What GDPR and the Health Research Regulations (HRRs) mean for Ireland: a research perspective



Irish Health Research Regulations (HRRs) were introduced following the European Union (EU) General Data Protection Regulation (GDPR) in 2018. The HRRs described specific supplementary regulatory requirements for research regarding governance, processes and procedure that impact on several facets of research. The numerous problems that the HRRs and particularly “explicit consent” inadvertently created were presented under the auspices of the Irish Academy of Medical Sciences (IAMS) on November 25, 2019, at the Royal College of Surgeons in Ireland.


The objective of this review was to obtain feedback and to examine the impact of GDPR and the HRRs on health research in Ireland in order to determine whether the preliminary feedback, presented at the IAMS meetings, was reflected at a national level.


Individuals from the research community were invited to provide feedback on the impact, if any, of the HRRs on health research. Retrospective patient recruitment and consent outside a hospital setting for a multi-institutional Breast Predict study (funded by the Irish Cancer Society) were also analysed.


Feedback replicated the issues presented at the IAMS with additional concerns identified. Only 20% of the original target population (n = 1987) could be included in the Breast Predict study.


Our results confirm that the HRRs have had a significantly negative impact on health research in Ireland. Urgent meaningful engagement between patient advocate groups, the research community and legislators would help ameliorate these impacts.


The European Union (EU) General Data Protection Regulation (GDPR) came into effect on May 25, 2018. GDPR permitted member states to introduce further protections or safeguards, with regard to personal data, including health data [1,2,3]. Ireland’s Health Research Regulations (HRRs) followed on August 8, 2018. The HRRs introduced additional regulatory requirements for health research in relation to governance, processes and procedures that impacted on several aspects of research [4, 5]. One of the requirements of the HRRs is that identified or identifiable personal data cannot be included in health research unless (a) explicit consent exists or (b) a consent declaration has been granted [1,2,3,4,5,6,7].

At a public meeting organised by the Irish Academy of Medical Sciences (IAMS), on November 25, 2019, GDPR was welcomed, yet the view was expressed that mandatory “explicit consent”, as imposed by the HRRs, was a significant impediment to conducting health research in Ireland.

Also presented were preliminary findings that the HRRs had precipitated [8] (a) huge site to site variation, because institutions had interpreted and applied the legislation differently; (b) serious concerns regarding Ireland’s ability to attract clinical trials now and into the future, due to site to site variability; (c) a go-slow in research, with some studies halted altogether due to (i) protracted decision-making on the part of institutions, (ii) immense outlay in both time and funds, required to implement GDPR and the HRRs, and (iii) difficulties navigating a new regulatory system for research.

It was felt that the common difficulties identified warranted further investigation. All feedback is presented herein. National feedback was sought to rule out institutional bias.

Lastly, an example of retrospective patient recruitment and consent for health research, outside a hospital setting, is included. The inclusion of this Breast Predict study serves as an example of the difficulties in:

  1. 1.

    Obtaining consent retrospectively outside a hospital setting, cost, staffing, response rate, attrition, patient capacity, establishing whether the patient is alive, emotional distress to patients and family members and understanding

  2. 2.

    The changing parameters around consent requirements and the difficulties posed to researchers

  3. 3.

    Divergence of opinions around consent requirements and the law

  4. 4.

    Lack of clear and consistent advice available to researchers

  5. 5.

    Difficulty applying the technical requirements of the HRRs in practice


Feedback from the research community on the HRRs

The purpose in obtaining feedback was to ascertain whether the preliminary feedback, presented at the IAMS November meeting, was reflected at a national level. This publication is not intended as an exhaustive assessment of Irish research post introduction of GDPR and the HRRs, but rather a collection of opinions from individuals attempting to navigate the new system, for the inclusion of data in research. Individuals were invited to provide information via email on any of the following: (a) general understanding of the HRRs, (b) time to obtain Research Ethics Committee (REC) approval, (c) RECs shutting down to become compliant, (d) RECs reluctance to accept external templates due to lack of nationally approved templates, e.g. patient information leaflets, (e) time outlay related to Health Research Consent Declaration Committee (HRCDC) applications and (f) Data Protection Officer (DPO) guidance. The established networks of the Irish Research Nurses Network (IRNN) and Cancer Trials Ireland were utilised to harness wider feedback.

Irish Cancer Society (ICS) Breast Predict study: recruitment outside a hospital setting

The study “Towards personalised approaches to breast cancer treatment and prevention: establishing a retrospective breast cancer cohort” was ethically approved, on August 23, 2016.

This study sought to obtain consent retrospectively from previous breast cancer patients diagnosed at St. James’s Hospital between 2004 and 2014 to take part in a Breast Predict study and also consent to their inclusion in the St James’s Hospital Histopathology Biobank (SJHHB).

The Breast Predict Consent Form and Information Leaflet were modelled on the SJHHB documentation which underwent robust review, namely [9]:

  1. i.

    Review by department of Legal and Insurance.

  2. ii.

    Legal review from an independent medical lawyer.

  3. iii.

    Review by the (then) Deputy Data Protection Commissioner, which focused particularly on the proposed method for data sharing.

  4. iv.

    Review by patient advocate group—Europa Donna Ireland.

  5. v.

    NALA (National Adult Literacy Agency) review—NALA translated the patient information leaflet (PIL) into “plain English”, ensuring that the document was simple and easy to follow.

  6. vi.

    Review by hospital research and ethics committee.

  7. vii.

    In 2018, a review of SJHHB documentation was conducted by an independent and unbiased Data Protection Consultant. Their report defined the description of “Future Research and Studies” on the consent form, as “good”, and the purpose, as “specific”.

It was decided that a research nurse (RN) was best placed to (a) contact patients and next of kin, (b) handle questions posed by respondents, (c) understand concurrent illnesses capable of impairing an individual’s capacity to consent, (d) liaise with clinical teams, where necessary. The RN was employed for a fixed term of 12 months at a cost of almost €30,000 (19.5 h per week). An introductory letter, detailing the objectives of the study, and consent form were posted. A prepaid envelope provided the means of returning the consent forms.

Results and discussion

Feedback on the HRRs

Respondents echoed feedback presented at the November IAMS public meeting [8]. Additional concerns were (a) the absence of meaningful consultation when drafting the HRRs; (b) difficulty comprehending the HRRs and confusion regarding their impact on clinical trials; (c) the requirement for Ireland only amendments to international clinical trial documentation, to reach the threshold of “explicit consent”, required by the HRRs; (d) the future of non-interventional clinical trials and critical care research in Ireland; (f) the negative impact on PhD (Doctor of Philosophy), MD (Doctor of Medicine) and ICAT (Irish Clinical Academic Training) programmes; (g) Ireland’s capacity to contribute to large international collaborative research projects; and (h) reports that the increased bureaucratic burden (ethical and HRRs related) had slowed and in some cases halted research (see Table 1).

Table 1 Quotes detailing the impact of the HRRs on health research*

Breast Predict—retrospective recruitment and consent outside a hospital setting

As per the Guide to Professional Conduct and Ethics for Registered Medical Practitioners, the Tallaght University Hospital/St. James’s Hospital (SJH) Joint Research Ethics Committee deemed that consent from the next of kin was required where possible, where patients had died [10]. The pathway for contact and consent was decided after discussions between clinicians, biobank staff and the legal team. The inclusion of GPs (general practitioners) as gatekeeper to contacting patients or their next of kin was important in attempting to establish whether clinical changes had occurred in the interim, which might affect the participants’ capacity to consent. Over 1 year, 812 patients and next of kin were contacted (Table 2). On 104 occasions, GPs advised against contact. Reasons included dementia, patient in long-term residential care and grief, or anger, at patients passing. Six hundred and fifteen (76%) of those contacted responded. Quality control of returned consent forms led to the exclusion of 22% of respondents, due to inaccurate or partial completion of forms. The section most commonly not initialled related to financial gain, i.e. I understand I will not make money if research leads to a new test or treatment. It was difficult to interpret the respondents’ opinion or concerns around “financial gain”. Did they believe that research in an academic environment is preferable to research performed by a commercial entity? This was complex to evaluate, as one of the principal aims of health research must be the identification of translational elements, which may lead to the development and delivery of novel tests or treatments, for patients. Delivering such innovation, without industrial partners, would be impossible.

Table 2 Recruitment outside a hospital setting for the Breast Predict study

Tiered consent, though valuable, inadvertently created an “all or nothing situation”, that is unless a patient, or next of kin, consented to all sections of the consent form; it was difficult to manage the inclusion of associated samples and data. From a legal perspective, especially that of “explicit consent”, it was safer to simply omit incomplete consent forms. Some of the one hundred and ten respondents excluded post quality control could potentially have been included, subsequent to follow-up. However, several issues prevented this recontact: (a) The RN’s contract had expired and the biobank lacked resources to perform this role. (b) It was unclear what level of “follow-up” would be satisfactory. It is not clear whether a written record of telephone conversations, where respondents clarified their wishes, would have satisfied the requirements of “explicit consent”. (c) The prospect of recontacting patients or their next of kin, for a second time, raised concerns. Specifically, the potential stress this may cause. It was unclear how to strike a balance to ensure the wishes of patients and their next of kin were upheld with that of an individual’s right to privacy. For example, an acceptable frequency of telephone calls and written communication could not be established.

In total, 399 patients’ samples out of a potential 1987 could be included in the study (see Table 2).This represented just 20% of the original study target. Managing tiered consent, with multiple choices, in the absence of a Biobank Information Management System (BIMS) also proved extremely difficult and costly in terms of time.

During the period of retrospective consent (October 2017 to October 2018), three distinct laws were in place: (a) Data Protection Acts 1988 and 2003, (b) GDPR and (c) GDPR and the HRRs. GDPR and the HRRs were respectively introduced at 6 and 10 months into the process [1,2,3,4,5,6,7]. Towards the end of the research nurse’s contract, it became unclear whether the retrospective consent was GDPR and HRR compliant and even were funds available, whether it would be ethical to return to patients and next of kin again. Many questions remain, namely, (i) what constitutes compliant documentation, (ii) what constitutes sufficient transparency in terms of future use of data and (iii) whether a HRCDC application is required. This is discussed in detail in the companion paper; What GDPR and the Health Research Regulations (HRRs) mean for Ireland: “explicit consent”—a legal analysis.

Participant consent has long existed as an ethical and legal requirement for the conduct of health research in Ireland [11, 12]. Therefore, the concept of “explicit consent”, as required by the HRRs, may seem reasonable. However, as a legal instrument, the prerequisite of participant “explicit consent”, as presented within the HRRs, neither encourages nor facilitates health research [3, 13]. The Patient Voice in Cancer Workshop sought to understand what information was most pertinent to participants [14]. Crucial given the level of information, researchers were encouraged to furnish participants with, in order to achieve “explicit consent” [15]. Importantly for re-consent, patients viewed information leaflets and consent forms as “companion documents”, i.e. they assumed someone would sit with patients and go through the documents [14]. Though this adds to the complexity of retrospective consent, it reinforces the need for simple, clear and patient-friendly documentation.


The findings presented at the IAMS on November 25, 2019, at the Royal College of Surgeons, Ireland, are upheld.

The introduction of legislation and standards to afford greater protection to health research participants will always be welcome. However, legislation and standards are only of value when achievable. Research infrastructure has never been prioritised in Ireland. Therefore, legislators and funding agencies must furnish the research community with the infrastructure required to achieve compliance and attain standards [16].

It is important to state that the intention of the legislators was not, in the authors’ opinion, to impede health research. Rather GDPR presented a mechanism to regulate research and simultaneously afford greater autonomy to health research participants. Inadvertently, however, the HRRs have heavily impacted on Ireland’s capacity to conduct health research, including clinical trials (both interventional and non-interventional) and caused significant damage to Irish research. It is hoped, that the findings presented herein provide sufficient grounds to prompt a review of the legislation.

The authors seek the regulation of consent in health research to a high standard. Getting data protection right in health research is important and vital to ensuring public trust of and continued support of research.


  1. 1.

    Several proposed amendments were presented at both IAMS events in an attempt to rectify some of the problems created by the HRRs. Despite this these amendments have not been enacted, and there has been no attempt by the Department of Health to set up a consultative process with IAMS to discuss these proposals. This is an obvious area which needs to be addressed.

  2. 2.

    There must be an urgent review of the HRRs GDPR “explicit consent” requirement.

  3. 3.

    The regulation of informed consent in research in line with the common law and the approach taken by other EU member states.

  4. 4.

    Meaningful dialogue and consultation between legislators and key stakeholders including IPPOSI (Irish platform for Patient Organisations, Science and Industry), patient advocate groups and the research community are urgently needed.


  1. 1.

    The EU General Data Protection Regulation (GDPR) is the most important change in data privacy regulation in 20 years.eugdpr.org. EU: c2019 [cited 20 April 2020]. Available from: https://eugdpr.org/

  2. 2.

    General Data Protection Regulation (GDPR). Recitals. Key Issues. gdpr-info.eu. EU: c2019 [cited 20 April 2020]. Available from: https://gdpr-info.eu/

  3. 3.

    Clarke N, Vale G, Reeves EP et al (2019) GDPR: an impediment to research? Ir J Med Sci 188:1129–1135. https://doi.org/10.1007/s11845-019-01980-2

    Article  PubMed  Google Scholar 

  4. 4.

    Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018. irishstatutebook.ie. Ireland:c2019 [cited 20 April 2020].Available from: http://www.irishstatutebook.ie/eli/2018/si/314/made/en/pdf

  5. 5.

    Health Research Consent declaration Committee. Hrcdc.ie. Ireland: c2019 [cited 20 April 2020]. Available from: https://hrcdc.ie/

  6. 6.

    Health Research Board Decision Tree. hrb.ie. Ireland: c2019 [cited 20 April 2020]. Available from: https://www.hrb.ie/fileadmin/user_upload/Decision_Tree_30072018.pdf

  7. 7.

    Guidance notes to support and application to process or further process personal data for the purposes of health research commencing before 8 August 2018 (re-consenting). hrcdc.ie. Ireland. c2019 [cited 20 April 2020]. Available from: https://hrcdc.ie/wp-content/uploads/2018/12/HRCDC-Guidance_Re-consenting.pdf

  8. 8.

    Woods K (2019) Researchers: consent rules put future medical trials at risk. Sunday Business Post (Ireland). Sect. A:6 (col. 1)

  9. 9.

    Mee B, Gaffney E, Glynn SA et al (2013) Development and progress of Ireland's biobank network: ethical, legal, and social implications (ELSI), standardized documentation, sample and data release, and international perspective. Biopreserv Biobank 11(1):3–11. https://doi.org/10.1089/bio.2012.0028

    Article  PubMed  PubMed Central  Google Scholar 

  10. 10.

    (2019) Guide to Professional Conduct and Ethics for Registered Medical Practitioners. 8th Edition

  11. 11.

    (1950) Declaration of Helsinki, Article 40.3 Bunreacht Na hEireann, the common law, European Convention for the Protection of Human Rights and Fundamental Freedoms, European Convention on Human

  12. 12.

    Health Service Executive (2019) National Quality Improvement Division. National Consent Policy – Quality Improvement Programmes. HSE. https://www.hse.ie/eng/about/who/qid/other-quality-improvement-programmes/consent/. Accessed 20 April 2020

  13. 13.

    Wallace R, Greene E (2020) Survey of NCHDs in Ireland to assess their views and opinions in relation to participation in health research and the impact of new Irish data protection regulations. Ir J Med Sci 189:783–789. https://doi.org/10.1007/s11845-020-02185-8

    Article  PubMed  Google Scholar 

  14. 14.

    Streamlining patient participation in health research biobanks. Patient Voice in Cancer Research. Wednesday, 9th October 2019, Cork. Available from: https://www.eventbrite.ie/e/streamlining-patient-participation-in-health-research-biobanks-tickets-71043873137#REPORT

  15. 15.

    Department of Health. Guidance on Information Principles for informed consent for the processing of personal data for health research. October 2018. Accessed 20 April 2020. Available from: https://www.hrb.ie/funding/gdpr-guidance-for-researchers/gdpr-and-health-research/

  16. 16.

    Mee B, Gaffney E, McGarrigle S et al (2016) Can a biobank network and supporting infrastructure enhance Ireland’s ability to attract pharmaceutical research and development and clinical trial opportunities? A pilot survey. J Biorepos Sci Appl Med 4:1–8. https://doi.org/10.2147/BSAM.S103837

Download references


Biobank Ireland Trust provides funding to help run the St. James’s Hospital Histopathology Biobank; Breast-Predict was funded by the Irish Cancer Society (2013–2019).

Author information




Conceptualisation: Blanaid Mee, Mary Kirwan, Niamh Clarke and Noel G Mc Elvaney

Methodology: Kathleen Bennett, Sarah Mc Garrigle, Niamh Clarke, Elisabeth Connolly and Richard Flavin

Formal analysis and investigation: Emma Halpin, Aoife Tanaka, Lino Manaloto, Eoin Gaffney, Una Gibbons, Ciaran Flanagan, Blanaid Mee, Mary Kirwan, Kathleen Bennett, Sarah Mc Garrigle and Elisabeth Connolly

Writing: including original draft preparation: Laura Tier; Niamh Clarke, Kathleen Bennett, Sarah Mc Garrigle, Elisabeth Connolly, Richard Flavin, Ann Cullen, Una Gibbons, Blanaid Mee, Mary Kirwan, Emma Halpin, Aoife Tanaka, Lino Manaloto, Eoin Gaffney, Noel G Mc Elvaney and Ciaran Flanagan

Writing: including review and editing of original draft preparation: Laura Tier; Kathleen Bennett, Sarah Mc Garrigle, Elisabeth Connolly, Richard Flavin, Ann Cullen, Una Gibbons Blanaid Mee, Mary Kirwan, Emma Halpin, Aoife Tanaka, Lino Manaloto, Eoin Gaffney, Noel G Mc Elvaney and Ciaran Flanagan

Resources: St. James’s Hospital

Supervision: Blanaid Mee, Mary Kirwan and Noel G Mc Elvaney

Corresponding author

Correspondence to Blanaid Mee.

Ethics declarations

Conflicts of interest/competing interests

Not applicable

Ethics approval


Consent to participate


Consent for publication

Not applicable

Additional information

Publisher’s note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Rights and permissions

Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article's Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article's Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/.

Reprints and Permissions

About this article

Verify currency and authenticity via CrossMark

Cite this article

Mee, B., Kirwan, M., Clarke, N. et al. What GDPR and the Health Research Regulations (HRRs) mean for Ireland: a research perspective. Ir J Med Sci (2020). https://doi.org/10.1007/s11845-020-02330-3

Download citation


  • Consent
  • Data protection
  • GDPR
  • Irish Health Research Regulation
  • Patients & Data protection