Privacy notice for reporting a side effect from a medicine for human use

The HPRA operates the national system for recording and reporting details of suspected adverse reactions (side effects) occurring in Ireland which are notified in association with the use of medicines. These reports are submitted to the HPRA directly by healthcare professionals and patients. They are also submitted indirectly from pharmaceutical companies, through the European Medicines Agency’s (EMA) database, known as 'EudraVigilance'. See more information under How is your information processed and shared?

What information do we process?

Some of the reports will contain personal data such as age and sex. Reports may also include what are called 'special categories' of personal data, in particular, health data, such as the condition being treated and the effects experienced. Please note that the contact details included on adverse reaction report forms are used solely to follow up with you regarding the report. If you provide us with details of your healthcare professional and permission to contact them, we may also seek further information from them regarding the report made.

Legal basis for processing

The legal basis for processing of personal data in adverse reaction reports is firstly, Article 6(1)(c) of the General Data Protection Regulation (GDPR), which states: Processing is necessary for compliance with a legal obligation to which the controller is subject.

Secondly, in terms of special categories of personal data, the HPRA relies on Article 9(2)(i) of GDPR, which states: Processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy.

As part of its statutory role in the regulation of medicines, the HPRA is legally obliged to collect adverse reaction reports for human medicines. The legal basis is Statutory Instrument 272 of 2012 and related European Union laws. The HPRA is also legally obliged to submit details of adverse reaction reports received to the EudraVigilance database. The EMA is an agency of the European Union and is also subject to the laws of the European Union.

How is your information processed and shared?

Adverse reaction reports are recorded and stored on our national database. Reports are submitted by the HPRA to the EudraVigilance database (a database owned and administered by the EMA). The information provided includes a unique identifier number. Other personal identifiers such as names, contact details or specific locations (e.g. hospital name) are not included.

The HPRA are a joint controller with the EMA for reports submitted to EudraVigilance. The joint controller arrangement in place can be viewed on the EMA's website. Further information on the EudraVigilance database and the EMA are available on the EMA's website.

Partially anonymised details of reports are shared with other bodies also involved in safety monitoring of medicines, in accordance with the legislative provisions. These bodies include the World Health Organisation (WHO) and as appropriate, the company(ies) that hold the licence(s) for the medicine(s) concerned (i.e. marketing authorisation holders or 'MAHs'). Sharing of the information you are reporting ensures that the information is available to all parties responsible for the ongoing safety monitoring of medicines.

Through these systems, adverse reaction reports are pooled with data from other countries to provide information on global safety experience with medicines. Information from these sources, together with additional safety data (e.g. from the scientific literature, cumulative safety data analysis, epidemiological studies, etc.) are assessed on an on-going basis, in conjunction with our EU counterparts to consider their impact on the known safety profile of the medicine in question and any need for regulatory changes. Data from EudraVigilance is used for the ongoing safety monitoring of medicines. This data may be included in regulatory submissions and assessment reports, some of which are published (in anonymised form) by the EMA. Changes to support safe and appropriate use of medicines could include recommendations to restrict use, or the addition of warnings to the product information for healthcare professionals and patients.

The HPRA uses third party service providers and suppliers (also known as data processors) in order to carry out both our regulatory functions and other related matters. These third parties process personal data on behalf of the HPRA and appropriate arrangements are in place with them to protect personal data.

Note that while personal identifiers and contact information are not shared, given the nature of adverse reaction reports, in that they can comprise a variety of different forms, some information may include data that in conjunction with other information contained in the report or elsewhere, may identify individuals.

The pharmacovigilance personal data collected by the HPRA is not transmitted to third countries by the HPRA. The data is retained permanently.

The HPRA fully respects your right to privacy and treats all personal information with the appropriate standards of security and confidentiality, strictly in accordance with data protection legislation.

What are your rights under data protection law?

Data protection law provides you with the following rights regarding the processing of your personal data:

  • The right to request access to your data
  • The right to request your data be rectified or erased if it is inaccurate
  • The right to request processing of your data be restricted
  • The right to lodge a complaint to the Data Protection Commission

How to contact us

For more information or to make a request regarding your personal data under data protection law, please submit your request in writing or via email to:

Data Protection Officer
Health Products Regulatory Authority
Kevin O'Malley House,
Earlsfort Centre,
Earlsfort Terrace,
Dublin 2

Tel: +353 (1) 676 4971
Fax: +353 (1) 676 7836
Email: dataprotectionofficer@hpra.ie

Please provide sufficient information in your request to enable us to deal with your query.

Further information regarding data protection at the HPRA can be found in our main privacy notice.