Privacy Notice – Pharmacovigilance and EudraVigilance Database
The HPRA operates the national system for recording and reporting details of suspected adverse reactions occurring in Ireland which are notified in association with the use of medicines. These reports are submitted to the HPRA directly by healthcare professionals and patients. They are also submitted indirectly from pharmaceutical companies, through the European Medicines Agency’s database, known as ‘EudraVigilance’ (see below).
What information do we process?
Some of the information in adverse reaction reports will comprise personal data such as age and sex. Reports may also include what are called ‘special categories’ of personal data, in particular, health data, such as the condition being treated and the effects experienced. Please note that the contact details included on adverse reaction report forms are used solely for the purposes of interaction regarding the report submitted.
We may also seek further information from any healthcare professional(s) nominated by you for additional information, following provision of their contact details and an indication of your agreement for us to do so.
How is your information processed and shared?
Adverse reaction reports are recorded and stored on our national database. Reports are submitted by the HPRA (with personal identifiers and contact details removed) to the EudraVigilance database (a database owned and administered by the European Medicines Agency (EMA)). Partially anonymised details of reports are shared with other bodies also involved in safety monitoring of medicines, in accordance with the legislative provisions. These bodies include the World Health Organisation (WHO) and as appropriate, the company(ies) that hold the licence(s) for the medicine(s) concerned (i.e. marketing authorisation holders or ‘MAHs’) – further details are provided below. Sharing of the information you are submitting ensures that the information is available to all parties responsible for the ongoing safety monitoring of medicines.
Through these systems, adverse reaction reports are pooled with data from other countries to provide information on global safety experience with medicines. Information from these sources, together with additional safety data (e.g. from the scientific literature, cumulative safety data analysis, epidemiological studies etc.) are assessed on an on-going basis, in conjunction with our EU counterparts to consider their impact on the known safety profile of the medicine in question and any need for regulatory changes to support safe and appropriate use. Such changes could include recommendations to restrict use, or the addition of warnings to the product information for healthcare professionals and patients.
What is the legal basis for processing your information?
The legal basis for processing of personal data in adverse reaction reports is firstly, Article 6(1)(c) of the General Data Protection Regulation (GDPR), which states:
Processing is necessary for compliance with a legal obligation to which the controller is subject.
Secondly, in terms of special categories of personal data, the HPRA relies on Article 9(2)(i) of GDPR, which states:
Processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy.
As part of its statutory role in the regulation of medicines, the HPRA is legally obliged to collect adverse reaction reports to human medicines. The legal basis for such collection is Statutory Instrument 272 of 2012 and related European Union laws. The HPRA is also legally obliged to transmit details of adverse reaction reports received to the EudraVigilance Database. The EMA is an agency of the European Union and is also subject to the laws of the European Union.
The HPRA does not transmit names or contact details of individuals when providing adverse reaction reports to the EMA for inclusion in the EudraVigilance Database. The information provided includes a unique identifier number, but no names or specific locations (e.g. hospital name) are included.
However, given the nature of adverse reaction reports, in that they can comprise a variety of different forms, some information may include data that in conjunction with other information contained in the report or elsewhere, may identify individuals.
The pharmacovigilance personal data collected by the HPRA is not transmitted to third countries by the HPRA. The data is retained indefinitely. The HPRA is a data controller in respect of adverse reaction reports.
What are your rights under data protection law?
The right exists to request a copy of personal data held by the HPRA and to have any inaccuracies in such data corrected or deleted. Further details on data protection can be found here.
Further information
Further information on the EudraVigilance database and the EMA are available here: EMA & EudraVigilance.
To make a request regarding your personal data under the GDPR, please submit your request in writing or via email:
Data Protection Officer
Health Products Regulatory Authority
Kevin O’Malley House,
Earlsfort Centre
Earlsfort Terrace
Dublin 2
Tel: +353 (1) 6764971
Fax:+353 (1) 6767836
Email: dataprotectionofficer@hpra.ie
Please ensure that you describe the records you seek in the greatest detail possible to enable us to identify the relevant records. The HPRA must confirm within one month if data is held and if so, the description of the data and the purposes for which they are kept. The Irish supervisory authority for data protection is the Data Protection Commission. They may be contacted here. Details of your entitlement to complain to the Data Protection Commissioner will be included in the decision letter or email.