The authors refer to seldom heard voices - it would be helpful if the authors included the definition of this term in the open letter itself (it is noted that a definition of the term is provided in the associated reference).
    
4. Under the numbered paragraph 2, the authors request that the Health Research Consent Declaration Committee develop a "suite of short accessible participant information templates ...". While this is a positive and worthwhile suggestion, it should be noted that it is not part of the statutory responsibilities of the Consent Declaration Committee.

This is a timely letter and a clever use of this open-access platform. The points are clearly made and are reflective of many of the current concerns of the Irish health research community, including patients and their representatives. It is a valuable addition to the discourse on the need to achieve balance between protecting health data privacy and ensuring the progression of health research. 
 
Unless the authors have strong reasons for not doing so, I suggest shortening the name of the regulations, in the article title and abstract, to what will become their common use name, the Health Research Regulations, so as not to lose the reader at the first hurdle. The full name can be provided in the introduction.

Below, I briefly comment on each of the five issues raised by the authors, along with some minor suggestions for improvement.
 
Issue 1. Consent Declaration and the Establishment of The Health Research Consent Declaration Committee
It is welcome that the Department of Health have indicated that patient and public voices will be included in this committee and that training for those individuals will be provided. The letter valuably points to the fact that the inclusion of diverse and seldom heard voices in this committee will be a challenge to achieve and requires consideration. It would be valuable for groups like the Executive Committee of UCD PPI Ignite, patient groups and medical research charities to support the Department of Health in reaching sensible and practical solutions. The importance of such a collective effort could perhaps be alluded to in the letter.
 
Issue 2. Co-designed agreed national participation information leaflet Templates
The authors make the welcome point that template patient/participant information leaflets, developed with the involvement of patient, public and seldom heard voices, would be worthwhile. I would caution however that this task might be outside the scope of the Health Research Committee, which will have a heavy workload (especially in the early days) and will be made up of people with other jobs and roles. It is possible that the HRB-supported secretariat to this committee might be in a position to undertake this task but I would encourage the authors to think broadly about what other groups or agencies might be involved in achieving this and what additional resourcing might be required.
 
Issue 3. Conflict between open data, data sharing and purpose-bound consent
As proposed by the authors, clarification on how to balance the need for data privacy with the FAIR data principals, would be welcome. It is worth noting in the letter however, that in those cases where the anonymisation of health data is possible, the application of the FAIR principals should still be achievable.

Issue 4. The burden of re-consenting
As the authors highlight, re-consenting research participants in the cases of large studies or historical data is likely to prove burdensome on both the researchers and participants. None-the-less, the letter should acknowledge that it is important to encourage researchers to give proper consideration to re-consenting and how that might be achieved. While it is not necessary to note in this letter, in cases where this is very difficult or impossible, hopefully a common-sense approach will be arrived at, by both the research community and the Consent Declaration Committee. Such a common-sense approach might involve including the perspectives of representatives of the research participants, in decision-making at the research group level.  

Issue 5. Linking the regulations with the Assisted Decision-Making (Capacity) Act 2015
The authors make the valid point that, as there is increased focus on the need for explicit consent by patients and the public for their data to be used for research purposes, so too there must be an increased focus on how to support people with impaired capacity in decision-making.
As throughout the letter, the emphasis on the need for seldom heard voices to be included in developing codes of practice on this topic is welcome and progressive.