Privacy notice for reporting a quality defect in a medicine for human use

The HPRA is responsible for investigating reports about quality defects in human and veterinary medicinal products. 

What information do we process?

A defect report may contain personal data such as the contact details of the individual who experienced the defect (e.g. name, address, email address, phone number) and age and sex. Reports may include what are called 'special categories' of personal data, in particular, health data, such as the condition being treated and the product defect experienced.

The HPRA also collects personal data of the reporter submitting a defects report.

Legal basis for processing

The legal basis for processing personal data in incident reports is Article 6(1)(c) of the General Data Protection Regulation (GDPR), which states:

Processing is necessary for compliance with a legal obligation to which the controller is subject.

In terms of special categories of personal data, the HPRA relies on Article 9(2)(i) of GDPR, which states:

Processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy.

The HPRA is legally obliged to receive reports of defects in human and veterinary medicinal products under the provisions of SIs 539/2007, 540/2007, 538/2007 and 786/2007 (all as amended).

How is your information processed and shared?

Information regarding quality defects in human and veterinary medicinal products is shared with other European regulatory bodies and the European Commission, however the personal data of a reporter or a person who experienced a defect will not be shared with these bodies. Data is also shared with other international regulatory bodies however, data is shared either in aggregated form or where personal data and other potentially identifying information is removed from the report.

The HPRA also communicates defect reports to the authorisation holder, manufacturer or wholesaler of the product. The HPRA may seek to share an individual's contact details with these parties to allow them to follow up with individuals in relation to the defects experienced. The HPRA will always seek consent before providing an individual's contact details to the authorisation holder, manufacturer or wholesaler of the product.

The HPRA may share quality defect reports regarding centrally authorised products with the European Medicines Agency, as the Agency coordinates the investigation of those reports across the EU. These reports may contain individual's contact information. The HPRA does not transmit names or contact details of individuals when providing defect reports to other EU bodies. However, given the nature of defect reports, in that they can comprise a variety of different forms, some information may include data that in conjunction with other information contained in the report or elsewhere, may identify individuals.

The HPRA uses third party service providers and suppliers (also known as data processors) in order to carry out both our regulatory functions and other related matters. These third parties process personal data on behalf of the HPRA and appropriate arrangements are in place with them to protect personal data. 

The personal data collected by the HPRA is not transmitted to third countries by the HPRA. The personal data is retained permanently.

The HPRA fully respects your right to privacy and treats all personal information with the appropriate standards of security and confidentiality, strictly in accordance with data protection legislation.

What are your rights under data protection law?

Data protection law provides you with the following rights regarding the processing of your personal data:

  • The right to request access to your data
  • The right to request your data be rectified or erased if it is inaccurate
  • The right to request processing of your data be restricted
  • The right to lodge a complaint with the Data Protection Commission

Further information

For more information or to make a request regarding your personal data under data protection law, please submit your request in writing or via email:

Data Protection Officer
Health Products Regulatory Authority
Kevin O'Malley House,
Earlsfort Centre,
Earlsfort Terrace,
Dublin 2

Tel: +353 (1) 676 4971
Fax: +353 (1) 676 7836
Email: dataprotectionofficer@hpra.ie

Please provide sufficient information in your request to enable us to deal with your query. 

Further information regarding data protection at the HPRA can be found in our main privacy notice.