Abstract
The Brexit effect on the transfer of data and samples within a healthcare context is, of course, the result of the UK’s exit from the EU, which placed the UK outside the EU and made it a third country with respect to the EU. The answer to the burning question takes into consideration the de-regulation and re-regulation of EU retained law, looking closely at the principal concerns about how data and samples will be transferred. Furthermore, viable contractual clauses as a means of lawful transfer are discussed, as well as the EU Commission’s decision evaluating the adequacy of the UK legal framework to ensure protection for data transfers.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Notes
- 1.
The government did issue a technical note giving guidance on data protection post-Brexit; however, this guidance was withdrawn on 1 March 2019.
- 2.
The European Data Protection Board’s note of February 2019 states that the UK will become a third country unless there is a negotiated settlement on the issue. European Data Protection Board, Information Note on Data Transfers under the GDPR in the Event of a No-Deal Brexit, on 12 February 2019 (updated on 4 October 2019). https://edpb.europa.eu/sites/default/files/files/file1/edpb-2019-02-12-infonote-nodeal-brexit-october_en.pdf.
- 3.
The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019. https://www.legislation.gov.uk/ukdsi/2019/9780111177594/contents.
- 4.
In May 2017, a cyber-attack on the UK’s NHS locked many health service computers. This highlighted concerns regarding health data confidentiality, ownership and cyber-bulling.
- 5.
There is not only the GDPR to consider here but also the Council of Europe’s modernisation convention for the protection of individuals with regard to the processing of personal data, known as modernised convention 108. This international convention also states that health data is a special category of data.
- 6.
Human Tissue Act, 2004. https://www.legislation.gov.uk/ukpga/2004/30/contents.
- 7.
European Data Protection Board, Information Note on Data Transfers under the GDPR in the Event of a No-Deal Brexit, on 12 February 2019 (updated on 4 October 2019), see note 2, p. 2–4.
- 8.
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance), O.J.4.5.2016 L 119/1, see art. 45 (1).
- 9.
The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019, see note 3, Schedule 2, Part. 2 (general processing), 23: ‘17A Transfers based on adequacy regulation’, (3):‘Regulations under this section may specify that the Secretary of State considers that an adequate level of protection of personal data is ensured only for a transfer specified or described in the regulations’; ‘17B Transfers based on adequacy regulations: revie etc’ ‘[…] the Secretary of Sate must carry out a review of whether the country, territory, sector or organisation ensures an adequate level of protection of personal data at intervals of not more than 4 years’.
- 10.
Ibid., 74A ‘Transfers based on adequacy regulations’.
- 11.
The lead supervisory authority is a designated supervisory authority and means that an organisation need not deal with all of the supervisory authorities in countries in which data transfer occurs. The lead supervisory authority acts on behalf of all EEA supervisory authorities and is known as a one-stop shop.
- 12.
This act excludes reproductive material which is governed by the Human Fertilisation and Embryology Act 2008 as amended.
- 13.
See Human Tissue Act 2004, see note 6, Part.1, art.1. The Act handles material from a live person differently from material of a dead person.
- 14.
Ibid., art. 2. For children, this depends on whether the child is considered as competent to deal with the issues. If they are not competent, then consent is required from an appropriate adult, usually the parents.
- 15.
Ibid., Part. 2, art. 13.
- 16.
The Authority may provide directions and impose requirements in relation to the conduct of the activity that the licence authorises. These directions may be important if there are likely to be changes in the purposes of the activities licenced.
- 17.
Ibid., art. 26.
- 18.
Medical Research Council, MRC Ethics series, Using Information about People in Health Research, June 2018. https://www.ukri.org/wp-content/uploads/2021/08/MRC-0208212-Using-information-about-people-in-health-research-2018.pdf; Medical Research Council, MRC ethics series, Human Tissue and Biological Samples for Use in Research: Operational and Ethical Guidelines, November 2014. https://www.ukri.org/wp-content/uploads/2021/08/MRC-0208212-Human-tissue-and-biological-samples-for-use-in-research.pdf.
- 19.
Beyond these principles, the guidance also notes that researchers cannot own a human body or a sample from that human body once it has been removed from the donor.
- 20.
There are three different types of MTAs: agreements between academic institutions/research institutions; agreements between academic institutions and industry; and agreements between industry. These agreements are primarily between academic/research institutions for use in research. The agreements set out a number of permitted uses and, therefore, need to cover such issues as confidentiality, ownership, access to the results of the research and liabilities, inter alia. Any commercial potential should also be written into the agreement.
- 21.
These categories divide the types of samples into various groups; those which are infectious agents and those which are not infectious. Infectious biological material is given the number UN3373 biological substance category B.
References
Choromidou A (2021) EU data protection under the TCA: the UK adequacy decision and the twin GDPRs. Int Data Priv Law 4:388–401
Schwartz PM (2021) The data privacy law of Brexit: theories of preference change. Theoret Inq Law 22:111–152
Stolton S (2020) UK to diverge from EU data protection rules, Johnson confirms. EURACTIV. https://www.euractiv.com/section/digital/news/uk-to-diverge-from-eu-data-protection-rules-johnson-confirms/
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2023 The Author(s), under exclusive license to Springer Nature Switzerland AG
About this chapter
Cite this chapter
Christ, H. (2023). Brexit Effects. In: Colcelli, V., Cippitani, R., Brochhausen-Delius, C., Arnold, R. (eds) GDPR Requirements for Biobanking Activities Across Europe. Springer, Cham. https://doi.org/10.1007/978-3-031-42944-6_8
Download citation
DOI: https://doi.org/10.1007/978-3-031-42944-6_8
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-42943-9
Online ISBN: 978-3-031-42944-6
eBook Packages: Law and CriminologyLaw and Criminology (R0)