Data Protection Act 2018 (Section 60(6)) (Children’s Health Ireland Inquiry into Spina Bifida and Complex Scoliosis Services Scoping Exercise) Regulations 2026

S.I. No. 143/2026 - Data Protection Act 2018 (Section 60(6)) (Children’s Health Ireland Inquiry into Spina Bifida and Complex Scoliosis Services Scoping Exercise) Regulations 2026 Download PDF Íoslódáil PDF Notice of the making of this Statutory Instrument was published in “Iris Oifigiúil” of 14 th April, 2023. I, JENNIFER CARROLL MACNEILL, Minister for Health, in exercise of the powers conferred on me by section 60 (6) of the Data Protection Act 2018 (No. 7 of 2018), and having duly complied with subsections (9)(b) and (10) of section 60 of that Act, hereby make the following regulations, with respect to which, pursuant to section 6 of that Act, a draft has been laid before each House of the Oireachtas and a resolution approving the draft has been passed by each such House: 1. These Regulations may be cited as the Data Protection Act 2018 (Section 60(6)) (Children’s Health Ireland Inquiry into Spina Bifida and Complex Scoliosis Services Scoping Exercise) Regulations 2026. 2. In these Regulations — “Act of 2018” means the Data Protection Act 2018 (No. 7 of 2018); “Facilitator” means the person appointed by the Minister to facilitate the scoping exercise and provide a final report to the Minister; “Minister” means the Minister for Health; “relevant function” has the meaning assigned to it by Regulation 3; “relevant objective” has the meaning assigned to it by Regulation 4; “relevant person” means — (a) the Facilitator, (b) the administrator to the Facilitator, (c) the Minister, or (d) any other person acting for, appointed by or working under the direction of the Facilitator or the Minister in connection with the scoping exercise; “scoping exercise” means the Children’s Health Ireland Inquiry into Spina Bifida and Complex Scoliosis Services Scoping Exercise approved by decision of the Government on 18 November 2025; “terms of reference” means the terms of reference of the scoping exercise, which terms are set out in the Schedule. Relevant function 3. In these Regulations, “relevant function” means a function performed by a relevant person that relates directly or indirectly to — (a) the scoping exercise, or (b) reporting or making recommendations to the Minister in accordance with the terms of reference. Relevant objective 4. In these Regulations, “relevant objective” means an objective — (a) referred to in paragraph (b) or (o) of section 60(7) of the Act of 2018, and (b) pursued by a relevant person in exercising a relevant function. Scope: categories of personal data 5. These Regulations apply to personal data (including special categories of personal data) processed by a relevant person. Controllers of personal data 6. For the purposes of these Regulations and within the meaning of the Data Protection Regulation and the Act of 2018, the Minister and the Facilitator are each controllers of personal data (including special categories of personal data) provided to the scoping exercise. Scope: purpose of processing 7. These Regulations apply to the processing by a relevant person of personal data to which these Regulations apply that is necessary for the achievement of a relevant objective. 8. (1) The rights and obligations provided for in Articles 12 to 22, Article 34 and Article 5 (in so far as any of its provisions correspond to the rights and obligations in Articles 12 to 22) of the Data Protection Regulation, in respect of processing to which these Regulations apply, are restricted to the extent that such a restriction is — (a) necessary, and only for so long as is so necessary, to safeguard a relevant objective, and (b) proportionate to the need to safeguard that relevant objective, including where the exercise of the right or compliance with the obligation, as the case may be, would — (i) obstruct or otherwise prejudice, in whole or in part, the performance of a relevant function, or (ii) prevent the Facilitator processing personal data to which these Regulations apply for a period of time, in a case in which any delay to the processing may prejudice the achievement of the relevant objective. (2) Matters which are relevant, for the purposes of paragraph (1), in determining whether a restriction of a right or obligation is necessary to safeguard a relevant objective, and proportionate to the need to safeguard the relevant objective, include — (a) whether or not the exercise of the right or compliance with the obligation would obstruct or otherwise prejudice the achievement by the Facilitator of the relevant objective, (b) the need to respect the essence of the right to data protection of the data subject, and (c) the risks to the rights and freedoms of a data subject that may result from such a restriction. Information to be provided where right or obligation restricted 9. (1) Subject to paragraph (3), where a right or obligation referred to in Regulation 8(1) is restricted in accordance with that Regulation, the Facilitator shall notify the data subject concerned of the restriction, in writing and in a timely manner. (2) A notification under paragraph (1) shall inform the data subject concerned of the following: (a) the right or obligation referred to in Regulation 8(1) affected by the restriction; (b) whether the right or obligation concerned has been restricted in whole or in part; (c) the reasons for the restriction, unless informing the data subject concerned of the reasons may, in the opinion of the Facilitator, obstruct or otherwise prejudice the achievement of the relevant objective; (d) that the data subject concerned may lodge a complaint with the Data Protection Commission pursuant to Article 77(1) of the Data Protection Regulation; (e) that the right referred to in subparagraph (d) is without prejudice to any other rights or remedies which the data subject concerned may have. (3) Where the Facilitator is of the opinion that notifying the data subject under paragraph (1) may be prejudicial to the achievement of a relevant objective, the Facilitator may elect not to notify the data subject and shall record the reasons for that decision. (4) Where requested to do so by a data subject notified in accordance with paragraph (1), the Facilitator shall provide information on the policies and procedures referred to in Regulation 11(1) to the data subject. Communication with data subject 10. The Facilitator shall ensure that all information provided to a data subject under or in relation to these Regulations is provided in a concise, intelligible and easily accessible form using clear and plain language. 11. (1) The Facilitator shall prepare and implement policies and procedures to provide for the matters referred to in Article 23(2)(d) and (f) of the Data Protection Regulation. (2) Without prejudice to the generality of paragraph (1), the policies and procedures referred to in that paragraph shall provide for the following: (a) the use of secure storage, passwords, encryption and other methods to ensure personal data can only be accessed by a relevant person; (b) the use of controls to ensure that personal data is only disclosed to a relevant person, or to a person otherwise entitled or permitted by law to receive that personal data; (c) processes to ensure the accuracy of the personal data, that it is kept up to date and accurate, and that an accurate record of the data provided to the Facilitator is kept; (d) the determination of appropriate storage periods for personal data or classes of personal data taking into account the nature, scope and purpose of the processing of the category of data and the conclusion of the scoping exercise; (e) the treatment of personal data or classes of personal data at the expiry of the storage periods referred to in subparagraph (d); (f) the use of data minimisation, including the use of anonymisation and pseudonymisation; (g) the treatment of personal data disclosed, verbally or otherwise, during meetings or private sessions, including circumstances in which such treatment constitutes processing for the purposes of the Act of 2018. (3) The policies and procedures referred to in paragraph (1) shall be reviewed by the Facilitator on a regular basis and updated where the Facilitator considers it appropriate to do so. Interaction with other law 12. The restriction referred to in paragraph (1) of Regulation 8 is in addition to and not in substitution for any restriction of the rights and obligations referred to in that paragraph under any other enactment or law of the European Union. Children’s Health Ireland Inquiry into Spina Bifida and Complex Scoliosis Services Scoping Exercise Terms of Reference 1. BACKGROUND 1.1. The Government, at its meeting of 18 November 2025, agreed, at the request of the Minister for Health (the “Minister”) that a scoping exercise be undertaken by a Facilitator in response to requests from advocacy groups and their legal representatives. 1.2. The Minister has appointed Remy Farrell SC (the “Facilitator”) to conduct the review. 2. SCOPE OF EXERCISE 2.1. The Facilitator shall consult with stakeholders (parents, patient advocates, CHI clinicians, CHI management, HSE management and Department of Health officials) in order to assess and consider what steps and/or actions may be appropriate. 2.2. The Facilitator shall understand the details of discussions at Minister and Tánaiste meetings with parents/advocates on 29 September 2025 and 12 November 2025. 2.3. The Facilitator shall consider the existing information relating to the current context of services and the typical model of care/patient journey through services. 2.4. The Facilitator shall consider the existing information relating to the number of processes already underway or undergoing implementation of recommendations as set out in the Appendix. 2.5. The Facilitator shall be mindful of other statutory processes, such as Coroner’s Inquests which may take precedence. 2.6. The Facilitator shall seek to avoid duplication with other relevant approaches or statutory processes such as those set out in the Appendix. 2.7. The Facilitator shall explore any modular or sequencing approach that could be taken to best meet the outcomes sought by the stakeholders including a patient/family personal statement module ensuring this is conducted in a child and family centred, non-adversarial manner. 2.8. The Facilitator shall make recommendations to the Minister in relation to the scope, breadth and format of an inquiry and the contents of potential terms of reference. 2.9. In making the above recommendations, the Facilitator will consider previous inquiries and reports with a particular focus on patients in health settings and identify those areas which it would be appropriate to examine further and those which have already been addressed by other processes. 2.10. The Facilitator may consider any other matter as agreed by stakeholders and the Minister with regard to engagement with stakeholders. 3. TIMEFRAME 3.1. The review will be carried out as quickly as possible with a commencement date of 3 March 2026 with the aim of furnishing a written report to the Minister within 16 weeks of that date. CHI REVIEWS AND TIMELINES Commencement Date Completion Date March 2023 July 2023 Sept 2023 Compiled Report Nayagam - Phase 1 (risk assessment of a surgeon) Nov 2023 Aug 2025 Terms of Reference Nayagam - Phase 2 Sept 2025 Expected early 2026 Expected early 2026 HIQA Review (non-CE springs) Nov 2023 April 2025 April 2025 Final Report DDH Audit (Thomas) July 2024 May 2025 May 2025 Final Report 2017 May 2017 2022 Internal on a clinical dept End 2021 Jan 2022 June 2025 (CHI Summary Report) Summary Report HSE Audit on governance and equity in patient access and waiting list management June 2025 Dec 2025/Jan 2026 On completion GIVEN under my Official Seal, 9 April, 2026. JENNIFER CARROLL MACNEILL, Minister for Health.