Privacy notice for reporting a serious adverse reaction/event for tissues and cells

As the competent authority for implementing EU and national legislation relating to human tissues and cells, the HPRA is responsible for collecting reports about:

  • serious adverse reactions and events which may influence the quality and safety of human tissues and cells, and
  • serious adverse reactions which may be linked to the quality and safety of tissues and cells. 

What information do we process?

It is not expected that any identifiable personal data of donors or recipients of tissues and cells will be collected by the HPRA. While information such as the sex, age and an identifier number of a donor or recipient may be collected, it is not anticipated that this information, alone or in combination with other information available to the HPRA, will identify any individual.  

The HPRA collects the contact details of the reporter submitting a tissue and cell adverse reaction or event report. These details are only used to follow up with the reporter regarding the report. 

Legal basis for processing

The legal basis for processing personal data in incident reports is Article 6(1)(c) of the General Data Protection Regulation (GDPR), which states:

Processing is necessary for compliance with a legal obligation to which the controller is subject

The HPRA is legally obliged to receive reports of such serious adverse reactions and events from tissue establishments, procurement organisations or organisations responsible for human application under the provisions of SI 158/2006 (as amended), SI 598/2007 and associated EU legislation.  

How is your information processed and shared?

In accordance with the legal requirements, the HPRA submits an annual notification of summary data to the European Commission each year. This notification includes information relating to the above reports occurring in Ireland and which have been notified to the HPRA. The notification contains aggregated data only. No individually identifiable information is included. 

The HPRA uses third party service providers and suppliers (also known as data processors) to carry out both our regulatory functions and other related matters. These third parties process personal data on behalf of the HPRA and appropriate arrangements are in place with them to protect personal data.

The personal data processed is not transmitted to third countries by the HPRA. 

The personal data described above is retained permanently. 

The HPRA fully respects your right to privacy and treats all personal information with the appropriate standards of security and confidentiality, strictly in accordance with data protection legislation.  

What are your rights under data protection law?

Data protection law provides you with the following rights regarding the processing of your personal data:

  • The right to request access to your data
  • The right to request your data be rectified or erased if it is inaccurate
  • The right to request processing of your data be restricted
  • The right to lodge a complaint to the Data Protection Commission

How to contact us

For more information or to make a request regarding your personal data under data protection law, please submit your request in writing or via email to:

Data Protection Officer
Health Products Regulatory Authority
Kevin O'Malley House,
Earlsfort Centre,
Earlsfort Terrace,
Dublin 2

Tel: +353 (1) 676 4971
Fax: +353 (1) 676 7836
Email: dataprotectionofficer@hpra.ie

Please provide sufficient information in your request to enable us to deal with your query. 

Further information regarding data protection at the HPRA can be found in our main privacy notice.