Data Protection Act 2018 (Section 51(3)) (Children’s Health Ireland Inquiry into Spina Bifida and Complex Scoliosis Services Scoping Exercise) Regulations 2026

S.I. No. 144/2026 - Data Protection Act 2018 (Section 51(3)) (Children’s Health Ireland Inquiry into Spina Bifida and Complex Scoliosis Services Scoping Exercise) Regulations 2026 Download PDF Íoslódáil PDF Notice of the making of this Statutory Instrument was published in “Iris Oifigiúil” of 14 th April, 2026. I, JENNIFER CARROLL MACNEILL, Minister for Health, in exercise of the powers conferred on me by subsection (3) of section 51 of the Data Protection Act 2018 (No. 7 of 2018), having had regard to the matters referred to in subsection (8) of section 36 and subsection (7) of section 51 of that Act and having duly complied with subsections (5)(b) and (6) of section 36 and subsection (6)(b) of section 51 of that Act, hereby make the following regulations with respect to which, pursuant to section 6 of that Act, a draft has been laid before each House of the Oireachtas and a resolution approving the draft has been passed by each such House: 1. These Regulations may be cited as the Data Protection Act 2018 (Section 51(3)) (Children’s Health Ireland Inquiry into Spina Bifida and Complex Scoliosis Services Scoping Exercise) Regulations 2026. 2. In these Regulations — “Act of 2018” means the Data Protection Act 2018 (No. 7 of 2018); “Facilitator” means the person appointed by the Minister to facilitate the scoping exercise and provide a final report to the Minister; “Minister” means the Minister for Health; “relevant person” means — (a) the Facilitator, (b) the administrator to the Facilitator, (c) the Minister, or (d) any other person acting for, appointed by or working under the direction of the Facilitator or the Minister in connection with the scoping exercise; “scoping exercise” means the Children’s Health Ireland Inquiry into Spina Bifida and Complex Scoliosis Services Scoping Exercise approved by decision of the Government on 18 November 2025; “special categories of personal data” has the meaning assigned to it by section 2 of the Act of 2018; “terms of reference” means the terms of reference of the scoping exercise, which terms are set out in the Schedule. Processing of special categories of personal data for reasons of substantial public interest 3. Subject to the Data Protection Regulation and the Act of 2018, the processing by a relevant person of special categories of personal data is authorised only in so far as is necessary for, and proportionate to, the substantial public interest referred to in Regulation 4. Substantial public interest 4. For the purposes of Regulation 3, “substantial public interest” means the performance by the Facilitator of the functions for which the Facilitator was appointed to conduct the scoping exercise under the terms of reference. Controllers of special categories of personal data 5. For the purposes of these Regulations and within the meaning of the Data Protection Regulation and the Act of 2018, the Minister and the Facilitator are each controllers of special categories of personal data provided to the scoping exercise. Persons to whom special categories of personal data may be disclosed 6. Special categories of personal data may be disclosed to a relevant person in accordance with such policies and procedures as may be provided for under Regulation 7. Suitable and specific measures to be taken to safeguard fundamental rights and freedoms of data subject in processing special categories of personal data authorised by these Regulations 7. The Facilitator shall, for the purposes of safeguarding the fundamental rights and freedoms of a data subject in processing special categories of personal data in accordance with these Regulations, take the following suitable and specific measures: (a) prepare and implement policies and procedures for the processing of special categories of personal data under these Regulations, having particular regard to the involvement of children and other vulnerable persons, including in relation to the following: (i) the use of secure storage, passwords, encryption, logging mechanisms and other methods to ensure that the special categories of personal data can only be accessed by a relevant person authorised by the Facilitator to access that data; (ii) the use of controls to ensure that special categories of personal data are only disclosed to a relevant person authorised by the Facilitator or who are entitled or permitted by law to receive that data; (iii) the determination of appropriate storage periods for special categories of personal data or classes of special categories of personal data; (iv) the treatment of special categories of personal data or classes of special categories of personal data at the expiry of the storage periods referred to in subparagraph (iii); (v) the erasure of special categories of personal data; (vi) to ensure that relevant persons have undertaken to maintain the integrity and confidentiality of the special categories of personal data or are under an appropriate statutory obligation to do so; (vii) the use of data minimisation and access controls in respect of personal data relating to children, including age-appropriate transparency measures and the use of anonymisation and pseudonymisation, where appropriate; (viii) the treatment of personal data disclosed, orally or otherwise, during meetings or private sessions, including circumstances in which such treatment constitutes processing for the purposes of the Act of 2018; (b) without prejudice to the generality of paragraph (a), take such other measures as the Facilitator considers appropriate to ensure that — (i) special categories of personal data are processed under these Regulations only to the extent strictly necessary and proportionate for the purposes of the scoping exercise; (ii) on a regular basis, an assessment is made by the Facilitator of the risks to the fundamental rights and freedoms of data subjects in respect of whom special categories of personal data are processed under these Regulations by reason of such processing; (c) ensure that the policies and procedures referred to in paragraph (a) and any measures referred to in paragraph (b) are reviewed on a regular basis, and, as the Facilitator considers it appropriate to do so, duly updated. Children’s Health Ireland Inquiry into Spina Bifida and Complex Scoliosis Services Scoping Exercise Terms of Reference 1. BACKGROUND 1.1. The Government, at its meeting of 18 November 2025, agreed, at the request of the Minister for Health (the “Minister”) that a scoping exercise be undertaken by a Facilitator in response to requests from advocacy groups and their legal representatives. 1.2. The Minister has appointed Remy Farrell SC (the “Facilitator”) to conduct the review. 2. SCOPE OF EXERCISE 2.1. The Facilitator shall consult with stakeholders (parents, patient advocates, CHI clinicians, CHI management, HSE management and Department of Health officials) in order to assess and consider what steps and/or actions may be appropriate. 2.2. The Facilitator shall understand the details of discussions at Minister and Tánaiste meetings with parents/advocates on 29 September 2025 and 12 November 2025. 2.3. The Facilitator shall consider the existing information relating to the current context of services and the typical model of care/patient journey through services. 2.4. The Facilitator shall consider the existing information relating to the number of processes already underway or undergoing implementation of recommendations as set out in the Appendix. 2.5. The Facilitator shall be mindful of other statutory processes, such as Coroner’s Inquests which may take precedence. 2.6. The Facilitator shall seek to avoid duplication with other relevant approaches or statutory processes such as those set out in the Appendix. 2.7. The Facilitator shall explore any modular or sequencing approach that could be taken to best meet the outcomes sought by the stakeholders including a patient/family personal statement module ensuring this is conducted in a child and family centred, non-adversarial manner. 2.8. The Facilitator shall make recommendations to the Minister in relation to the scope, breadth and format of an inquiry and the contents of potential terms of reference. 2.9. In making the above recommendations, the Facilitator will consider previous inquiries and reports with a particular focus on patients in health settings and identify those areas which it would be appropriate to examine further and those which have already been addressed by other processes. 2.10. The Facilitator may consider any other matter as agreed by stakeholders and the Minister with regard to engagement with stakeholders. 3. TIMEFRAME 3.1. The review will be carried out as quickly as possible with a commencement date of 3 March 2026 with the aim of furnishing a written report to the Minister within 16 weeks of that date. CHI REVIEWS AND TIMELINES Commencement Date Completion Date March 2023 July 2023 Sept 2023 Compiled Report Nayagam - Phase 1 (risk assessment of a surgeon) Nov 2023 Aug 2025 Terms of Reference Nayagam - Phase 2 Sept 2025 Expected early 2026 Expected early 2026 HIQA Review (non-CE springs) Nov 2023 April 2025 April 2025 Final Report DDH Audit (Thomas) July 2024 May 2025 May 2025 Final Report 2017 May 2017 2022 Internal on a clinical dept End 2021 Jan 2022 June 2025 (CHI Summary Report) Summary Report HSE Audit on governance and equity in patient access and waiting list management June 2025 Dec 2025/Jan 2026 On completion GIVEN under my Official Seal, 9 April, 2026. JENNIFER CARROLL MACNEILL, Minister for Health.