S.I. No. 142/2026 - Data Protection Act 2018 (Section 38(4)(b)) (Children’s Health Ireland Inquiry into Spina Bifida and Complex Scoliosis Services Scoping Exercise) Regulations 2026

Notice of the making of this Statutory Instrument was published in

“Iris Oifigiúil” of 14th April, 2026.

I, JENNIFER CARROLL MACNEILL, Minister for Health, in exercise of the powers conferred on me by subsection (4)(b) of section 38 of the Data Protection Act 2018 (No. 7 of 2018) and having duly complied with subsections (4) and (5) of section 38 of that Act, hereby make the following regulations:

Citation

1. These Regulations may be cited as the Data Protection Act 2018 (Section 38(4)(b)) (Children’s Health Ireland Inquiry into Spina Bifida and Complex Scoliosis Services Scoping Exercise) Regulations 2026.

Definitions

2. In these Regulations —

“Act of 2018” means the Data Protection Act 2018 (No. 7 of 2018);

“Facilitator” means the person appointed by the Minister to facilitate the scoping exercise and provide a final report to the Minister;

“Minister” means the Minister for Health;

“relevant person” means —

(a) the Facilitator,

(b) the administrator to the Facilitator,

(c) the Minister, or

(d) any other person acting for, appointed by or working under the direction of the Facilitator or the Minister in connection with the scoping exercise;

“relevant task”, in relation to the scoping exercise, means a task carried out by a relevant person in connection with the terms of reference;

“scoping exercise” means the Children’s Health Ireland Inquiry into Spina Bifida and Complex Scoliosis Services Scoping Exercise, approved by decision of the Government on 18 November 2025;

“terms of reference” means the terms of reference of the scoping exercise, which terms are set out in the Schedule.

Application of Regulations

3. These Regulations apply to personal data —

(a) processed by the scoping exercise in respect of which the Facilitator is the controller, and

(b) processed by the scoping exercise in respect of which the Minister is the controller.

Processing – public interest

4. Subject to the Data Protection Regulation and the Act of 2018, the processing by a relevant person of personal data to which these Regulations apply, and which is necessary and proportionate for the performance of a relevant task carried out in the public interest by a relevant person, is hereby specified.

Circumstances in which personal data may be processed

5. Without prejudice to the generality of Regulation 4, the circumstances in which personal data to which these Regulations apply may be processed shall include the performance by a relevant person of such relevant tasks as the Facilitator considers necessary and proportionate to enable the scoping exercise to —

(a) undertake the matters set out in the terms of reference, and

(b) report or make recommendations to the Minister in accordance with the terms of reference.

Persons to whom personal data may be disclosed

6. Personal data to which these Regulations apply may be disclosed to a relevant person in accordance with such policies and procedures as may be provided for under Regulation 7.

Conditions of processing

7. (1) The Facilitator shall prepare and implement policies and procedures to provide for the processing of personal data under these Regulations.

(2) Without prejudice to the generality of paragraph (1), the policies and procedures referred to in that paragraph shall provide for the following:

(a) the use of secure storage, passwords, encryption and other methods to ensure personal data can only be accessed by the Facilitator or by a relevant person authorised by the Facilitator to access that data;

(b) the use of controls to ensure that personal data are only disclosed to –

(i) a relevant person, or

(ii) a person entitled or permitted by law to receive that personal data;

(c) the determination of appropriate storage periods for personal data or classes of personal data;

(d) the treatment, including erasure where relevant, of personal data or classes of personal data at the expiry of the storage periods referred to in subparagraph (c);

(e) the use of data minimisation, including the use of anonymisation and pseudonymisation where appropriate;

(f) the treatment of personal data disclosed, orally or otherwise, during meetings or private sessions, including circumstances in which such treatment constitutes processing for the purposes of the Act of 2018.

(3) The Facilitator shall —

(a) review the policies and procedures referred to in paragraph (1) on a regular basis, and

(b) update those policies and procedures as the Facilitator considers appropriate.

Schedule

Children’s Health Ireland Inquiry into Spina Bifida and Complex Scoliosis Services Scoping Exercise

Terms of Reference

1. BACKGROUND

1.1. The Government, at its meeting of 18 November 2025, agreed, at the request of the Minister for Health (the “Minister”) that a scoping exercise be undertaken by a Facilitator in response to requests from advocacy groups and their legal representatives.

1.2. The Minister has appointed Remy Farrell SC (the “Facilitator”) to conduct the review.

2. SCOPE OF EXERCISE

2.1. The Facilitator shall consult with stakeholders (parents, patient advocates, CHI clinicians, CHI management, HSE management and Department of Health officials) in order to assess and consider what steps and/or actions may be appropriate.

2.2. The Facilitator shall understand the details of discussions at Minister and Tánaiste meetings with parents/advocates on 29 September 2025 and 12 November 2025.

2.3. The Facilitator shall consider the existing information relating to the current context of services and the typical model of care/patient journey through services.

2.4. The Facilitator shall consider the existing information relating to the number of processes already underway or undergoing implementation of recommendations as set out in the Appendix.

2.5. The Facilitator shall be mindful of other statutory processes, such as Coroner’s Inquests which may take precedence.

2.6. The Facilitator shall seek to avoid duplication with other relevant approaches or statutory processes such as those set out in the Appendix.

2.7. The Facilitator shall explore any modular or sequencing approach that could be taken to best meet the outcomes sought by the stakeholders including a patient/family personal statement module ensuring this is conducted in a child and family centred, non-adversarial manner.

2.8. The Facilitator shall make recommendations to the Minister in relation to the scope, breadth and format of an inquiry and the contents of potential terms of reference.

2.9. In making the above recommendations, the Facilitator will consider previous inquiries and reports with a particular focus on patients in health settings and identify those areas which it would be appropriate to examine further and those which have already been addressed by other processes.

2.10. The Facilitator may consider any other matter as agreed by stakeholders and the Minister with regard to engagement with stakeholders.

3. TIMEFRAME

3.1. The review will be carried out as quickly as possible with a commencement date of 3 March 2026 with the aim of furnishing a written report to the Minister within 16 weeks of that date.

APPENDIX

CHI REVIEWS AND TIMELINES

GIVEN under my Official Seal,

9 April, 2026.

JENNIFER CARROLL MACNEILL,

Minister for Health.

EXPLANATORY NOTE

(This note is not part of the Instrument and does not purport to be a legal interpretation.)

The purpose of these Regulations is to enable the commencement of the scoping exercise into the inquiry into spina bifida and complex scoliosis by providing a legislative base for the controlling and processing of personal data by the data controllers for the purposes of conducting that scoping exercise and making recommendations to the Minister in relation to the scope, breadth, format and content of potential terms of reference for an inquiry.