Data Protection Notice –  Serious Adverse Reaction/Event reports for blood and blood components

The HPRA has been designated as the competent authority for the purposes under the blood legislation. The data controller is the HPRA unless otherwise specified.  

What information do we process?

While the HPRA is the competent authority for implementation of legislation relating to blood and blood components, the National Haemovigilance Office (NHO) provides assistance to the HPRA through the continued collection, collation and evaluation of Serious Adverse Reactions (SARs) and Serious Adverse Events (SAEs), as provided for in Statutory Instruments 360 of 2005 and 547 of 2006 and associated EU legislation. These SAR and SAE reports are then notified to the HPRA by the NHO.

Some of the information in these reports will comprise patient personal data such as age and sex. Reports will also include what are called ‘special categories’ of personal data, in particular, health data, such as the a patient’s medical history and the effects experienced. 

It is not expected that any identifiable personal data of patients will be collected by the HPRA. While information such as the sex, age and health data may be collected, it is not anticipated that this information, alone or in combination with other information available to the HPRA, will identify any individual.  

The HPRA also collects personal data of the reporter submitting these reports. This information comprises contact details of the reporter, and is collected as part of the process for notifying reports by the NHO.  

Legal basis for processing

The legal basis for processing of personal data in adverse reaction reports is firstly, Article 6(1)(c) of the General Data Protection Regulation (GDPR), which states:
Processing is necessary for compliance with a legal obligation to which the controller is subject.
Secondly, in terms of special categories of personal data, the HPRA relies on Article 9(2)(i) of GDPR, which states:
Processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy.

The HPRA is legally obliged to process notifications of SARs and SAEs related to blood and blood components under the Directives 2002/98/EC and 2005/61/EC and the Statutory Instruments 360 of 2005 and 547 of 2006. 

How is your information processed and shared?

Reports are recorded and stored in the HPRA. The personal data gathered is not shared with any other bodies. The personal data collected by the HPRA is not transmitted to third countries by the HPRA. 

In accordance with the legislative requirements, the HPRA submits an annual notification of summary data to the European Commission each year. This notification includes information relating to the above reports occurring in Ireland and which have been notified to the HPRA. This report contains only aggregated data with no individually identifiable information included.

The data is retained indefinitely. 

The HPRA fully respects your right to privacy and treats all personal information with the appropriate standards of security and confidentiality, strictly in accordance with data protection legislation.  

What are your rights under data protection law?

Data protection legislation provides you with the following rights regarding the processing of your personal data:
- the right to request access to your data
- the right to request your data be rectified or erased
- the right to request processing of your data be restricted 
- the right to lodge a complaint with the Data Protection Commission

Further information

To make a request regarding your personal data under data protection legislation, please submit your request in writing or via email:

Data Protection Officer
Health Products Regulatory Authority 
Kevin O’Malley House, 
Earlsfort Centre
Earlsfort Terrace
Dublin 2
Tel: +353 (1) 6764971
Fax:+353 (1) 6767836
Email: dataprotectionofficer@hpra.ie 

Please ensure that you describe the records you seek in the greatest detail possible to enable us to identify the relevant records. The HPRA must confirm within one month if data is held and if so, the description of the data and the purposes for which they are kept. The Irish supervisory authority for data protection is the Data Protection Commission. They may be contacted here. Details of your entitlement to complain to the Data Protection Commission will be included in the decision letter or email.

Further information regarding data protection at the HPRA can be found here.