A DATA EXPERT has warned that the Department of Children may be at odds with EU regulations if it does not directly give survivors of Mother and Baby Homes copies of their medical records.
Minister for Children Roderic O’Gorman wants new data protection regulations to be implemented so survivors can be granted access to their health records without the involvement of a GP.
However, solicitor Simon McGarr has said that introducing new regulations is not necessary because General Data Protection Regulation (GDPR), as a regulation in EU law, supersedes domestic legislation.
McGarr told The Journal that if the minister does not disapply regulations at national level that impede the application of GDPR, his department would be in breach of EU law.
Survivors of Mother and Baby Homes have in recent months been requesting access to personal information, including medical records, held by the Department of Children, Equality, Disability, Integration and Youth (DCEDIY).
The DCEDIY became the data controller for records held by the Commission of Investigation into Mother and Baby Homes after the Commission dissolved at the end of February.
Under Article 15 of GDPR, people have a right to submit Subject Access Requests (SARs) if they wish to be given a copy of any of their personal information which is being processed by those in control of it.
But survivors of Mother and Baby Homes have been asked to nominate a GP or other doctor who will receive their medical records and then decide whether or not it is appropriate to pass on to them.
A spokesperson for the DCEDIY told The Journal that O’Gorman “acknowledges the difficulties created by the requirement, and is working with Cabinet colleagues to address it”.
“The Minister has written to relevant Government colleagues to raise the making of new regulations as a matter of urgency. The making of new regulations continues to be a priority for the minister and his department.”
Documents released to the Clann Project – which advocates on behalf of survivors – via a Freedom of Information request show how staff in the department believe that a medical practitioner needs to be involved in the process of having health records released to survivors, under the Data Protection (Access Modification) (Health) Regulations, 1989 .
The DCEDIY spokesperson said: “A data controller who is not a health professional is required to consult with an appropriate health practitioner before supplying any health data to the data subject concerned.
“The department, as a data controller, must apply the regulations when records contain health data. The regulations do not enable the exercise of any discretion by the data controller and require consultation with an appropriate health practitioner in all cases.”
However, legal experts including McGarr have claimed that this approach is incorrect because of GDPR.
The Court of Justice of the European Union (CJEU) previously ruled that bodies are “obliged to adopt all the measures necessary to ensure that EU law is fully effective, disapplying if need be any national provisions or national case-law that are contrary to EU law”.
“This means that those bodies, in order to ensure that EU law is fully effective, must neither request nor await the prior setting aside of such a provision or such case-law by legislative or other constitutional means,” the ruling continued.
McGarr said, as data controller, it is O’Gorman’s “obligation to set aside the national law that is incompatible, that’s what [the CJEU] says”.
Advice from the Attorney General
O’Gorman wrote to Justice Minister Heather Humphreys on 1 June to discuss his concerns about the impact of the 1989 regulations – which fall under the remit of the Department of Justice.
Humphreys responded on 10 June. In her letter, she referred to the possibility of making new regulations under section 60 of the Data Protection Act 2018.
The DCEDIY spokesperson said Humphreys also noted that making new regulations would require “consultation with other relevant Ministers as may be appropriate (such as, for example, in this instance, the Minister for Health as the Regulations concern access to health data)”.
But McGarr says that none of this would be possible under EU law.
“The Minister for Justice can’t disapply regulations on behalf of [the Minister for Children] because she doesn’t have the power to enforce the EU law – that’s his job as a data controller. And he doesn’t have the power to change her regulation,” he said.
“So even if he brought a new regulation, he can’t repeal the other one. What are they going to do, have two contradictory regulations in place? Of course not.
“Therefore, the only way forward is to follow the obligations under EU law and disapply the regulation that’s there, and that’s for the minister to do himself.”
Minister O’Gorman also sought the advice of the Attorney General and the Data Protection Commissioner when the issue arose in recent weeks.
The DCEDIY has declined to release the AG’s advice, citing “legal professional privilege”.
However, a spokesperson told The Journal: “Following that consultation, the minister’s position is that it would be preferable if new regulations were made at an early date.
“As any new regulations will apply generally to access to health data and to data controllers in both the public and private sectors, the making of new regulations will require consultation and engagement between relevant Ministers, including the Minister for Justice and the Minister for Health.”
The spokesperson added that, “what this means in practice, for the moment” is that non-health data is being released to people who submit SARs.
But they also said that, “to give effect to the regulations”, people are asked to provide the department with the details of their health practitioner and consent to consult them before the health data is released.
“Once the requester’s medical practitioner has reviewed the health data and has determined that it can be released, the department will release the personal data in question to the requester. The department appreciates that this regulatory requirement will delay the sharing of information, but it has committed to turning around such health data requests in as timely a manner as possible.”
A spokesperson for the Department of Justice said its officials “are available for further discussion” with DCEDIY officials on the issue.
In an email sent to DCEDIY officials in May, an official from the DPC stated that the 1989 regulations do require “consultation with a health practitioner”.
“Once the relevant medical practitioner has reviewed the personal data and has determined that it can be released, the medical practitioner can release the information themselves, or can instruct the controller, in this instance, the Department, to release the personal data in question.”
In a follow-up email, they refer to their comments as “just a statement of the text of the regulation itself”.
“This is without prejudice to any assessment that may be carried out as to whether the [regulation] in its current form impedes the right of access to an extent that it can be considered a restriction on the right of access itself and whether that restriction meets the criteria set down in Article 23 GDPR.”
The Journal has contacted the DPC for comment but had not received a response at the time of publication.
To embed this post, copy the code below on your site
have your say