Processing of Personal Data (Secondary Processing) (secondaryprocessing)

L.N. 263 of 2019

HEALTH ACT

(CAP. 528)

Processing of Personal Data (Secondary Processing)

(Health Sector) Regulations, 2019

IN EXERCISE of the powers conferred by articles 27 and 30 of

the Health Act, the Minister for Health, after consultation with the

Data Protection Commissioner, has made the following regulations:-

(1) The title of these regulations is the Processing of

Personal Data (Secondary Processing) (Health Sector) Regulations,

2019. (2) The objective of these regulations is to regulate the further

processing of personal data in the health sector, hereinafter referred as

"secondary processing" which is not linked to the primary purpose for

which the data was originally collected.

(3) The provisions of these regulations shall be read in

conformity with the provisions of the Data Protection Act and the

provisions of Regulation (EU) 2016/679 of the European Parliament

and of the Council of 27 April 2016 on the protection of natural

persons with regard to the processing of personal data and on the free

movement of such data, and repealing Directive 95/46/EC, hereinafter

referred to as the "General Data Protection Regulation.".

In these regulations, unless the context otherwise requires

"health care professional" means any health care professional

regulated by the Health Care Professions Act;

"non-governmental organisation" means a voluntary organisation,

as recognised by the Ministry for Health, and which has been enrolled

with the Commissioner for Voluntary Organisations under the

Voluntary Organisations Act.

For the purposes of these regulations, the "data controller",

referred to under the General Data Protection Regulation, shall also

include the Chief Executive Officer of entities providing a healthcare

service to patients, including but not limited to residential services to

such patients within the Ministry for Health but not solely, or such

other officer appointed by the respective Ministry to be responsible for

such entity under such Ministry;

"pseudonymisation" means the processing of personal data in

such a manner that the personal data can no longer be attributed to a

specific data subject without the use of additional information,

provided that such additional information is kept separately and is

subject to technical and organisational measures to ensure that the

personal data are not attributed to an identified or identifiable natural

person.

Secondary processing of personal data in the health sector Secondary

processing of

shall be permitted where such secondary processing is related to -

personal data.

(a) the processing and analysis of records kept by all

entities falling within the ambit of the health sector, and the

administration of the systems and services by entities, which

entities are licensed to deliver any kind of service to patients or

individuals, for the purpose of managing and enhancing the

health service;

(b) the analysis of health records supplied to the Ministry

for Health in accordance with licensing legislation, contractual

obligations, compliance with EU regulations on public health

statistics and to safeguard other public health interests, to

produce the indicators required for monitoring, to ensure the

quality and cost effectiveness of the health services at national

level;

(c) the monitoring of contractual obligations, including

the purposes of quality control, management information and

monitoring of such services and systems, arising from the public-

private partnerships and partnerships with non- governmental

organisations which the Ministry for health has entered into with

third parties, to ensure that the afore-mentioned partners are

adhering to their contractual obligations to deliver a safe and

accessible service;

(d) the fulfilment of the obligations related to the

provision of statistical information, whether to international

organisations or local clients; this may involve the linkage of

existing administrative databases and disease registers;

(e) the compilation of evidence in medico-legal cases

and in cases referred by public bodies, in the course of exercising

their duties as provided by law;

(f) the investigation and monitoring of health threats,

which typically requires the processing of health record data for

the protection of public health; and

(g) access to health records, for the purpose of research

activities.

In pursuance of regulations 3(c) and 3(g), personal data

may be processed where the research activities are in the public

interest. Where such processing cannot be conducted using

anonymised data, it is only permissible subject to the following

conditions

(a) following approval by the Health Ethics Committee

within the Ministry of Health, where the research activity is

conducted within the Ministry for Health or its partners, and

after obtaining prior authorisation from the Commissioner for

Data Protection in terms of article 7 of the Data Protection Act;

(b) following approval by any other Ethics Committee

recognized by the Information and Data Protection

Commissioner where the research activity is conducted by

academics or students, or any other NGO or public body having

the remit to assist patients in need for health services, and after

obtaining prior authorisation from the Commissioner for Data

Protection in terms of article 7 of the Data Protection Act

Provided that processing of such data is conducted

using pseudonymised data, and where this is not possible

appropriate measures are taken to safeguard the rights and

fundamental freedoms of the data subject by providing that data

should be anonymised as soon as the research or the statistical

study no longer requires identifiable data.

In all other cases, processing health records for a n y

p u rpose other than that pursuant to regulation 3, shall require the

consent of the data subject concerned as provided for in the General

Data Protection Regulation.

€0.27