Special categories of personal data
Part 3 Section 45 of the Data Protection Act contains specifying provisions on processing of special categories of personal data. It says the processing has to be authorized by Article 9 GDPR or Sections 41, 46-54 of the Data Protection Act. These sections give permission to process personal data for employment, health, public interest, scientific, historical research or statistical purposes.
Part 3 Section 61 of the Irish Data Protection Act provides restrictions on the exercise of data subject rights, where processing is for archiving in the public interest, scientific or historical research and statistical purposes.
Health research
So far, regulations have only been made for health research purposes. Statutory Instruments S.I. No. 314 of 2018 (http://www.irishstatutebook.ie/eli/2018/si/314/made/en/pdf) that came into effect on 8 August provides:
- a definition of health research
- for arrangements so personal data not processed in a way to cause or is likely to cause damage or distress
- for appropriate governance structures, including ethical committee approval, third party involvement, funding, etc.
- additional procedures, including initial assessment, impact assessment, limiting access to personal data, effectiveness of security measures, etc.
- Obtaining explicit consent from relevant data subjects
