What are the implications of EU-UK data transfers for the European health care sector?

At this event organised by the European Health Stakeholder Group organised on 6 May, from 12:00 to 13:00, we tackle the challenge of international transfers of personal health data between the EU and the UK.

The transfer of data is essential for many functions within the European health sector. These transfers facilitate the delivery of cross-border health and social care, aid the movement of healthcare professionals, and support our response to health threats such as COVID-19. The sharing of health data also facilitates cooperation on clinical trials and epidemiological research.

In February, the European Commission published a draft adequacy decision on the UK data protection regime. An adequacy decision enables the unrestricted flow of personal data to a non-EU country. If approved, as far as transfers of personal data from the EU to the UK are concerned, the UK will essentially be treated as if it were still a member state.

To allow time for the EU to consider whether to grant such an adequacy decision, as part of the trade deal, the EU has agreed to delay transfer restrictions for a time limited period – either until an adequacy decision has been reached or until 30 June 2021 at the latest.

This session will focus on the importance EU-UK data transfers for the European health care sector, consider the likelihood of the UK being awarded adequacy, and raise awareness of additional steps health organisations will need to consider if adequacy is denied.

If a draft data adequacy decision is not reached before 30th June 2021, alternative data transfer mechanisms will need to be put in place to enable personal health data to continue to flow legally from the EU to the UK. This will place additional responsibilities on health organisations who control or process EU personal data. Furthermore, the CJEU Schrems II decision raised the bar for transfer of data from the EU to Third Countries using alternative data transfer mechanisms.

Under those circumstances, what would be the implications on European health organisations? What alternatives for data sharing are possible in the absence of an adequacy decision and what are their impacts?