Privacy notice for Serious Adverse Reaction/Event reports for blood and blood components

The HPRA has been designated as the competent authority for the purposes outlined under the blood legislation. 

While the HPRA is the competent authority for implementation of legislation relating to blood and blood components, the National Haemovigilance Office (NHO) also provides assistance to the HPRA. The NHO collects, collates and evaluates Serious Adverse Reactions (SARs) and Serious Adverse Events (SAEs), as provided for in Statutory Instruments 360 of 2005 and 547 of 2006 and associated EU legislation. These SAR and SAE reports are then notified to the HPRA by the NHO. 

What information do we process?

The SAR and SAE reports collected contain patient personal data such as age and sex and ‘special category’ personal data, in particular, health data, such as the patient’s medical history and the effects experienced. While this information is collected, it is not anticipated that this information, alone or in combination with other information available to the HPRA, will identify any individual.  

It is also not expected that any identifiable personal data of patients will be collected by the HPRA directly. 

The HPRA has access to the contact details of the reporter submitting these reports. This information is collected by the NHO as part of the process for notifying reports.

Legal basis for processing

The legal basis for processing of personal data in adverse reaction reports is firstly, Article 6(1)(c) of the General Data Protection Regulation (GDPR), which states:

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Secondly, in terms of special categories of personal data, the HPRA relies on Article 9(2)(i) of GDPR, which states:

Processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy.

The HPRA is legally obliged to process notifications of SARs and SAEs related to blood and blood components under the Directives 2002/98/EC and 2005/61/EC and the Statutory Instruments 360 of 2005 and 547 of 2006. 

How is your information processed and shared?

In accordance with the legal requirements, the HPRA submits an annual notification of summary data to the European Commission each year. This notification includes information relating to the above reports occurring in Ireland and which have been notified to the HPRA. The notification contains aggregated data only. No individually identifiable information is included. 

The HPRA uses third party service providers and suppliers (also known as data processors) to carry out both our regulatory functions and other related matters. These third parties process personal data on behalf of the HPRA and appropriate arrangements are in place with them to protect personal data.

Reports are recorded and stored in the HPRA. The personal data gathered is not shared with any other bodies. 

The personal data collected by the HPRA is not transmitted to third countries by the HPRA. 

The data is retained permanently. 

The HPRA fully respects your right to privacy and treats all personal information with the appropriate standards of security and confidentiality, strictly in accordance with data protection legislation.  

What are your rights under data protection law?

Data protection law provides you with the following rights regarding the processing of your personal data:

  • The right to request access to your data
  • The right to request your data be rectified or erased if it is inaccurate
  • The right to request processing of your data be restricted
  • The right to lodge a complaint to the Data Protection Commission

How to contact us

For more information or to make a request regarding your personal data under data protection law, please submit your request in writing or via email to:

Data Protection Officer
Health Products Regulatory Authority
Kevin O'Malley House,
Earlsfort Centre,
Earlsfort Terrace,
Dublin 2

Tel: +353 (1) 676 4971
Fax: +353 (1) 676 7836
Email: dataprotectionofficer@hpra.ie

Please provide sufficient information in your request to enable us to deal with your query.

Further information regarding data protection at the HPRA can be found in our main privacy notice.