Privacy notice for the HPRA website including My Alerts subscriptions

What information do we process?

We only collect information that you choose to share with us via our online forms:

  • Contact us
  • My Alerts
  • Registering for an event
  • Reporting an issue
  • Recruitment

We process personal details such as name, email address, phone number, email alert preferences, dietary preferences for events, etc.

Please refer to the separate privacy notices in place for information received under our Recruitment and Report an Issue forms. Links to these can be found in each form or via our main privacy and data protection page. 

Using your data for analytics

Your personal data may also be anonymised and used for statistical purposes, such as web analytics. This technical information will be used only by the HPRA to assist in providing an efficient and user-friendly website. These details are confined to the following items:

  • The IP address of your web server
  • The top-level domain name used (for example .ie, .com, .org, .net)
  • The previous website address from which you reached us, including any search terms used
  • Clickstream data which shows your navigation around this web site (for example pages accessed and documents downloaded)
  • The type of web browser, operating system and device you used

We will make no attempt to identify individual visitors, or to associate these technical details with any individual. It is our policy never to share technical information in respect of individual website visitors to any third party, unless obliged to disclose such information by law. For more information on our cookie policy, please visit our cookie listing page.

To unsubscribe or request your details be removed from the MyAlerts system

You can request to remove your details at any time by sending us a message via our online contact us form. Please select  ‘Other > MyAlerts query’ in the dropdown menu when prompted and we will process your request.

Legal basis for processing

The legal bases for the processing are Articles 6(1) a, c, and e of the GDPR:

  • the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
  • processing is necessary for compliance with a legal obligation to which the controller is subject;
  • processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
A list of relevant legislation outlining our responsibilities can be found under the relevant areas on this website.

The legal basis for processing of special category data (e.g. data related to health) is Article 9(1)i of the GDPR:

  • processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy

or Article 9(1)a in some circumstances

  • the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject

How is your information processed and shared?

Where required, any personal information you provide may be made available to other regulatory bodies in Europe and third countries to fulfil our regulatory functions. Personal information is also shared with a third party when you make online payments to the HPRA. We also co-operate with and may share data with An Garda Siochána, The Revenue’s Customs Service, and with other national and international counterparts and official bodies as required.

The HPRA uses third party service providers and suppliers (also known as data processors) to carry out both our regulatory functions and other related matters. These third parties process personal data on behalf of the HPRA and appropriate arrangements are in place with them to protect personal data.

All personal data relating our regulatory functions are kept permanently.

We fully respect your right to privacy and treat all personal information with the appropriate standards of security and confidentiality, strictly in accordance with data protection legislation.

What are your rights under data protection law?

Data protection legislation provides you with the following rights regarding the processing of your personal data:

  • the right to withdraw your consent to processing based on this legal basis at any time. Note the withdrawal of consent does not affect the lawfulness of processing based on this consent before its withdrawal.
  • the right to request access to your data
  • the right to request your data be rectified or erased
  • the right to request processing of your data be restricted
  • the right to request data portability
  • the right to lodge a complaint with the Data Protection Commission

How to contact us

For more information or to make a request regarding your personal data under data protection law, please submit your request in writing or via email to:

Data Protection Officer
Health Products Regulatory Authority
Kevin O’Malley House,
Earlsfort Centre,
Earlsfort Terrace,
Dublin 2
Tel: +353 (1) 676 4971
Fax: +353 (1) 676 7836
Email: dataprotectionofficer@hpra.ie

Please provide sufficient information in your request to enable us to deal with your query.

Further information regarding data protection at the HPRA can be found in our main privacy notice.