European Stakeholder Group Statement – Maintaining the exchange of critical health data

We welcome the draft adequacy decision on the UK data protection regime issued by the European Commission on 19 February 2021. Protecting the benefits of the free flow of personal data must be a top priority. The absence of an adequacy decision would negatively affect the UK and EU health sectors and their patients. We urge the European Data Protection Board and the European Parliament to support the ruling and National Governments to approve the draft decision.

We welcome the European Commission’s draft decision to recognise the adequacy of the UK data protection regime under Article 45(3) of the GDPR. We hope that this decision will be approved and that the EU and UK can continue to benefit from having access to each other’s health data in order to facilitate the development of new treatments and improve patient safety and care across Europe. Recognition of the adequacy of the UK data protection regime is vital for the functioning of the European health sector. It determines everything from the delivery of cross-border health and social care for thousands of European citizens to governing the security of health data shared with the purpose to advance the research. This preliminary decision issued by the Commission is a positive first step to ensure the continued secure free flow of personal data between the EU and UK. Therefore, we call on the European Data Protection Board and European Parliament to support the ruling and National Governments to approve the decision to protect the European health sector.

The free flow of data between the 27 EU Member States and the UK is long established and it provides clear benefits for parties in the health sector and beneficiaries of health services. In this context, recognition of the adequacy of the UK data protection regime is instrumental to addressing cross-border health threats, such as COVID-19, and to facilitating quick and effective information exchanges between EU and UK regulators. An adequacy decision would greatly facilitate continuing cooperation between EU and UK researchers on clinical trials and epidemiological research, which saves and improves citizens’ lives and contributes to public health policy.

With an adequacy decision, EU organisations and businesses will also benefit from the ability to continue transferring personal data to the UK securely as they do now, without having to resort to costly and burdensome alternative transfer mechanisms. If there is no adequacy decision, the average costs to EU organisations and business setting up alternative data transfer mechanisms have been estimated at €3.300 for a micro-organisation, €11.000 for a small organisation, €21.511 for a medium organisation and €179.069 for a large business. Without an adequacy decision, every transfer of personal data from the EU to the UK would be affected with immediate effect from 1 July 2021.

Read the full statement.