Privacy notice for reports of wrongdoing under the Protected Disclosures Act

The HPRA may receive reports of wrongdoing from directly from reporting persons or through other Prescribed Persons or the Office of the Protected Disclosures Commissioner.

What information do we process?

The HPRA may process personal data when a report of wrongdoing is made, such as the name, address, email address, phone number, job title, signature, etc., of the reporting person. If a report is made by phone, the call may be recorded or a transcript of the call may be taken. The HPRA may be given personal data relating to others, such as contact details, opinions or information about their actions. The HPRA may also take minutes from meetings which may contain personal data.  

Legal basis for processing

The legal basis for the processing is Article 6(1)c of the GDPR which states processing is necessary for compliance with a legal obligation to which the HPRA is subject.

 The relevant legislation relied on is the Protected Disclosures Act, 2014, as amended (hereafter referred to as ‘the Act’).

Personal data is processed in accordance with the provisions of Data Protection Act 2018, Regulation (EU) 2016/679, Directive (EU) 2016/680 and Regulation (EU) 2018/1725.

How is your information processed and shared?

The reporting person’s personal data may be shared with other Prescribed Persons or the Office of the Protected Disclosures Commissioner, as required under the Protected Disclosures Act, or with other bodies such as An Garda Síochána if criminal activity is discovered, etc. All reasonable steps will be taken to protect the identity of a reporting person and to ensure the report is treated in confidence in line with the provisions of the Act. The HPRA will not disclose the identity of the reporting person, however if a decision or action is required which may directly or indirectly identify the reporting person, they will be consulted in advance that this may occur, unless there are certain prescribed circumstances not to do so (as defined in the Act).

 The HPRA uses third party service providers and suppliers (also known as data processors) to carry out both our regulatory functions and other related matters. These third parties process personal data on behalf of the HPRA and appropriate arrangements are in place with them to protect personal data.

Relevant personal data gathered under the Protected Disclosures Act is retained permanently. Data is periodically reviewed and, if found not to be required, is deleted after two years.

 The HPRA fully respects your right to privacy and treats all personal information with the appropriate standards of security and confidentiality, strictly in accordance with data protection legislation.  

What are your rights under data protection law?

Data protection law provides you with the following rights regarding the processing of your personal data:

  • The right to request access to your data
  • The right to request your data be rectified or erased if it is inaccurate
  • The right to request processing of your data be restricted
  • The right to lodge a complaint to the Data Protection Commission

Note that your rights under data protection law may be restricted in some cases in accordance with Section 16B of the Act, as allowed under Article 23 of the GDPR.

Restrictions may apply where it’s necessary to:

  • safeguard general public interest
  • protect others
  • prevent or address attempts to hinder reporting or impede, frustrate or slow down follow-up or find out the identity of reporting persons
  • prevent the disclosure of information that might identify a reporter
  • prevent effective follow up of the disclosure being prejudiced

How to contact us

For more information or to make a request regarding your personal data under data protection law, please submit your request in writing or via email to:

Data Protection Officer
Health Products Regulatory Authority
Kevin O'Malley House,
Earlsfort Centre,
Earlsfort Terrace,
Dublin 2

Tel: +353 (1) 676 4971
Fax: +353 (1) 676 7836
Email: dataprotectionofficer@hpra.ie

Please provide sufficient information in your request to enable us to deal with your query. Further information regarding data protection at the HPRA can be found in our main data protection or privacy notice.