(1)Regulations may—
(a)make such provision for and in connection with requiring or regulating the processing of protected information for the purposes of medical research as the Secretary of State considers is necessary or expedient in the public interest or in the interests of improving patient care, and
(b)make such provision for and in connection with requiring or regulating the processing of protected information for the purposes of any other research as the Secretary of State considers is necessary or expedient in the public interest.
(2)Regulations under subsection (1) may, in particular, make provision—
(a)for requiring or authorising the disclosure or other processing of protected information to or by persons of any prescribed description subject to compliance with any prescribed conditions (including conditions requiring prescribed undertakings to be obtained from such persons as to the processing of such information),
(b)for securing that, where prescribed protected information is processed by a person in accordance with the regulations, anything done by that person in so processing the information must be taken to be lawfully done despite any obligation of confidence owed by the person in respect of it,
(c)for requiring fees of a prescribed amount to be paid to the Authority in prescribed circumstances by persons in relation to the disclosure to those persons of protected information under those regulations,
(d)for the establishment of one or more bodies to exercise prescribed functions in relation to the processing of protected information under those regulations,
(e)as to the membership and proceedings of any such body, and
(f)as to the payment of remuneration and allowances to any member of any such body and the reimbursement of expenses.
(3)Where regulations under subsection (1) require or regulate the processing of protected information for the purposes of medical research, such regulations may enable any approval given under regulations made under section 251 of the National Health Service Act 2006 (control of patient information) to have effect for the purposes of the regulations under subsection (1) in their application to England and Wales.
(4)Subsections (1) to (3) are subject to subsections (5) to (8).
(5)Regulations under subsection (1) may not make any provision requiring or authorising the disclosure or other processing, for any purpose, of protected information, where that information is information from which an individual may be identified, if it would be reasonably practicable to achieve that purpose otherwise than pursuant to such regulations, having regard to the cost of and technology available for achieving that purpose.
(6)Regulations under this section may not make provision for or in connection with the processing of protected information in a manner inconsistent with any provision made by or under [F2the data protection legislation].
(7)Subsection (6) does not affect the operation of provisions made under subsection (2)(b).
(8)Before making any regulations under this section the Secretary of State shall consult such bodies appearing to the Secretary of State to represent the interests of those likely to be affected by the regulations as the Secretary of State considers appropriate.
(9)In this section—
[F3“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).]
“prescribed” means prescribed by regulations made by virtue of this section,
“processing”, in relation to information, means the use, disclosure, or obtaining of the information or the doing of such other things in relation to it as may be prescribed for the purposes of this definition, and
“protected information” means information falling within section 31(2).]
Textual Amendments
F1Ss. 33A-33D substituted for s. 33 (6.4.2009 for specified purposes, 1.10.2009 for specified purposes, 6.4.2010 in so far as not already in force) by Human Fertilisation and Embryology Act 2008 (c. 22), ss. 25, 68(2); S.I. 2009/479, art. 5(e)(h) (with art. 7 Sch.); S.I. 2009/2232, art. 2(l); S.I. 2010/987, art. 2(a)
F2Words in s. 33D(6) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 39(2) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)
F3Words in s. 33D(9) inserted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 39(3) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)