Privacy Notice for Authority members, committee members and experts

This privacy notice has been created to inform you about the information we process in connection with your involvement with the HPRA Authority and/or its committees, or your role as an external expert. 

What information do we process?

We process personal data including the following:

  • contact details, e.g. name, address, phone numbers, email addresses
  • details of our qualifications and work history
  • declaration of interests including details regarding household members
  • accident reports in cases where an accident occurs on HPRA property

Legal basis for processing

The legal basis for processing personal data for public interest/official authority is Article 6(1)(e) of the General Data Protection Regulation (GDPR), which states:

Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The legal basis for processing personal data for accident reports is Article 9(2)(b) of the General Data Protection Regulation (GDPR), which states:

Processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject.

How is your information processed and shared?

Authority members' names, profiles and a summary of declarations of interest are made available on the HPRA website (www.hpra.ie).

Committee members' names are also made available on the HPRA website (www.hpra.ie).

The HPRA uses third party service providers and suppliers (also known as data processors) to carry out both our regulatory functions and other related matters. These third parties process personal data on behalf of the HPRA and appropriate arrangements are in place with them to protect personal data. 

Members and experts' information is retained permanently in order to maintain an audit trail demonstrating the integrity of regulatory decisions. Where relevant, accident reports are kept for ten years and then deleted.

What are your rights under data protection law?

Data protection law provides you with the following rights regarding the processing of your personal data:

  • the right to request access to your data;
  • the right to request your data be rectified or erased if it is inaccurate
  • the right request processing of your data be restricted
  • the right to object to the processing of your data
  • the right to lodge a complaint to the Data Protection Commission

How to contact us

For more information or to make a request regarding your personal data under data protection law, please submit your request in writing or via email to:

Data Protection Officer
Health Products Regulatory Authority
Kevin O'Malley House,
Earlsfort Centre,
Earlsfort Terrace,
Dublin 2

Tel: +353 (1) 676 4971
Fax: +353 (1) 676 7836
Email: dataprotectionofficer@hpra.ie

Please provide sufficient information in your request to enable us to deal with your query.

Further information regarding data protection at the HPRA can be found in our main privacy notice.