What happens to data sharing agreements with the EU after Brexit?

The UK will formerly leave the European Union on 31 January at 11pm – so what does Brexit mean for data sharing, health tech and the NHS?

As established in the Withdrawal Agreement Act 2020, the UK will enter into a transition period until 31 December 2020.

During this time the UK continues to participate in the EU Customs Union and Single Market, but new trading relationships will need to be established during the transition period.

What does the withdrawal agreement say about data sharing?

Neil Ross, programme manager for digital economy at techUK, told Digital Health said both sides will need to reach a data sharing agreement by the end of the Brexit transition period.

All current data sharing agreements between the UK and EU will be subject to a adequacy agreement – this will allow data to continue being shared without further safeguarding being necessary.

“The revised political declaration sets the basis for the assessment by the European Commission to begin as soon as possible after the United Kingdom’s withdrawal from the EU and commits both sides to endeavour to reach a decision by the end of 2020,” he said.

Do you have to apply for an adequacy agreement?

The good news is that tech companies, NHS trusts and any other organisation or party that currently has a data sharing agreement with the EU won’t have to do anything to ensure that data can still be shared.

Unless otherwise specified in the Withdrawal Agreement, techUK says it is “business as usual” until the transition period is over.

But when the UK leaves the EU it will no longer be part of common data protection frameworks, including GDPR, meaning any data sent to and from the UK will need sufficient protections to comply with EU law. That’s where an adequacy agreement comes into play.

“Whether or not the UK receives an adequacy decision, the UK will no longer be bound by common rules on data protection with the EU. This means the UK will need to develop its own regime for transferring data abroad to third countries as well as having the freedom to design its own rules on the use of personal data,” Ross said.

“We don’t know exactly what effects these will have as this will be dependent on what agreements the UK reaches with other countries. However, the UK Government has committed to a high standard of data protection.

“We must collectively urge the UK Government and the EU to engage in good faith and move quickly to conclude the process.”

As it stands, the Government has not indicated it intends to change the UK’s data protection laws.

“Depending on whether/how the UK changes its data protection rules this may have an impact the longevity of a EU adequacy agreement. These agreements are reviewed at least every four years by the European Commission,” Ross added.

“If the UK were to radically change its data protection rules, this adequacy decision could be removed and would mean the UK would need to exchange data on third country terms with the EU.”

The future relationship between the EU and the UK after Brexit, including data adequacy, will supersede the transition period to establish the new trading and economic relationship, according techUK.

How could this impact healthcare in the UK?

Any changes to data sharing agreements are likely to impact how the NHS and healthcare providers handle data.

“Currently health data is a special category under GDPR, requiring more stringent treatment. At the point of exit the UK will still have the same rules as the EU,” Ross explained.

“However, these could be reviewed over time, changing how health data is handled.

“It is also worth noting that currently there are no known plans to change the UK’s data protection rules, meaning that if the UK receives an adequacy decision there will be almost no change in the day-to-day when handling of health data after the end of the transition period.”

Why data sharing is vital

techUK has previously warned that the full power of innovative digital technologies would not be achieved in the even of a no-deal Brexit.

This was largely down to concerns there would be delays in sharing vital data to inform research.

While the UK and EU have since decided on a deal, the value of data sharing remains the same.

“Realising the full economic and social power of advanced, innovative digital technologies will not be achieved without data,” Ross previously wrote in a blog.

“Data is the fuel powering innovative fourth industrial revolution technologies such as the Internet of Things, machine learning, AI and autonomous connected vehicles.

“If data is not able to flow smoothly between the UK, Europe and the rest of the world the UK’s ability to unlock the productive power of current and future digital technologies, as well as to continue to be a world leader in the development and adoption of responsible, digital innovation, will be put at risk.”