DDPO and REC Pilot

The Beaumont Hospital Deputy Data Protection Officer (DDPO) and Research Ethics Committee (REC) have been pilotting joint and parallel review of research Data Protection Impact Assessments (DPIAs) and applications for research ethics approval since January 2020. This pilot forms an important part in data governance processes for health research in the hospital.

These draft DDPO-REC Pilot Appendices (May 2021) represent knowledge gained to date.

Latest Progress on Pilot
  • The DPIA for Research and Clinical Trials was updated by the DDPO in August 2021 (and again in May 2022)- see here
  • A Checklist for researchers to self-assess data subject rights was released by the DDPO in August 2021 - see here
  • Guidance for the REC on when to refer a study to the DPO was finalised by the REC and the DDPO in September 2021 - see When should BH REC refer a study?
  • and:
  • Work commenced on deleloping 'Step by Step Guides' for Researchers in October 2021 - researchers will need to identify the data controller as the first step in each of these guides - see challenges in identifying data controllers...
  • Links to online Training material in GDPR suitable for health researchers was made available in November 2021 - see GDPR and Health Data
  • followed by:
  • a series of pilot audio recordings in February 2022 on How to submit to Beaumont Ethics Committee
  • Between April and June 2022, review of DPIAs was delegated / outsourced by the DPO for a subset of studies received for review by Beaumont REC (6 studies in total)

Ultimate responsibility for completion of the DPIA rests with the researcher who needs to retain and maintain a copy of the most up to date DPIA and make available to the DDPO, DPO or Data Protection Commission (DPC) on request.

GDPR allows Data Protection Officers to provide advice and feedback on DPIAs where this is requested.

(In the Republic of Ireland, evolving best practice is for RECs to request either a DPIA or confirmation that a DPIA is not required as part of the REC submission. The National Office of Research Ethics Committees, for example, requires that researchers provide confirmation of input from the DPO(s) affiliated to the organisation(s) which are the data controller(s) for the research study, while the HSE Reference RECs require confirmation of input from the DPO(s) affiliated to the site(s) where the study will take place. Implementing the latter practice of requiring site DPO input prior to submission to a REC is subject to resources available to site DPOs. Beaumont Hospital hopes to put a dedicated resource in place to review DPIAs from the 1st September 2022)

DPIAs need to be kept under review - see DPIA review...