Looming deadline on post-Brexit data agreement has researchers worried

Data flow disruptions between the EU and UK would be a “lose-lose situation”.

27 April 2021

ANDREAS SOLARO/AFP via Getty Images

Scientists and data experts are warning that some key collaborative research projects between the European Union (EU) and the UK will be obstructed if a data-adequacy agreement concerning the institutional transfer of personal data across borders is not soon reached. The EU is examining whether UK rules on personal data protection are sufficient and consistent with those of the EU post-Brexit.

An announcement is due by 30 June at the latest. Under the EU General Data Protection Regulation, personal data cannot normally be shared unless a data subject has provided informed and explicit consent to data processing.

“We are hopeful that the outcome will be positive, but we are concerned, because the free flow of data between the EU and UK is vital to all aspects of progressive research and patient care,” says Rosie Richards, senior European policy manager at the UK National Health Service (NHS) Confederation, which represents organizations that commission and provide NHS health services.

The European Health Stakeholder group – a consortium of hospital and healthcare federations – has indicated that all clinical trials would cease if the EU decided UK data-protection rules were inadequate.

Worries also persist over longer-term divergence on data protection between the EU and UK that may arise from political differences and future legislation. Collaborations in genomics, cancer research, Earth observation and artificial intelligence (AI), among others, face disruption.

In healthcare, multilateral projects that would be affected include CONCORD, which is run by the London School of Hygiene and Tropical Medicine and depends on the international exchange of data from one million cancer patients to monitor cancer survival rates.

Research at the Wellcome Sanger Institute, a Cambridge-based organization that conducts genome sequencing, is also at risk. Scientists at the institute rely on data provided by its EU partners for its Human Cell Atlas project, which aims to understand every single cell in the human body, for example.

On the EU side, Holger Hoos, professor of machine learning at the Leiden University in the Netherlands, says freely flowing data across Europe is indispensable to AI technology development in several research areas. These include personalized medicine using genetic data, and Earth climate and environmental monitoring by the European Space Agency (ESA).

“The UK is a very important player both in precision medicine and in the ESA,” says Hoos. “If it diverges on data protection, the UK could find itself isolated. This would be to the UK and EU’s detriment – a lose-lose situation.”

Millions in investment at risk

Many research institutions are taking precautions against an adverse EU decision.

The Wellcome Sanger Institute, for example, has placed its data platform within the EU to avoid disruption. Others in the UK are preparing special contracts to ensure continuing smooth data flow should UK rules be deemed inadequate.

“It’s not that we won’t be able to share personal data; there are alternative international data transfer mechanisms,” says Richards. For example, a UK institution could negotiate an agreement with an institution in another country within the EU. “But these are costly, burdensome and cause unacceptable delays.”

Investigations by the University College London European Institute and British think-tank, the New Economics Foundation, suggest that it could cost medical-research institutions £50,000 to £100,000 (roughly US$70,000 to $140,000) to negotiate a data-sharing agreement with an institution in another country.

This exceeds comparable costs for most private companies because the contracts take more time to prepare due to the sensitivity of the data, which may include tissue samples, for example.

A recent British law, the Investigatory Powers Act, which allows the government to access personal data without the consent or knowledge of an individual or any opportunity for recourse, may prove an obstacle to an adequacy agreement.

“I would not be surprised if the EU decided against an adequacy decision because of this legislation,” says Penny Bygrave, senior associate at London-based law firm, Veale Wasbrough Vizards.

Any agreement would be due for review within four years, causing further uncertainty, says Richards.

UK prime minister Boris Johnson has indicated that the UK will seek to diverge from EU data protection rules and establish its own "full sovereign controls".

“I am deeply of the opinion that it would be a tragedy if we didn’t gain data adequacy,” says Hoos.