Data protection and data-driven digital health innovation

The United Kingdom (UK) enjoys a dynamic digital health market characterised by innovation and growth, and encompassing both the private and public sectors. However, the development of new digital health technologies (DHTs) and solutions continues to face a challenging and multifaceted legal and regulatory landscape, including data protection laws, set for reform.

The past year has seen organisations in the UK continue to innovate, with a significant increase in the development, production and implementation of data-driven medical technologies and medical devices (MedTech), DHTs and digital transformation initiatives within the healthcare sector.

These trends are set to continue into 2023, with constant new ways for DHTs and devices to collect, track, analyse and utilise personal data, including arguably more revealing personal data such as specific genetic biomarkers and biological samples, on course to progress accordingly.

The impact of continued developments within the digital health sector will undoubtedly be significant, from both a patient- and industry-supply perspective. Increased access to these novel data-driven products could revolutionise the healthcare system in the UK. Promoting digital transformation across the health and social care system, the Government aims to embed digital technologies in the system. Such ambitious reforms include: digitising health and social care records; enabling digital diagnoses; expanding the functionalities of the two principal national digital channels, the NHS App and the NHS.uk website; devising clearer policies for accrediting DHTs that are likely to be adopted nationally by the NHS with the National Institute for Health and Care Excellence (NICE); and piloting a new early value assessment (EVA).

Aspiring to unlock the power of data, it is no surprise that the Government would seize the opportunity to rethink and support radical reforms. In the past year, significant changes to the data protection regime in the UK have been contemplated, from both a regulatory and a legislative perspective. At the heart of these proposed changes is the Government’s drive to promote data- driven innovation and to reduce regulatory burden in the post- Brexit and post-pandemic UK landscape.

As highlighted by the Information Commissioner’s Office (ICO) – the UK’s data protection supervisory authority – the effectiveness of any data-driven innovation relies on user engagement and public trust. To ensure that patients are suitably protected and to maintain public support for the continued development of such technologies and solutions, organisations must continue to take proactive steps to understand and meet their obligations under the current data protection regime, including those required by the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018) and the Privacy and Electronic Communications Regulations 2003 (PECR), while also staying abreast of the potential impact of the Government’s proposed reforms in the digital health sector.

The COVID-19 pandemic has seen many healthcare systems around the world come under unprecedented strain due to staff shortages, budget cuts and other financial pressures. Many healthcare providers, including the NHS in the UK, have there- fore adopted digital health solutions, such as remote patient monitoring (RPM) initiatives, to respond to these challenges.

RPM initiatives collect patient data via DHT platforms, MedTech and other digital products. The data collected is then shared with a healthcare professional for clinical assessment and diagnosis. The COVID-19 pandemic saw the adoption of RPM initiatives by many hospitals around the world as a new way of monitoring patients after their discharge from hospital, and in 2022, these RPM initiatives were utilised in other healthcare contexts, such as the management of chronic medical conditions. RPM initiatives and similar technologies are also increasingly featuring in the NHS’s plans to transform the UK health- care system; their use has been a focus in both the NHS 2022 delivery plan for tackling the backlog of elective care post- pandemic [1], and in the recent NHS publication [2] on the steps taken to increase operational resilience in preparation for winter 2022/23.

Alongside their clear clinical benefits, including reduced patient wait times, RPM initiatives come with a range of data protection and privacy concerns; in particular, the sharing of patient special-category data. To navigate this hurdle, NHS England’s Transformation Directorate has published practical, governance-focused guidance [3] for the use of RPMs which highlights the importance of undertaking Data Protection Impact Assessments (DPIA) prior to implementation, and of ensuringthat contractual data-sharing terms are put in place with RPM providers and relevant care partners, particularly given that the processing is likely to result in a high risk to the rights and freedoms of patients. The guidance further sets out that DPIAs should be continuously reviewed and updated while the RPMs are in use.

The large volume of data obtained by RPMs and similar technologies allows developers to establish a strong evidence base to analyse their performance and effectiveness. It also allows the NHS to analyse the levels of public engagement and to consider what improvements could be made in future service design and delivery. However, much of the data obtained is special-category (health) data relating to patients, so the lawful bases and legal grounds under which the data can be used for other purposes, including commercial purposes, are still limited at this time.

AI technology has huge potential to revolutionise healthcare in expediting diagnosis and treatment as well as minimising costs of delivery. The UK Government has recognised that “AI-driven technologies have the potential to improve health outcomes for patients and service users, and to free up staff time for care”[4]. Recent developments have enabled a breakthrough in heart disease screening [5], the prompt identification of people with high-risk factors of hepatitis C (which is otherwise difficult to detect at an early stage)[6] and the proactive screening of tumour regrowth in cancer patients to enable earlier treatment and improve outcomes [7].

However, the potential for huge medical gain is matched by high risks from a data protection perspective, which practitioners need to be alive to and be able to mitigate. Various studies have shown the importance of quality data input and the potential for inherent bias in the data pool which can skew outcomes [8]. A study conducted by the University of Oxford in relation to image- recognition technology that was developed based on AI algorithms to enable the classification of skin lesions showed that, as the data input was largely based on Caucasian patients, the tool struggled to identify lesions in patients with darker skin [9]. Likewise, research on oximeters to spot early signs of falls in oxygen levels, used increasingly during the COVID-19 pandemic, indicated that they performed better on lighter skin [10] and therefore delivered less favourable outcomes for ethnic minority patients. Data obtained from spirometers, which measure lung capacity, had also tended to indicate that ethnic minority users had lower lung capacity, an assumption that arose from racial biases in the data inputs into the AI tool. The ICO has rightly indicated that, due to these risks to the privacy rights and freedoms of individuals, AI will be one of its priority areas for regulation in 2023.

The ICO has also highlighted various considerations, directly derived from certain of the data protection principles, to ensure that the processing of personal data through AI is fair and lawful when designing a tool based on AI technology, including [11]:

• Privacy by design and default: Consider whether the use of AI is necessary or whether the end goals can be achieved by another, less high-risk, means. If AI is the preferred route, then an assessment of the risks involved should be carried out and appropriate safeguards put in place to mitigate the privacy risks.
• Transparency: Provide clear explanations of the decisions being made by AI-technology systems to individuals affected by such decisions.
• Data minimisation: Limit the amount of data used, and, to the extent possible, techniques such as perturbation or the use of synthetic data or federated learning should be employed.
• Mitigations: Implement appropriate safeguards to clean and define the labelling criteria for the data inputs at the outset, particularly given the potential for inherent bias in the collection of data.
• Security measures: Implement appropriate technical and organisational measures, such as the debugging of AI models, as a means of minimising the risk of unsatisfactory outputs.
• Human review of AI decisions: Build into the tool the possibility for meaningful human review of decisions made by AI, to be conducted by adequately trained and suitably senior staff with authority to override an automated decision.

It is widely recognised that the legislative framework currently in place to regulate AI in healthcare and more broadly is deficient as it was put in place before AI technology was contemplated. The European Commission has attempted to address this deficiency with its proposal for an AI Regulation (April 2021) [12], which seeks to more closely regulate high-risk AI systems with a sliding scale of rules based on the perceived risk to individuals.

For high-risk AI technology, the draft Regulation proposes to embed the need for human oversight of decisions made by AI tools and to promote data governance management practices that support the use of quality data inputs. It also proposes to impose penalties of up to €30 million or 6% of worldwide annual turnover for non-compliance [13], which surpass the maximum penalties under the UK GDPR. Although the Regulation is still in draft form, it could become the blueprint for other regula- tors seeking to introduce similar legislation, so AI developers should monitor the progression of the Regulation as a matter of priority.

In the UK, the Government has indicated its intention [14] to diverge from this legislative approach and to adopt a sector focused, non-statutory, light-touch regime which would seek to regulate the use of AI through industry guidance and codes of conduct. It would address high-risk concerns without placing unnecessary obstacles in the way of innovation. The National AI Strategy anticipates many AI-centric publications and consultations over the next decade, including a policy paper and white paper covering the Government’s pro-innovation position on the governance and regulation of AI in the UK. However, the Department for Digital, Culture, Media & Sport (DCMS) is yet to provide further detail of its plans, so it remains to be seen whether this proposed divergence from the approach in Europe will materialise.

Year on year, there is a significant increase in the use of MedTech, DHTs and digital initiatives by consumers, including wearable technologies and health apps that track physical activity and monitor various health conditions. This trend has continued post-pandemic with a steady stream of new products and technologies joining the market.

While healthtech products are increasing in popularity and becoming more common, there are several key considerations that developers need to consider when designing and maintaining their products in order to meet their obligations under UK data protection laws. This is because the vast majority of healthtech products operate by continuously collecting and processing large volumes of personal data (including special-category health data). Designers and developers should therefore ensure that users of their healthtech devices are fully informed of what personal data is being collected about them, and how it will be used and shared. They should also be able to identify an appropriate lawful basis to cover the processing activities carried out by the product. In addition, any algorithmic processing and AI used in conjunction with consumer healthtech should be accurate, fair and fully assessed to mitigate the risk of systemic bias [15].

The ICO’s Code of Practice for Consumer Internet of Things (IoT) Security also sets out practical steps for manufacturers of IoT devices to improve the security of the products and any asso- ciated services [16]. These steps include keeping software updated, securely storing credentials and security-sensitive data, ensuring personal data is protected, making systems resilient to outages and making it easy for consumers to delete personal data.

That said, healthtech is likely to be affected by the reforms proposed to the UK data protection laws. Amongst other things, the Data Protection and Digital Information Bill (DPDI) [17] sets out that moving forwards, references to processing special- category personal data under Article 9 of the UK GDPR for the purposes of scientific research will mean “any research that can reasonably be described as scientific”. This is expected to benefit those organisations designing and developing healthtech as it is expected to be an easier threshold to meet than the existing Article 9 wording which requires such processing to also be “proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and interests of the individual”.

The DPDI also proposes to include a general data processing consent for areas of scientific research where it is not possible to fully identify the scientific purposes (subject to certain conditions). This proposed position will allow organisations to expand their processing activities relating to special category data collected via healthtech, without the restriction of needing to obtain express and specific consent for all purposes from consumers upfront, which may not be possible.

Medical devices

A number of reforms on the horizon in the UK are due to impact the regulation of medical devices specifically. In particular, the Medicines and Healthcare products Regulatory Agency (MHRA) has announced plans to strengthen the regulation of medical devices to improve patient safety and encourage innova tion [18]. The proposed reforms are due to come into force in July 2024 and will include the following measures:

• Strengthening the MHRA’s power to act to keep patients safe.
• Making the UK a focus for innovation to become a world leader for developing and introducing innovative medical devices.
• Addressing health inequalities and mitigating biases throughout medical device product lifecycles.
• Introducing proportionate regulation which supports medical device businesses via new access routes that build on both EU and wider global standards.
• Setting world leading standards and building the new
  UKCA certification mark as a global exemplar.

Alongside these proposed reforms, the MHRA also announced the Software and AI as a Medical Device Change Programme [19] last year. Updates to the Programme introduced in October 2022 set out that, in respect of software as a medical device, specific cyber-security requirements will be introduced to mitigate the risks of both cyber-security vulnerabilities and issues presented by legacy software, medical devices and systems to patient safety and privacy [20].

As the existing medical device regulations in the UK do not currently provide sufficient safeguards in respect of novel and emerging medical device technologies, the reforms proposed by the MHRA to strengthen the regulation of medical devices are essential, both in ensuring patient safety and privacy and in continuing to encourage innovation. Medical device businesses should therefore actively monitor the medical device regulatory landscape and ensure that they have appropriate business and development plans in place to mitigate the impact of these proposed reforms.

NICE EVA

NHS England and NICE are also developing a policy frame- work which will include a new commissioning pathway for several types of healthtech products. The new policy frame- work will apply to broader MedTech and DHTs, such as medical devices and diagnostics, as well as purely digital technologies such as software and apps.

Until now, there has been no clear commissioning pathway for healthtech in the UK, so there has been a lack of clarity for developers regarding (i) what evidence is required to demonstrate that their product is clinically sufficient and cost-effective, and (ii) how to present such evidence in pursuance of a NICE recommendation for adoption across the NHS. There has been a similar lack of clarity for clinicians and commissioners on which DHTs should be recommended to patients, and which can be NHS-funded, so patients are often unable to access the most beneficial technologies for managing their health. The introduction of the policy framework and a new commissioning pathway therefore hopes to remedy this.

One of the biggest changes proposed in the new commissioning pathway is the introduction of an EVA as a means of allowing healthtech products with smaller or emerging evidence bases to obtain a conditional NICE recommendation for use across the NHS without having to undergo a full NICE assessment. As healthtech products are required to demonstrate a mature evidence base before they are eligible to undergo a full NICE assessment, the hope is that healthtech assessed via the EVA could benefit NHS patients sooner than via current evaluation methods. Healthtech developers will then be encouraged to use the time while their product is under the conditional NICE recommendation to generate additional evidence of the product’s clinical and cost- effectiveness and to address any gaps identified during the EVA.

NICE are planning to pilot the EVA across a range of healthtech products and use cases and data-collection infrastructures as a means of identifying and resolving any specific concerns, such as patient-related privacy and data protection concerns, with the new commissioning approach. At the time of writing, the policy framework and the new commissioning pathway (including the EVA) are due to be launched in Spring 2023.

Many of the changes proposed to the UK’s data protection reform consultations in the past 12 months will continue to progress in 2023. These proposed changes will have a significant impact on businesses in the digital health sector, particularly for those processing large volumes of special-category personal data and/or using AI tools or automated decision-making within their processing activities.

The DPDI

On 17 June 2022, the DCMS published its response to the “Data: A New Direction” [21] consultation.  Annex A of the response confirmed which of the proposed reforms to the UK’s data protection regime would be taken forward, which would not, and which still required further consideration as part of the Government’s plan to update and introduce legislation in this area.
Shortly after the DCMS published its response, the DPDI was laid before Parliament, with the aim of simplifying the UK’s data protection regime post-Brexit by amending, not replacing, existing UK data protection legislation, including the UK GDPR, PECR and DPA 2018.

Some of the more pertinent proposed reforms for the digital health sector within the DPDI which the Government plans to take forward include:

• Creating a statutory definition of scientific research based on recital 159 of the GDPR. The Government intends to simplify the legal requirements around research so that scientists and researchers are no longer impeded by “overcautious and unclear rules” on how they can use people’s personal data for scientific research, which will have a significant impact on the breadth and scope of scientific research in future.
• Incorporating broad consent for scientific research purposes within the data protection legislation. This will allow scientists and researchers to use a person’s personal data for scientific research purposes without the need to obtain that person’s specific consent to the purposes of processing.
• Removing the requirement on organisations to conduct DPIAs or undertake prior consultation with the ICO in relation to high-risk processing, and instead, allowing organisations to adopt different approaches to identify and minimise data protection risks that better reflect their specific circumstances. Removing this regulatory burden will likely have a large impact on organisations within the digital health sector where high-risk processing (such as using novel data collection methods to collect and process large volumes of sensitive patient data) is frequent.
• Removing the requirement to obtain user consent in relation to the use of analytics cookies and/or similar technologies. The DPDI sets out a proposal to treat analytics cookies and/or similar technologies in a similar way as “strictly necessary” or “essential” cookies which can be set without a user’s consent. Similarly, the DPDI proposes to remove the requirement to obtain user consent for the use of analytics cookies and/or similar technologies in instances where an organisation either (i) uses such cookies or technologies in compliance with an ICO-approved sector code or regulatory guidance, or (ii) demonstrates a legitimate-interest legal basis for processing any data obtained by the cookies and/or technologies. This proposed reform could have a substantial impact for those in the digital health sector as it will streamline digital development and allow organisations that use such cookies, for example to measure traffic to a webpage or app, or to improve service offerings to users, to obtain consent from users prior to deploying such cookies.
• Increasing fines under PECR. The DPDI also proposes to increase the fines under PECR to align with the maximum penalties set out in the UK GDPR and DPA 2018. This increase would enable the ICO to issue organisations with fines of up to £17.5 million or 4% of global turnover for breaches of certain regulations under PECR, and up to £8.7 million or 2% of its global turnover for other breaches of PECR, which could have a significant impact in the digital health sector where initiatives such as digital tracking technologies and electronic communica- tions feature heavily.
• Reforming and enabling the DCMS Secretary of State’s adequacy-making powers. This suggestion sets out a proposed deviation from the European Commission’s third-country adequacy test, towards a new and more flex- ible data protection test where the standard required from a third country is not that it must have an “essentially equivalent” standard of data protection to the country of export, but rather that it must not have a “materially lower” standard of data protection. This divergence with the EU’s approach to international transfers could jeopardise the UK’s adequacy decision and could ultimately result in new restrictions on international transfers between the UK and the EU being implemented.
• Enabling businesses to use sensitive personal data for the purpose of managing the risk of bias in their AI systems by providing legal clarity on how such sensitive personal data can be used to carry out bias monitoring, detection and correction. This proposed reform will be subject to appropriate safeguards, such as limitations on re-use and the implementation of security- and privacy- preserving measures when processing for this purpose. Although the DPDI was scheduled to have its second reading on 5 September 2022, it was determined that further consideration of the proposed reforms was needed, so the second reading did not take place as scheduled and a new date is still awaited.

The impact of the reforms set out in the DPDI, if and/or when they come into effect, therefore remain to be seen; however, for organisations wishing to monitor this development, progress of the bill through the relevant parliamentary stages can be tracked via the UK Parliament website.

UK international data transfers

Following the ICO’s public consultation on how best to protect individual’s personal data when transferred outside of the UK, and following Parliamentary approval, the following new data- transfer mechanisms came into force in the UK on 21 March 2022:

• The International Data Transfer Agreement [22] for use by data exporters in the UK, which serves as an alternative to the EU Standard Contractual Clauses, as issued under the European Commission Implementing Decision (EU) 2021/914 (EU SCCs).
• The international data transfer addendum to the EU SCCs (UK Addendum)[23] for use by data exporters in the UK where the data being exported is from both the EU and the UK and which is utilised in conjunction with the EU SCCs.
• Transitional provisions (Transitional Provisions) [24] for use by data exporters in relation to contracts entered into on, or before, 21 September 2022, which permit the continued use of standard data protection clauses in such contracts until 21 March 2024, provided that the contract includes the appropriate safeguards referred to in Article 46(1) of the UK GDPR and that the processing activities that are the subject matter of the contract remain unchanged.

The ICO further introduced a new transfer risk assessment (TRA) tool, following the CJEU’s judgment in 2020 of case C-311/18 (Schrems II), which organisations looking to rely on one of the UK data-transfer mechanisms must carry out.

A TRA is required under UK data protection legislation as a means of demonstrating that an organisation has considered the risks to the rights and freedoms of natural persons and has ensured that enforceable data-subject rights and effective legal remedies for data subjects are available in the country of import prior to making a data transfer.

Practically, the introduction of the UK data-transfer mecha- nisms, as well as the requirement to conduct a TRA in respect of them, may pose operational challenges for those organisa- tions transferring large volumes of personal data outside of the UK on a regular basis; many organisations will likely need to conduct a substantial repapering exercise prior to the Transi- tional Provisions deadline, and many may need to reconsider their data protection governance with regards to international data transfers.

However, the main aim of each of the UK data-transfer mech- anisms and the TRA tool is to facilitate the flow of data from the UK to non-adequate jurisdictions while maintaining high stand- ards of protection of the data being transferred. Their introduc- tion is expected to have a positive impact on the digital health sector by maintaining and creating trade opportunities with non-adequate countries, many of which are major players in the digital health sector such as China, North America, Australia, Brazil and India.