Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 02 MAY 2022

Market Intelligence Thought Leadership Award Winner

Health Data & Subject Access Requests: Important Changes Under The Data Protection Act 2018

William Fry LLP
William Fry LLP
Contributor
William Fry LLP

William Fry LLP

William Fry advises leading Irish and international companies, covering both the public and private...

View firm profile
Explore more from William Fry LLP

The Data Protection Act 2018 (Access Modification) (Health) Regulations 2022 (2022 Regulations) commenced on Tuesday, 8 March 2022. The 2022 Regulations revoke and replace the Data Protection...

IrelandPrivacy
David Kirton
David Kirton
David Cullen
David Cullen
Author LinkedIn connections

Introduction

The Data Protection Act 2018 (Access Modification) (Health) Regulations 2022 (2022 Regulations) commenced on Tuesday, 8 March 2022.  The 2022 Regulations revoke and replace the Data Protection (Access Modification) (Health) Regulations 1989 (1989 Regulations). This new legislation materially impacts organisations (acting as controllers) that process health data concerning individuals and receive data subject access requests (DSAR(s)) from such individuals under Article 15 of the General Data Protection Regulation (GDPR).

Under the 1989 Regulations, it was a mandatory requirement for any controller processing health data who was not a health service provider (e.g. an insurance company) on receipt of a DSAR, to consult with a health practitioner (e.g. a GP) before providing (or arranging) access to such data by the individual concerned.  Under the 2022 Regulations, it is a controller's discretion whether to consult a health practitioner, subject to

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

The Data Act – “Access By Design” Requirement Comes Into Force

The European Union's Data Act introduces a groundbreaking "access by design" requirement that fundamentally changes how manufacturers must approach product development for connected devices and IoT products. From September 2026, businesses placing connected products on the EU market must ensure users can directly access their generated data by default, shifting data accessibility from a reactive request-based model to a proactive design imperative.
IrelandPrivacy
Matheson
Matheson
Article

The Data Act: “Access By Design” Requirement Comes Into Force For Medical Devices

The Data Act's "access by design" requirement came into force on 12 September 2026, mandating that manufacturers of connected products and providers of related services must enable direct user access to generated data by default. This article examines the scope of this new obligation and its practical implications for businesses in the Life Sciences sector, particularly those developing medical devices and Internet of Things products.
IrelandPrivacy
Matheson
Matheson
Article

The Data Act – Part I: Key Considerations Regarding Data Access And Sharing

The EU Data Act, which became applicable on 12 September 2025, fundamentally reshapes how businesses handle data generated by connected devices and related services. With Ireland's General Scheme published in February 2026 designating ComReg and CCPC as enforcement authorities, companies must now assess their compliance obligations across data sharing frameworks, contractual terms, and user access rights or face significant fines.
IrelandPrivacy
Matheson
Matheson
Article

DPC AI Insights Report: Key Takeaways

Ireland's Data Protection Commission has published a comprehensive report examining its supervisory engagement with organizations developing AI products between 2021 and 2025, revealing a tenfold increase in AI-related engagements and highlighting critical compliance areas including lawful basis, transparency, and children's data protection. The report provides detailed insights into the DPC's quasi-regulatory sandbox approach and outlines key observations on data protection obligations for AI technologies,
IrelandPrivacy
Matheson
Matheson
Article

Ireland’s Data Centre Connections: Back Online

Ireland has lifted its data centre connection moratorium and introduced a demanding new framework requiring developers to provide their own generation capacity, source 80% of electricity from new Irish renewables within six years, and meet strict grid stability requirements. The policy creates significant opportunities for developers who can navigate the complex intersection of grid connection, planning permission, and renewable energy procurement, though a pending legal challenge adds uncertainty to the la
IrelandEnergy and Natural Resources
William Fry LLP
William Fry LLP
Article

Data For Sale: Can Insolvent Companies Realise The Value Of Corporate Data?

Spirit Airlines' proposed $10 million sale of a massive de-identified corporate dataset to Google in its Chapter 11 bankruptcy proceedings raises fundamental questions about whether operational business data can be treated as a realisable asset in insolvency. The transaction highlights the legal tension between preserving a dataset's commercial utility and ensuring individuals cannot be identified, particularly when the data maintains referential integrity across multiple systems.
IrelandInsolvency/Bankruptcy/Re-Structuring
William Fry LLP
William Fry LLP
Article

Government Legislative Priorities For Autumn 2026

The Government has published its Autumn 2026 Legislation Programme, identifying 32 bills for priority publication and 32 bills for priority drafting. This article explores a selection of measures likely to be of interest to businesses, spanning digital economy, strategic infrastructure, litigation reform, financial regulation, competition law, corporate structures, employment, pensions, and healthcare sectors.
IrelandGovernment, Public Sector
William Fry LLP
William Fry LLP
Article

Time Running Out As AI Transparency Guidelines Published

The European Commission has published comprehensive guidelines on AI transparency obligations under Article 50 of the EU AI Act, with enforcement beginning August 2, 2026. These guidelines establish how organizations must disclose AI systems, mark synthetic content, label deepfakes, and demonstrate compliance, with significant penalties for non-compliance reaching up to €15 million or 3% of global turnover.
IrelandTechnology
William Fry LLP
William Fry LLP
Article

CBI Consults On Third-Party Risk

The Central Bank of Ireland has published a consultation paper proposing new guidance on managing third-party risks that extends beyond traditional outsourcing to encompass partnerships, joint ventures, and fintech collaborations. The proposed framework aligns with recent European Banking Authority guidelines and DORA, introducing a lifecycle-based approach with enhanced contractual provisions and broader scope than the 2021 guidance it will replace. Financial entities now face the challenge of identifying
IrelandFinance and Banking
William Fry LLP
William Fry LLP