Ensuring we involve seldom heard voices in supporting the Data Protection Act 2018 ( Section 36 ( 2 ) ) ( Health Research ) Regulations 2018

This open letter presented by the UCD PPI Ignite executive committee outlines five concerns with regard the Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018. We request that that Department of Health outline a process as to how seldom heard voices will be involved in the Consent Declaration committee and request that national participation information leaflet templates are co-designed. We request for clarity as to how that act relates to the FAIR data principles and how the burden of reconsenting will be reduced. We ask that the act is linked with the Assisted Decision-Making (Capacity) Act 2015 and request the urgent development of codes of Open Peer Review


Introduction
The UCD Public and Patient Involvement (PPI) Ignite Program is actively embedding PPI in health and social care related research, education and training, professional practice and administration across UCD's structures. We are working with people who are seldom heard to develop research, education and support at UCD to include them from the start 1 .
The UCD Ignite Executive Committee (EC) is working and learning together to make PPI in health and social care research and education meaningful and effective.
At a recent meeting of the EC, discussion focused on the Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018 2 . The regulations signed into law in August 2018 outline how organisations must obtain a person's explicit consent in advance of processing personal data for health research purposes. We recognise that a number of knowledge sharing workshops and guidelines on the new regulations have occurred 3,4 .
Following review of the regulations and of the knowledge sharing initiatives, we as an EC wish to raise our concerns with regard to five specific issues.

Consent Declaration and the Establishment of The Health Research Consent Declaration Committee
The regulations make reference to the establishment of a Health Research Consent Declaration Committee that will make decisions on applications for consent declarations (a declaration that explicit consent is not required), including an appeals process. This is an important mechanism to oversee the regulations and we note that the committee is yet to be established but will comprise 15-21 members 5 .
We as an EC strongly urge that the Department of Health outline in detail how they will include public and patient organisations in the membership of this committee. More specifically we would welcome details as to how seldom heard voices will contribute to this committee and how they will be supported and resourced.
Diverse PPI involvement in this committee will be crucial to the success of the regulations. We note in particular that proposed patient information and consent forms and procedures will be lengthy and technical which may discourage many from partaking or actively exclude them, because the documentation violates accessibility and literacy considerations as noted in the literature 6,7 International research points to the need to develop standards to determine the best approach for improving consent forms and processes that are context specific 8,9 .

Co-designed agreed national participation information leaflet Templates
We request that once established, the Health Research Consent Declaration Committee develop a suite of short accessible participant information templates that are co-designed with all relevant stakeholders. These templates should be promoted and shared with all relevant research ethics committee's and be reviewed and updated frequently as illustrated by best practice from Australia 10 .
Involving diverse PPI groups and more specifically seldom heard voices is crucial in particular in assisting the development of templates to ensure it is accessible to all. It is also import to stress that the involvement of PPI groups must be adequately resourced and supported.

Conflict between open data, data sharing and purpose-bound consent
Health Research Regulation 3(1)(e) provides that explicit consent from the individual may be obtained "for the purpose of the specified health research, either in relation to a particular area or more generally in that area or a related area of health research, or part thereof". Clarification is required on how specific consent, even in its' granular form relates to the requirement for researchers to meet FAIR (Findable, Accessible, Interoperable, Reusable) data principles, which suggest that data can be shared and used by researchers for other purposes than those covered by the initial consent. Attempting to predict future purposes for which the data may be used may thwart novel research hypotheses being tested with the use of such secondary, open data. Reconsenting for such large data sets may not be practicable or possible, particularly if considerable time has elapsed since data collection.

The burden of re-consenting
The HRB consent declaration decision tree gives direction that a researcher must attempt to contact and re-consent participants before submitting an application to the Health Research Consent Declaration Committee. This requirement places a considerable burden on researchers who currently hold large data sets that they intend using for future research projects. It has also been brought to our attention that patients and other research participants are finding the re-consent process burdensome for several reasons. For example, some will have recovered from their condition and do not wish to be reminded of that period of their lives, some may be contacted by several researchers regarding the same data in cases where the data has already been made available through an open access platform.

Linking the regulations with the Assisted Decision-Making (Capacity) Act 2015
The Assisted Decision-Making (Capacity) Act 2015 was enacted by Dáil Éireann in December 2015. The act outlines the guiding principles of the presumption of capacity 11 . The act is relevant to the Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018 act as a person with impaired capacity must be supported as far as possible in their decision making 12 .
We as an EC request that there is urgent development of codes of practice to support and integrate assisted decision-making into the regulations. We also strongly suggest that the Department of Health to engage directly with seldom heard voices in coproducing these codes ensuring they are accessible to all. These must be underpinned with ongoing education to enable a shared understanding.
We would encourage community, charity, non-governmental organisations and interested health and social care researchers to share their perspectives on the regulations. We look forward to hearing other insights and suggestions.

Data availability
No data are associated with this article.

R&D and Health Analytics Division, Department of Health, Dublin, Ireland
Peter Lennon R&D and Health Analytics Division, Department of Health, Dublin, Ireland

General comments
As the Introduction makes clear, the stated purpose of the article is to raise concerns with regard to five issues concerning the Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018.
These concerns are addressed to the Department of Health and the Consent Declaration Committee (to be appointed by the Minister) as the Regulations, commonly referred to as the Health Research Regulations, were made by the Minister for Health in August of this year. While raising legitimate issues about patient voices, especially in a health system where there has been a publicly stated intention by Government to improve patient involvement, some of the issues raised are not relevant to the Regulations. Furthermore, where the concerns are relevant to the Regulations the authors place the whole responsibility on the Department of Health or the Committee to initiate and drive the requested patient involvement. It is submitted for consideration by the authors that they take the opportunity presented by the article to frame more clearly what those initiatives might or should be and identify the range of stakeholders, both statutory and non-statutory, who might be involved in advancing this important collective agenda.
It is also suggested that the article would benefit from setting out the background to and the purpose of the Regulations -in particular that they are "suitable and specific safeguards" for data subjects as required under the General Data Protection Regulation (GDPR). Contextualising the Regulations within the broad legal framework that gave rise to them would help the reader better understand their individual and collective provisions. This framework includes the General Data Protection Regulation (GDPR) and legislation giving effect to it in Ireland including the Data Protection Act 2018 and the Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018 but it also includes the Irish Constitution and its right to privacy, the common law duty of confidentiality which is at the heart of the health professional-patient relationship and the rights of individuals in relation to their health information under the European Convention on Human Rights and the related case law of the European Court. Consent and confidentiality in relation to personal health data are very much to the fore in each of the above.
Specific comments on each of the 5 concerns raised are included below.

Issue 1: The Health Research Consent Declaration Committee -how seldom heard voices will be involved
The article outlines the importance of the Committee and its membership. It notes that no one has, as yet, been appointed to the Committee and strongly urges that the Department outline in detail how they will include public and patient organisations in the membership of this committee. It also requests details as to how seldom heard voices will contribute to this committee and how they will be supported and resourced. While there are no specific provisions on patient involvement in the GDPR, the Department of Health is strongly of the view that ensuring the voice of patients is heard when it comes to matters of personal data protection, privacy and sharing of data is essential and it is for this reason that explicit reference is made to this in the Health Research Regulations. As a natural follow-on to the Department's support for the PPI initiatives advanced by its key health research agency, the Health Research Board in recent years, and a track record of close engagement with the Medical Charities Research Group, IPPOSI and the Irish Health Research Forum, the Department is committed to including patient and public voices on the Consent Declaration Committee. However, it is clear that this is not an insignificant challenge to get right, either at the outset or over time. Since no one has been appointed yet, it is suggested that the article provides a timely opportunity to suggest tangible proposals for consideration by the Department to achieve the objective sought. Such proposals could usefully inform other research-related initiatives into the future, such as the recruitment, training and support for public and patient representation in a national system of research ethics committees.

Issue 2: Co-design of participation information leaflet templates
The second specific point requests the Health Research Consent Declaration Committee (when established) to develop a suite of short accessible participant information templates that are codesigned with all relevant stakeholders. It would be very helpful if the article could clarify who the envisaged "participants" and "all the relevant stakeholders" are. Further, while it does not appear in the Regulations that there is a direct link between the Committee and research ethics committees -apart from the requirement that applicants to the Committee have REC approval-the article's suggestion that the Committee work with RECs on its documentation might usefully have been broadened to request a two-way process where the Committee and RECs develop and harmonise their applications and operational processes, as far as possible. Again it would be helpful to set out ideas in the article on how this might be done and what it might involve. The Department has engaged with members from a large number of RECs in recent months, and it is clear that much good work is being done by REC members in drafting template information leaflets and consent forms. Perhaps institutional PPI teams could engage with their institutional RECs to advance this work in a way that maximises accessibility with transparency for data subjects.
It is also worth noting that Article 40 of GDPR encourages association and other bodies representing categories of controllers or processors to draw up codes of conduct as a way to help them apply the GDPR effectively and to allow them to demonstrate compliance. As an example of this, the Biobanking and Biomolecular Resources Research Infrastructure (BBMRI), a distributed research infrastructure of biobanks and biomolecular resources, is currently developing a "Code of Practice for Health Research" and the Department of Health welcomes this and similar developments, and encourages the active participation of researchers, institutions and those representing the voice of the patient and the public to become actively involved in these deliberations.
Finally, the fact that consent under GDPR must be freely given, specific, informed and unambiguous is not unique to Ireland, but is a Europe wide requirement (and indeed was a requirement under the previous Data Protection Directive). Therefore, there are ever increasing instances of useful guidance and templates being made available online, both in respect of consent and transparency arrangements.

Issue 3: Conflict between open data, data sharing (FAIR principles) and purpose-bound consent
The third specific point concerns what is described as a conflict between open data, data sharing and purpose-bound consent. The article references Regulation 3(1)(e) of the Health Research Regulations which sets out the requirement for explicit consent. As the article correctly states, that consent can be for the purpose of specified health research, either in relation to a particular area or more generally in that area or a related area of health research, or part thereof. The article calls for clarification on how specific consent -which is not the same as consent for a specified purpose or purposes as per the Regulations -"relates to the requirement for researchers to meet FAIR (Findable, Accessible, Interoperable, Reusable) data principles".
The first important point to make is that the purpose limitation of consent was introduced by the GDPR rather than the Health Research Regulations, so the issue raised by the authors is one that needs to be addressed at a European and global level, and not just in Ireland.
Secondly, the Department, working with the HRB, remains committed to ensuring that the research it funds is as open, accessible and usable as possible so it can have the greatest impact. The benefits from opening up research data for scrutiny and reuse are potentially very significant including economic growth, increased resource efficiency and securing public trust in research. The development of the FAIR principles, the focus on Open Science by the EU Commission and the establishment of the EU High Level Expert group, the Open Science Policy Platform, are all to be welcomed. However, while the FAIR principles have pointed a way forward for facilitating data sharing more systematically, it is important that ethical, legislative, methodological, and organisational challenges are addressed as well. How the different considerations should be interpreted and weighed together will likely remain the subject of discussion and debate for some time to come, not least at groups such as the Open Science Policy Platform. Endeavours in this area, such as the drafting of a code of conduct led by BBMRI-ERIC, are much to be welcomed in this respect as a means of ensuring that all the necessary partners input to the deliberations. In particular, the voice of the public and the patient will be important in these discussions as it could be argued that the FAIR data principles seem at variance with the general theme of the article that patient voices should be heard if the idea being proposed is that data can be shared and used by researchers for other purposes than those covered by the initial consent. It is submitted that it is important that the article reconciles that apparent inconsistency which arises again in another guise in the next specific point.

Issue 4: The 'burden"' of reconsenting
The fourth specific point relates to "the burden of re-consenting" individuals regarding the further processing of their personal data for health research purposes. The burden appears to be two-fold falling on both the researcher and the data subject. It is stated that "a researcher must attempt to contact and re-consent participants before submitting an application to the Health Research Consent Declaration Committee".
It would be important for the article to point out that no one is being required to go to the Committee. The Consent Declaration process is an innovation in Irish law to facilitate important health research that might otherwise not be undertaken or continued but it is only available in certain and limited circumstances when it is not possible to hear the voice of the data subject/s through consent or re-consent or where anonymization is not a feasible solution.
Further and importantly, the need to re-consent was not created by the Health Research Regulations but by the GDPR itself. That requirement was referenced in the Article 29 Working Party Guidelines on Consent under Regulation 2016/679 (April 2018) which advised that "if a controller finds that the consent previously obtained under the old legislation will not meet the standard of GDPR consent, then controllers must undertake action to comply with these standards, for example by refreshing consent in a GDPR-compliant way". It seems reasonable to anticipate that reconsent is likely not to be required in the vast majority of instances for the use of data collected prior to 25 May 2018 provided that the way consent was previously given is in line with the conditions of GDPR. The focus here rests on whether the older consents meet the requirements for consent under the GDPR-freely given, informed, specific and unambiguous by a clear statement or affirmative action of consent. Older consents meeting these requirements are likely to be considered valid, even when the data privacy notification was not originally included.
Therefore, the article might helpfully make the point that the Regulations actually provide a lawful mechanism for ongoing research to continue-through the Consent Declaration Committee-which otherwise might have had to cease.
As for the burden that re-consenting places on data subjects, no concrete evidence is offered and the higher standard of consent required in the GDPR is designed to increase patients' rights to be heard in relation to their personal data which is the main focus of the article. It is worth noting that in their formal position paper on the GDPR, the European Patient's Forum welcomed the notion of explicit consent for the processing of sensitive data, they stressed that inactivity cannot be considered as consent and they welcomed the right of the data subject to withdraw their consent. They also acknowledged that the GDPR provided for the processing of identifiable data without consent in exceptional cases but stated that "while asking for consent may represent an excessive burden in certain exceptional cases, we believe that the current provisions are too vague and need to be more detailed. The need to lift consent should be assessed on a case by case basis. Patient representatives should be involved in examining these cases". This is provided for through the Consent Declaration Committee in Ireland. Furthermore, the EPF highlighted that "consent forms should be clear about potential future use of patients' data. Patients should be informed of the possibility that their data may be re-used, and it should be clarified if by giving their consented they agree to the re-use of their data by the same research team for the continuity of the study, or broader consent for secondary use by other researchers and/or for other purposes. If the original consent form is not clear on the future use of patients' data, then consent should be as a rule sought again".

Issue 5: Linking the Health Research Regulations with the Assisted Decision-Making (Capacity) Act 2015 and development of codes of practice
The fifth point relates to linking the Health Research Regulations with the Assisted Decision-Making (Capacity) Act 2015. While there is no question that capacity to consent is important in the context of the Regulations' requirement for explicit consent, it is suggested that the article should set out the broader backdrop to this issue.
First, the relevant provisions in the Assisted Decision-Making (Capacity) Act 2015 -which as the article correctly states outlines the guiding principles of the presumption of capacity-have not, as yet been fully commenced. Second, since it is the stated view of the Data Protection Commission that informed consent was required prior to the Regulations, it is not the Regulations that have created difficulties with capacity to consent in processing personal data for health research. Further, as the Regulations are secondary legislation and the consent related provisions in the 2015 Act are primary legislation not yet commenced the legislative ability of the Minister to include provisions on capacity to consent in the Health Research Regulations was limited. However, it is the case that the Department of Health have already publicly stated that they are actively seeking to work with others to prepare best practice guidance in this area for the purposes of matters covered by the Health Research Regulations. The article could helpfully set out what some ideas on what might be included in that guidance.

Does the article adequately reference differing views and opinions? Partly
Are all factual statements correct, and are statements and arguments made adequately supported by citations? Partly

Is the Open Letter written in accessible language? Yes
Where applicable, are recommendations and next steps explained clearly for others to follow? Partly Competing Interests: Both referees were involved in the drafting of the Health Research Regulations on behalf of the Minister for Health and will provide support for the establishment and subsequent operations of the Consent Declaration Committee.
We confirm that we have read this submission and believe that we have an appropriate level of expertise to confirm that it is of an acceptable scientific standard, however we have significant reservations, as outlined above. a) The authors seek clarification on how the new statutory consent declaration committee will involve public and patient representation. In particular, how will the committee take into account the opinions of seldom heard voices? b) The authors are concerned that patient information leaflets and consent forms will be lengthy and complicated and will discourage patient participation. They request that a suite of templates are co-designed by the consent declaration committee in conjunction with all relevant stakeholders. c) The authors seek clarification in respect of how the new regulations will interface with FAIR data principles (which promote findable, accessible, interoperable and reusable data principles) d) The authors are concerned that the process of re-consenting is burdensome on both data subjects and researchers. e) The authors note that, where a data subject has impaired capacity, the new regulations will interact with the Assisted Decision-Making (Capacity) Act 2015 and they request the development of codes of practice to support and integrate assisted decision-making into the regulations.

Overall Comments:
This open letter raises important practical points regarding the implementation of the Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018. In particular, the authors emphasise the importance of including the opinions and viewpoints of the public and patient representatives including those of seldom heard voices.
These points are clearly articulated and the authors propose recommendations where possible.
When considering the health research regulations, it is important to remember that the requirement for explicit consent is not new. The previous 1995 Data Protection Directive also required consent to be freely given, specific, informed and unambiguous and this should already be a part of good health research practice.
Although the authors highlight their concern that regulation 3(1)(e) restricts the re-use of data under the FAIR principles, it is important to note that the purpose limitation of consent was introduced by GDPR rather than the new health research regulations. Thus, consent for unspecified future purposes (or blanket consent) is not valid under GDPR. Arguably, the wording used in regulation 3(1)(e) is slightly broader than that used in GDPR.
The authors highlight the burden of re-consenting for both researchers and data subjects. While there is no doubt that this is a burden on researchers in the short to medium term particularly where research is ongoing, the authors do not support their contention that all or even most data subjects do not wish to be contacted again to be re-consented. Also, it ignores the viewpoint of other data subjects who may wish to be re-consented. In this regard, it should also be borne in mind that the right to privacy, while not absolute, is a right under the Irish Constitution and is also an international human right. Consequently, strong arguments supported by evidence are required when proposing to limit fundamental personal rights for the greater societal good.
The authors also highlight the issue of consenting individuals who's capacity to consent is impaired. The authors refer to the Assisted Decision-Making (Capacity) Act 2015 which was enacted in December 2015. It is noted, that while this Act has indeed been enacted, it is not yet commenced and it is not known when this will occur.
I think this open letter initiates a very worthwhile discussion on the operation of the new health research regulations. It highlights legitimate concerns on the part of many stakeholders in the health research process (including patient advocacy groups) and highlights the need to ensure that the opinions of seldom heard voices are included in the process. It also offers practical solutions to some of the issues raised.

Specific comments:
Reference 3 is not a 2018 publication, but is from 2007 which predates the introduction of the GDPR and the Health Research Regulations.

1.
Under the numbered paragraph 1, the authors indicate that the Regulations "make reference to "the establishment of a Health Research Consent Declaration Committee. I think this significantly understates the effect of the Regulations. The Regulations in fact 2.
concerns that ethics procedures in particular will run many pages and will, therefore, exclude seldom heard voices to take part in research and would urge the development of short templates as advanced in other countries. As a committee, we would be delighted to be involved in any way possible. Regards, Éidín I would caution however that this task might be outside the scope of the Health Research Committee, which will have a heavy workload (especially in the early days) and will be made up of people with other jobs and roles. It is possible that the HRB-supported secretariat to this committee might be in a position to undertake this task but I would encourage the authors to think broadly about what other groups or agencies might be involved in achieving this and what additional resourcing might be required.

Issue 3. Conflict between open data, data sharing and purpose-bound consent
As proposed by the authors, clarification on how to balance the need for data privacy with the FAIR data principals, would be welcome. It is worth noting in the letter however, that in those cases where the anonymisation of health data is possible, the application of the FAIR principals should still be achievable.

Issue 4. The burden of re-consenting
As the authors highlight, re-consenting research participants in the cases of large studies or historical data is likely to prove burdensome on both the researchers and participants. None-theless, the letter should acknowledge that it is important to encourage researchers to give proper consideration to re-consenting and how that might be achieved. While it is not necessary to note in this letter, in cases where this is very difficult or impossible, hopefully a common-sense approach will be arrived at, by both the research community and the Consent Declaration Committee. Such a common-sense approach might involve including the perspectives of representatives of the research participants, in decision-making at the research group level.

Issue 5. Linking the regulations with the Assisted Decision-Making (Capacity) Act 2015
The authors make the valid point that, as there is increased focus on the need for explicit consent by patients and the public for their data to be used for research purposes, so too there must be an increased focus on how to support people with impaired capacity in decision-making. As throughout the letter, the emphasis on the need for seldom heard voices to be included in developing codes of practice on this topic is welcome and progressive.

Does the article adequately reference differing views and opinions? Partly
Are all factual statements correct, and are statements and arguments made adequately supported by citations? Yes

Is the Open Letter written in accessible language? Yes
Where applicable, are recommendations and next steps explained clearly for others to follow? Yes different organisations' perspectives on the regulations. The recommendations and next steps could be more persuasive if the authors considered offering a specific mechanism for sharing of perspectives such as a PPI event or survey of representatives of seldom heard voices. Furthermore, the authors might consider offering to help the Department of Health in reaching seldom heard voices to include on the Consent Declaration Committee and to participate in the development of participant information templates.

Does the article adequately reference differing views and opinions? Partly
Are all factual statements correct, and are statements and arguments made adequately supported by citations? Partly

Is the Open Letter written in accessible language? Yes
Where applicable, are recommendations and next steps explained clearly for others to follow? Partly