Commentary on provisions of Bill Section 4: Data processing
As part of a reciprocal healthcare system, "authorised persons" may need to share personal data (including medical/health data) between themselves within the UK, or receive from or share personal data with, equivalent persons or bodies overseas in the EEA or Switzerland, to enable the reciprocal healthcare system to function. Prior to this Act, EU law provided the necessary powers to do this. This section provides a legal basis for processing data to facilitate reciprocal healthcare as part of an agreement with an EEA state or Switzerland or the EU.
	This section provides a basis for facilitating data processing to support the making of payments, or provision for payments to be made, for healthcare in an EEA state or Switzerland and the giving effect to healthcare agreements as provided for by the Act.
	For example, if after EU exit a person who is paid a UK pension but resides in Spain is to have their healthcare funded by the UK, it may be necessary for the relevant Spanish healthcare provider to share information with the relevant government department in the UK to determine that the person is in receipt of a UK pension and to confirm that person’s identity. The government department in the UK may need to share personal data to confirm the person’s identity and their receipt of a UK pension, so that the reciprocal healthcare arrangement in this scenario can operate correctly. They would do so in reliance on this section. The Spanish healthcare authority would rely on its own domestic powers to process data.
	It may sometimes be necessary for healthcare providers to share medical information to facilitate treatment. This includes when someone requests to give birth or have treatment from a provider in an EEA state or Switzerland (as currently happens using the ‘S2 route’), and may sometimes happen when someone needs urgent healthcare (using the EHIC entitlement) and the provider requests information about their medical history to ensure they provide safe and effective care.
	"Authorised person" is defined in section 4(6) and includes the Secretary of State, Scottish Ministers, Welsh Ministers and a Northern Ireland department, providers of healthcare and other NHS bodies (such as Special Health Authorities which may have administrative functions in relation to the NHS but do not provide healthcare directly).
	Subsection (6)(e) enables the Secretary of State to make regulations adding other persons to the list of authorised persons. These regulations would be subject to the draft affirmative procedure. This regulation making power enables the Secretary of State to update the list of authorised persons to ensure that any person or body who is vital to the operation of a future reciprocal healthcare system would be able to process personal data to support its operation.
	Personal data means any information relating to an identified or identifiable living individual.
	As the personal data in question may include information about medical treatment to which the duty of confidence would attach, this section overrides an obligation of confidence owed by the person processing the personal data, or any other restriction that would apply to the processing of that personal data. However, any such processing must continue to comply with data protection legislation (as defined in section 3 of the Data Protection Act 2018). Section 4(3) of this Act expressly provides that nothing in section 4 authorises the processing of personal data which contravenes UK data protection legislation or relevant parts of the Investigatory Powers Act 2016 (or the Regulation of Investigatory Powers Act 2000 until its repeal).