Data Protection Act 2018 (Access Modification) (Health) Regulations 2022
Statutory Instruments
Source: Statutory Instruments

num: 1
paragraphs: These Regulations may be cited as the Data Protection Act 2018 (Access Modification) (Health) Regulations 2022.
num: 2
paragraphs: The Data Protection (Access Modification) (Health) Regulations 1989 ( S.I. No. 82 of 1989 ) are revoked.
num: 3
paragraphs: In these Regulations –
num: 4
paragraphs: The application of the right of access under Article 15 of the Data Protection Regulation may, in accordance with Regulation 6 or 7, be restricted in relation to health data of the data subject but only –
(a) to the extent that is necessary and proportionate, and
(b) for as long as necessary only to protect the health of the data subject.
num: 5
paragraphs: Nothing in these Regulations shall operate to excuse a controller from granting access to a data subject to so much of the information sought in relation to the health data concerned as may be granted without causing serious harm to the physical or mental health of the data subject.
num: 6
paragraphs: Where a controller –
(a) is a health services provider, and
(b) has reasonable grounds for believing that granting access to the data subject to the health data concerned would be likely to cause serious harm to the physical or mental health of the data subject,
num: 7
paragraphs: Where a controller –
(a) is a person other than a health services provider, and
(b) has reasonable grounds for believing that granting access to the health data concerned would be likely to cause serious harm to the physical or mental health of the data subject,
num: 8
paragraphs: (1) Where a controller referred to in Regulation 7 has the reasonable grounds referred to in subparagraph (b) of that Regulation, he or she may consult with a health practitioner who has experience and qualifications to advise on the subject matter of the data before making a decision on whether or not to provide the data subject with the personal data concerned.
(2) Where a controller consults with a health practitioner under paragraph (1), the controller shall provide to that health practitioner only so much of the data subject’s health data as is necessary for the health practitioner to advise on the subject matter of the data.
(3) For the purposes of the consultation referred to in paragraph (1), the health data to be provided under paragraph (2) shall be provided to the health practitioner in pseudonymised form.
(4) Any advice provided by a health practitioner consulted under paragraph (1) which recommends withholding some or all of the health data concerned shall be provided in writing to the controller concerned.
num: 9
paragraphs: Where, pursuant to Regulation 6 or 7, a controller does not provide health data to the data subject, the controller shall –
(a) advise the data subject that, if the data subject so requests, the controller shall offer access to the data concerned, and keep it available for that purpose, to such health practitioner having experience and qualifications in the subject matter of the data as the data subject may specify, and
(b) offer access to the data concerned to such health practitioner as referred to in subparagraph (a), and keep it available for that purpose.