Data rights group concerned as CSO collects Covid information

Antoin Ó Lachtnain expressed concern about the way pandemic-related information about people — including their vaccinations — was being handled. Picture: Larry Cummins

A leading data rights group has expressed concerns over the Covid-19 personal medical data being held by the Central Statistics Office.

Digital Rights Ireland has expressed reservations about the CSO allegedly “not being open and transparent about its dealings with medical data”.

The CSO hosts a Covid-19 information hub on its website which reproduces “all Covid-19 related releases and publications”.

However, the body also hosts a “secure Covid-19 data research hub” which contains “individual level administrative data sets" it gets from the  HSE. That data is also being made available for research, the CSO said, a decision arrived at after “extensive consultation”. All data is pseudonymised, the CSO said.

Vaccine data in a future database

Vaccine data is also to be used to form a future database in a similar vein, although that data has not yet been made available to the CSO by the HSE. DRI director Antoin Ó Lachtnain expressed concern that this is personal health data relating to individual citizens who have not been given an opportunity to opt out of their data being used for research purposes, and that the existence of the research hub has not been given sufficient publicity.

Mr Ó Lachtnain said that he had asked the CSO for both the data protection impact assessment (DPIA) for the project, and also its record of processing activities (ROPA).

He was promised both a summary of the DPIA and a copy of the ROPA on June 14. However, neither document has yet been made available, Mr Ó Lachtnain said:

There is no reason for the DPIA and RPOA not to be published as soon as they are ready.

“This is now common practice in dealing with medical records in the public sector,” he added, and suggested that the example of the Covid-19 tracker app from June 2020, which had its DPIA and source code published by the HSE in advance of its going live, is one of best practice in terms of a State-funded data project.

Basis for sharing data

The Irish Examiner asked the CSO what data sharing agreements are in place between itself and the HSE regarding the shared medical data, and how that data corresponds to the CSO’s remit of collating statistical information with regard to economic, social, and general activities.

A spokesperson for the body said that health data “would generally be classed as falling under social and general conditions and the CSO can collect medical records with the permission of the Minister for Health” under the 1993 Statistics Act.

Mr Ó Lachtnain suggested that while this provision exists, it is in terms of where medical data is needed in order to process economic or social queries, such as the cost of surgery, not medical research itself.

The spokesperson also said “for operational security reasons we do not publish copies of DPIAs”.

What's your view on this issue?

You can tell us here

Mr Ó Lachtnain said: “The CSO has not been forthcoming in relation to its plans for obtaining and sharing medical data. 

It has not made its plans widely known and it is unwilling to date to provide a copy of the DPIA for this project. We think this is very worrying. 

He said the gathering of such data threatens to “undermine trust in Ireland’s national statistics office”.

“Anyone who has had a test or been vaccinated will have their data given to the CSO. We do not know what benefit there will be, if any, to these patients from this data gathering and research,” he said.