S.I. No. 145/2026 - Data Protection Act 2018 (Section 38(4)(b)) (Scoping Exercise in Response to Requests from Dignity4Patients) Regulations 2026

1. Background

1.1. The Government, at its meeting of 26 November 2025, agreed, at the request of the Minister for Health (the “

Minister

”) that a scoping exercise be undertaken by a facilitator in response to requests from Dignity4Patients on behalf of victims and survivors of Michael Shine.

1.2. The Minister has appointed Lorcan Staines SC (the “

Facilitator

”) to conduct the review.

2. Scope of Exercise

2.1. The Facilitator shall meet with “Dignity4Patients”, the representatives of the victims of Michael Shine, and any of the individual victims that the Facilitator deems necessary in order to assess and consider what steps and/ or actions may be appropriate.

2.2. In this context the Facilitator shall consider the information and request from Dignity4Patients in its paper of 30 June 2025 provided to the Minister entitled

“What do children and young people who were victims of sexual abuse at the hands of former surgeon & convicted sexual offender Michael Shine want from a statutory inquiry/investigation?”

2.3. The Facilitator will consider all relevant documentation and seek such court judgments and other documentation, or other evidence, as is required for the scoping exercise to be completed. This documentation will include the Report of the Independent Review Group established by the Board of the International Missionary Training Hospital, Drogheda and chaired by Dr. Miriam Hederman O’Brien dated June 1996, and the Report authored by Mr. Justice Thomas Smyth.

2.4. The Facilitator shall consider the Report of Mr. Justice Smyth and shall make a recommendation as to whether it should be published (which recommendation shall be subject to the provision of legal advice to the Minister for Health).

2.5. The Facilitator shall make recommendations to Government in relation to the next steps that may or may not be appropriate, including steps in relation to

- the roles and actions of the International Missionary Training Hospital (formerly Our Lady of Lourdes Hospital, Drogheda (the “

Hospital

”), the Medical Missionaries of Mary (the “

Congregation

”) and relevant State bodies in response to the events both during the period of Michael Shine’s employment at the Hospital and subsequently;

- The preservation, custody and treatment of relevant records.

2.6. In making the above recommendations, the Facilitator will consider previous inquiries and reports related to historic sexual abuse with a particular focus on patients in health settings and identify those areas which it would be appropriate to examine further and those which have already been addressed.

2.7. These recommendations shall include a reasoned consideration regarding any further State response and the issues that should be enquired into. This process shall include an assessment of the practical challenges arising considering the passage of time and the availability of the witnesses and of contemporaneous documentation.

2.8. The Facilitator may consider any other matters as agreed by the Minister with regard to engagement with stakeholders.

3. Timeframe

3.1. The review will be carried out as quickly as possible with a commencement date to be agreed with the aim of furnishing a written report to the Minister within 16 weeks of the date of commencement.

GIVEN under my Official Seal,

9 April, 2026.

JENNIFER CARROLL MACNEILL,

Minister for Health.

EXPLANATORY NOTE

(

This note is not part of the Instrument and does not purport to be a legal interpretation.

)

The purpose of these Regulations is to enable the commencement of the scoping exercise in response to requests from Dignity4Patients on behalf of victims and survivors of Michael Shine by providing a legislative base for the controlling and processing of personal data by the data controllers for the purposes of conducting that scoping exercise and making recommendations to the Minister in relation next steps and actions.

4. Subject to the Data Protection Regulation and the Act of 2018, the processing by a relevant person of personal data to which these Regulations apply, and which is necessary and proportionate for the performance of a relevant task carried out in the public interest by a relevant person, is hereby specified.

Circumstances in which personal data may be processed

5. Without prejudice to the generality of Regulation 4, the circumstances in which personal data to which these Regulations apply may be processed shall include the performance by a relevant person of such relevant tasks as the Facilitator considers necessary and proportionate to enable the scoping exercise to –

(a) consider the matters set out in the terms of reference, and

(b) report or make recommendations to the Minister in accordance with the terms of reference.

Persons to whom personal data may be disclosed

6. Personal data to which these Regulations apply may be disclosed to a relevant person in accordance with such policies and procedures as may be provided for under Regulation 7.

Conditions of processing

7. (1) The Facilitator shall prepare and implement policies and procedures to provide for the processing of personal data under these Regulations.

(2) Without prejudice to the generality of paragraph (1), the policies and procedures referred to in that paragraph shall provide for the following

(a) the use of secure storage, passwords, encryption and other methods to ensure personal data can only be accessed by the Facilitator or by a relevant person authorised by the Facilitator to access that data;

(b) the use of controls to ensure that personal data are only disclosed to –

(i) a relevant person, or

(ii) a person entitled or permitted by law to receive that personal data;

(c) the determination of appropriate storage periods for personal data or classes of personal data;

(d) the treatment, including erasure where relevant, of personal data or classes of personal data at the expiry of the storage periods referred to in subparagraph (c);

(e) the use of data minimisation, including the use of anonymisation and pseudonymisation where appropriate;

(f) the treatment of personal data disclosed orally or otherwise during meetings or private sessions, including circumstances in which such treatment constitutes processing for the purposes of the Act of 2018.

(3) The Facilitator shall –

(a) review the policies and procedures referred to in paragraph (1) on a regular basis, and

(b) update those policies and procedures as the Facilitator considers appropriate.

Schedule

SCOPING EXERCISE IN RESPONSE TO REQUESTS FROM DIGNITY4PATIENTS ON BEHALF OF VICTIMS AND SURVIVORS OF MICHAEL SHINE

TERMS OF REFERENCE

Notice of the making of this Statutory Instrument was published in

“Iris Oifigiúil” of

14

th April,

2026.

I, JENNIFER CARROLL MACNEILL, Minister for Health, in exercise of the powers conferred on me by subsection (4)(b) of

section 38

of the

Data Protection Act 2018

(No. 7 of 2018) and having duly complied with subsections (4) and (5) of section 38 of that Act, hereby make the following regulations

Citation