March 3, 2021
News
Joint statement
We welcome the draft adequacy decision on the UK data protection regime issued by the European Commission on 19th February 2021. Protecting the benefits of the free flow of personal data must be a top priority. The absence of an adequacy decision would negatively impact the UK and EU health sectors and their patients. We urge the European Data Protection Board and the European Parliament to support the ruling and National Governments to approve the draft decision.
We welcome the European Commission’s draft decision to recognise the adequacy of the UK data protection regime under Article 45(3) of the GDPR. We are hopeful that this decision will be approved and that the EU and UK can continue to benefit from having access to each other’s health data to facilitate the development of new treatments and to improve patient safety and care across Europe. Recognition of the adequacy of the UK data protection regime is vital for the functioning of the European health sector. It determines everything from the delivery of cross border health and social care for thousands of European citizens, to governing how health data is securely shared to advance research. This preliminary decision from the Commission is a positive first step to ensure the continued secure free flow of personal data between the EU and UK to protect the European health sector.
We urge the European Data Protection Board and European Parliament to support the ruling and National Governments to approve the decision to protect the European health sector. The free flow of data between the 27 EU Member States and the UK is long established and it provides clear benefits for parties in the health sector and beneficiaries of health services. In the health context, recognition of the adequacy of the UK data protection regime is instrumental to addressing cross-border health threats, such as COVID-19, and to facilitating quick and effective information exchanges between EU and UK regulators. An adequacy decision would greatly facilitate continuing cooperation between EU and UK researchers on clinical trials and epidemiological research, which saves and improves citizens’ lives and contributes to public health policy.
With an adequacy decision, EU organisations and businesses will also benefit from the ability to continue transferring personal data to the UK securely as they do now, without having to resort to costly and burdensome alternative transfer mechanisms. If there is no adequacy decision, the average costs to EU organisations and business setting up alternative data transfer mechanisms have been estimated at €3.300 for a micro-organisation, €11.000 for a small organisation, €21.511 for a medium organisation and €179.069 for a large business.[1] Without an adequacy decision, every transfer of personal data from the EU to the UK would be affected with immediate effect from 1st July 2021.
Formal adoption by the EU of the draft adequacy decision on the UK data protection regime will protect all European stakeholders’ capacity to exchange important health data for the management of cross-border health threats and the development and authorisation of new medicines.
When responding to a public health crisis from a communicable disease, the free exchange of personal health data under a mutually recognised data protection regime plays a critical role in understanding transmission, infection, and symptoms, and in identifying drug targets, developing vaccines and designing public health responses. The COVID-19 pandemic has clearly highlighted the critical value of international collaboration to advance scientific discovery when time is of the utmost importance. Services, such as the European Genome-phenome Archive (EGA), have proved to be vital resources during the COVID-19 pandemic. The EGA has facilitated data sharing and provided individual-level health data to accelerate coronavirus research. The UK is currently the biggest European contributor of personally identifiable genetic and phenotypic data. As of February 2021, the UK has shared over 2,000 datasets on the EGA, this is more than double the EU 27 countries’ contributions combined.[2]
Substantial exchanges of personal data between the EU and the UK also take place as standard practice in the context of international epidemiological research programmes on non-communicable diseases. For example, the CONCORD programme for the global surveillance of cancer survival, led by the Cancer Survival Group at the London School of Hygiene and Tropical Medicine, receives personal data on millions of cancer patients from more than 140 population-based cancer registries throughout the European Union.[3] The results are used in the European Union’s Country Health Profiles as part of the State of Health in the EU initiative.
Formal adoption by the EU of the draft adequacy decision on the UK data protection regime will safeguard access for EEA-qualified medical professionals to opportunities for clinical practice and research in the UK with minimal bureaucracy and will maximise patient safety.
Regulators of the medical profession in the EU and UK benefit greatly from the free flow of personal data, facilitating the mutual recognition of EU and UK qualified healthcare professionals. Adoption of the draft adequacy decision will avoid the need for EU and UK medical regulators to arrange bilateral agreements by 30th June 2021, in order to share the personal data needed to grant recognition of a healthcare professional’s qualifications. It seems improbable that all nine UK health and social care regulators would be able to negotiate arrangements with 27 individual countries, some of whom have multiple regulators at regional level, before the current adequacy arrangements expire. Without a data adequacy arrangement, if an EU Member State were to refuse to supply requested personal data about an incoming healthcare professional applying for registration in the UK on the grounds of confidentiality, the UK regulator might have to refuse to grant the application. Approval of the adequacy decision will help EEA applicants avoid difficulties and lengthy delays when applying for registration in the UK.
Formal adoption by the EU of the draft data decision on the UK data protection regime is crucial for ensuring that joint conduct of EU UK trials can continue uninterrupted and without additional administrative and financial burden. This is critical for patients in the UK, EU and beyond – and especially for patients with rare diseases.
Secure personal data transfers are essential for running joint EU-UK clinical trials. Patient data and test results need to be routinely transferred across international borders from trial sites to researchers conducting the analysis. Clinical trials investigating rare and childhood diseases, often driven by academia, are particularly reliant on multi-national data for patient recruitment to reach the requisite number of patients. Moreover, the UK contribution is recognised in more pan-European trials for rare and childhood diseases than any EU country,[4] thus contributing to the development of specialist expertise that all partners can draw on. For example, monogenic diabetes is a rare condition affecting just 1-2 per cent of people with diabetes and is caused by a single gene mutation. If identified, it can be life changing for the person living with the condition, replacing multiple daily injections with one daily tablet. The test for this requires a single blood sample, performed in the UK (Exeter) for the whole of Europe as part of the European Molecular Genetics Quality Network (EMQN) scheme.
The depth of EU UK collaboration on clinical trials is long established. In 2019, 40 per cent of the clinical trials in the UK were run with Member States.[5] This can be seen within the European Society for Paediatric Oncology Clinical Research Council where the majority of clinical trials on paediatric cancer are pan-European, including early trials that can offer life-saving opportunities for children with hard-to-treat malignancies.[6] This EU UK collaboration on clinical trials is vital and set to continue. As of February 2021, the UK is involved in 33 open or upcoming trials within the European Organisation for Research and Treatment of Cancer (EORTC).[7]
Without an adequacy decision researchers would have to resort to costly and burdensome alternative data transfer mechanics. The tripartite collaboration between FEAM, EASAC and ALLEA notes the substantial challenges to sharing data outside of the EEA, challenges that would apply to EU UK data transfer in the absence of a data adequacy agreement. Furthermore, all clinical trials sponsored by European pharmaceutical companies, representing €4.4million of investment per annum by those companies, would have to halt on 1st July 2021, as the EU would no longer be able to share safety monitoring forms with the UK.[8] This European investment needs to be protected by approving the draft data decision on the UK data protection regime.
In the immediate term, an adequacy decision would avoid the need for European researchers to invest time and money to comply with additional legal safeguards. In the long term, these legal barriers and costs may discourage collaboration, leading to both the EU and the UK losing out on opportunities to innovate and improve patient care. The reliance on international data and patient recruitment is only expected to grow, as future clinical trials will increasingly examine innovative treatment methods and group patients by specific and rare genetic profiles.
The alternatives to an adequacy decision for data transfer are complex, costly and burdensome. They would require lengthy approval processes and cause significant delays in data sharing. An adequacy decision is the most efficient way to provide certainty for European organisations, professionals, and patients in the long term.
If the draft data adequacy decision is not adopted before 30th June 2021, alternative transfer mechanisms will need to be put in place by EU data controllers, to enable personal data to continue to flow legally from the EU to the UK. Alternative transfer mechanisms are complex, costly and burdensome for EU organisations, businesses and citizens.
Standard contractual clauses are the most commonly used alternative transfer mechanism, but they may not be sufficient in light of the CJEU Schrems II ruling, that raised the bar for transfers of data from the EU to Third Countries.[9] As a result, supplementary measures may also be required in addition to standard contractual clauses as set out by the European Data Protection Board on 10th November 2020[10], which would further increase costs. Furthermore, the set wording of standard contractual clauses is currently under revision. This case highlights the importance of formally adopting an adequacy decision. It would provide long term confidence in the legality of the transfer of personal data between European organisations and the UK.
The UK has complied fully with the EU GDPR since the Regulation came into force in May 2018. The EU GDPR has also now been incorporated into UK legislation as the UK GDPR. This means that the principles and rules for processing personal data in the UK have not changed since the UK left the EU. The UK has committed to maintaining the same high standards of data protection and the UK-EU Trade and Cooperation Agreement includes articles to this effect. The UK has also introduced domestic legislation so that personal data can continue to flow freely, on a transitional basis, from the UK to the 30 EEA States and to the 12 countries that currently have EU adequacy decisions.
We urge the European Data Protection Board and European Parliament to support the draft adequacy decision on the UK data protection regime and for National Governments to approve the decision. Approval of the UK data protection regime will safeguard the significant benefits of the free flow of personal data and protect both patients and our common health interests.
[1] New Economics Foundation UCL European Institute (2020), The cost of data inadequacy: economic impacts of the UK failing to secure an EU data adequacy decision, accessed online February 2021. Exchange rate applied 1 GBP to 1.1 EUR.
[2] European Genome-phenome Archive (2021) Data extraction: EU/UK data flow from EGA 2015-2020.
[3] Allemani C, Matsuda T, Di Carlo V, et al., and CONCORD Working Group. Global surveillance of trends in cancer survival 2000–14 (CONCORD-3): analysis of individual records for 37,513,025 patients diagnosed with one of 18 cancers from 322 population-based registries in 71 countries, accessed online February 2021.
[4] Brexit Health Alliance (2018) The impact of Brexit: Patient access to medical research, accessed online February 2021.
[5] Wellcome Trust (2019) Brexit and beyond: Clinical trials, accessed online February 2021.
[6] SIOP Europe (2021) European Clinical Trial Groups, accessed online February 2021.
[7] EORTC (2021) Clinical trials database, accessed 10 February 2021.
[8] ABPI (2018) Pharmaceutical industry continues to invest significantly in UK research and development, accessed online February 2021. Exchange rate applied 1 GBP to 1.1 EUR.
[9] Data Protection Commissioner v Facebook Ireland Limited, Maximillian Schrems (Case C-311/18, “Schrems II”), 16 July 2021.
[10] European Data Protection Board (10 Nov 2020) Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, accessed online February 2021.