In February 2021, the European Data Protection Board (EDPB) published two opinions on the European Commission draft Implementing Decisions on the adequate protection of personal data in the United Kingdom.

The EDPB has since announced that it has adopted its opinion on the draft adequacy decision issued by the European Commission.

Although the EDPB opinion is not binding, the adequacy decision will be formally implemented if approved by the EU member states.  

WHY IT MATTERS

Adequacy decisions are critical in granting data flows between the EU and the UK, particularly in the post-Brexit environment. The process enables the EU to decide whether countries outside the bloc offer an adequate level of protection for the data of EU citizens.  

The EDPB ensures consistent application of the GDPR, ensuring lawful and fair processing for legitimate purposes, data quality and proportionality, data retention, security and confidentiality, and transparency.

The executive summary of the draft claims that the EDPB focused on the assessment of the general GDPR aspects of the draft decision. It also looked at the access by public authorities to personal data transferred from the EEA for the purposes of law enforcement and national security, including the legal remedies available to individuals in the EEA. The EDPB also assessed whether the safeguards provided under the UK legal framework are in place and effective.

The decision states: "The EDPB’s key objective is to give an opinion to the European Commission on the adequacy of the level of protection afforded to individuals in the UK. It is important to recognise that the EDPB does not expect the UK legal framework to replicate European data protection law."

 “Health leaders will welcome this opinion. It gives the green light to UK data protection standards, paving the way for uninterrupted sharing of relevant health data between the EU and UK.  

- Dr Layla McCay, director of policy at the NHS Confederation

THE LARGER CONTEXT 

In light of the digital health transformation experienced during the pandemic, European countries have pushed for a European health data space which requires interoperability on a European level.

Recently, former UK prime minister, David Cameron lobbied the NHS for access to staff’s personal data, weeks into the COVID-19 pandemic.

ON THE RECORD

Dr McCay explained: “Recognition of the adequacy of UK data protection standards is instrumental in addressing health threats such as COVID-19 and the delivery of cross-border health and social care. Crucially, data adequacy also provides the conditions for UK and EU researchers to co-operate on clinical trials and other health research, and in turn, save and improve lives.  

“We hope the draft data adequacy decision will be approved, and that the NHS and European health care systems can continue to benefit from having access to each other’s health data where needed, as it will support the development of new treatments and improve patient safety and care. We urge the European Parliament to support the preliminary decision and national governments to approve the decision before 30 June. Protecting the free flow of data must be a top priority to safeguard healthcare, research, and above all, patients.”

Healthcare IT News is a HIMSS Media publication.