EU-UK data deal protects the NHS

On 28 June, the European Commission adopted a so-called adequacy decision allowing the continued flow of personal data from the EU to the UK. But what does this mean in practice?

Data may not be the sexiest of subjects, but data transfers underpin our entire NHS and European health sector. The sharing of data is vital to addressing cross-border health threats such as COVID-19 and enabling the movement of professionals, not to mention vital for facilitating crucial health research, development, and cooperation. Failing to secure a data deal with the EU would have been a disaster for the NHS.

During COVID-19, we have experienced first-hand how European collaborations, underpinned by data transfers, improve patient outcomes and ultimately saves lives. It is thanks to this new data deal that the joint EU-UK trials will continue uninterrupted and without additional administrative and financial burden. It is also thanks to this deal that the UK will remain an attractive destination for new clinical trials and that EAA-qualified medical professionals will avoid facing difficulties and lengthy delays when applying for registration in the UK.

We have experienced first-hand how European collaborations, underpinned by data transfers, improve patient outcomes and saves lives

I am not saying that without this deal these activities would have been impossible, however NHS trusts and researchers would have needed to implement costly and burdensome alternative transfer mechanisms to continue to receive the EU data required for these activities. The average cost to establish these alternatives has been estimated at £19,555 for a medium organisation and £162,790 for a large organisation1. These are costs that the NHS can ill bear to afford.

The twists and turns

Given the vital importance of data sharing for the NHS, we have worked tirelessly to get this data deal over the line, and it was certainly a bumpy ride! Let’s recap the twists and turns:

13 March 2020: The UK submitted its bid for adequacy in March 2020. However, 11 months later with Brexit just days away, the EU assessment was incomplete. The NHS and EU health sectors was facing a no-deal scenario with personal data transfers from the EU stopping on 1 January 2021 unless costly and burdensome alternative transfer mechanisms were in place.

24 December 2020: At the very last minute, an interim data sharing agreement was agreed ahead of 1 January 2021 buying much needed time for the EU to complete the assessment process for the UK data deal. After months of uncertainty, Health leaders breathed a sigh of momentary relief. However, the interim agreement was only in place until the 30 June 2021. Time remained short to reach a deal and we remained concerned.

19 February 2021: Fast-forward to February 2021, the European Commission published its draft data deal. This deal was the first step to protecting the European healthcare sector and was warmly welcomed by the NHS. Progress at last!

13 April 2021: This was followed by more positive news in April 2021, with the European Data Protection Board paving the way for continued sharing of personal health data between the EU and UK despite some areas of concern. Healthcare leaders were cautiously optimistic.

28 May 2021: Then a bump in the road. The European Parliament narrowly voted for the Commission to modify the draft adequacy decision, insisting that no decision should be granted unless their concerns were addressed. This decision focused on concerns around UK intelligence practices and despite having no read across to health, threatened the sharing of health data too. The European Parliament’s decision ignored the real-life health implications. With just over one month to go further delays and a no-deal scenario were all back on the table.

28 June 2021: Finally and despite a further last-minute intervention from MEPs, the European Commission recognised the need for and adopted a data deal for the UK, just days before the interim agreement expired.

That members saw no change to personal data transfers from EU to the UK on 30 June 2021 means we have achieved our goal

After 16 long months, it is finally time to celebrate continuity, certainty and ongoing collaboration for the benefit of all. Without adequacy, the impact would have been felt across the entire healthcare sector, without exception and during a global pandemic. It is precisely the fact that members saw no change to personal data transfers from EU to the UK on 30 June 2021 that means we have achieved our goal.

Rosie Richards is head of European data and research policy at the NHS Confederation. Follow the Confederation on Twitter @NHSConfed