L.H. v. Latvia

In the case of L.H. v. Latvia (Application no. 52019/07) the ECtHR found a violation of Article 8 of the Convention regarding the processing of health data without sufficient legal basis by a Latvian authority.

Facts

While the applicant, L. H., was giving birth in 1997, a Caesarian section was used and in the course of that surgery a tubal ligation, resulting in sterilisation, was performed without her consent. Following an unsuccessful attempt to achieve an out-of-court settlement, she brought civil proceedings against the district hospital in February 2005 and, in December 2006, was awarded compensation for the unauthorised sterilisation. In the meantime, in February 2004, the Inspectorate of Quality Control for Medical Care and Fitness for Work (MADEKKI), on request by the district hospital’s director, initiated an administrative inquiry concerning the gynaecological and childbirth assistance provided to Ms H. from 1996 to 2003. The MADEKKI received medical files from three medical institutions and, in May 2004, issued a report containing sensitive medical details, and the summary of the conclusions was sent to the hospital director. Ms H.’s lawyer lodged a claim before the administrative courts, complaining that the inquiry had been unlawful, in particular since its essential purpose had been to help the hospital to gather evidence for the impending litigation, which was outside the MADEKKI’s remit. The lawyer also requested to annul the report. Ms H.’s claim was rejected by the Administrative District Court in a decision eventually upheld by the Supreme Court (SC) in February 2007.

In her application Ms. L.H. complained that the collection of her personal medical data by a State agency had violated the right to respect for her private life, guaranteed by Article 8 of the Convention.

Violation of Article 8

Since there was no contradiction between the parties that the applicant’s medical data formed part of her private life and therefore the collection of such data by the MADEKKI constituted an interference with her right to respect for her private life, the Court proceeded to analyze whether the interference complied with the requirements of the second paragraph of Article 8 of the Convention.

The ECtHR reiterated that the expression “in accordance with the law” requires that

the impugned measure to have some basis in domestic law, which should be compatible with the rule of law, which, in turn, means that the domestic law must be formulated with sufficient precision and must afford adequate legal protection against arbitrariness. Accordingly the domestic law must indicate with sufficient clarity the scope of discretion conferred on the competent authorities and the manner of its exercise.

In this respect it noted that the Government referred to interpretation of the domestic law of the SC regarding the relevant domestic law, according to which the authority may assess the quality of medical care provided in medical institutions upon receiving requests from medical institutions, and was authorized to collect information and documents relating to questions within its field of competence.Therefore, since errors of fact or law allegedly committed by a national court falls under the Court’s supervision in so far as they may have infringed rights and freedoms protected by the Convention, it turned to the interpretation of section 11(5) of the Personal Data Protection Law (DPL) given by the Supreme Court. This section provides that personal data may be processed without the consent of the data subject if it is necessary for the purposes of medical treatment or the provision or administration of heath care services.

It noted that the MADEKKI started to collect the applicant’s medical data seven years after her sterilisation, during the civil litigation. In the Court’s view this lengthy delay raises a number of questions: whether data collection can be deemed to have been necessary for the purposes set out in section 11(5) of the DPL, if the actual health care services had been provided years earlier. “Such a broad interpretation of an exception to the general rule militating against the disclosure of personal data might not offer sufficient guarantees against the risk of abuse and arbitrariness.” Secondly, the applicant had never been informed that the MADEKKI had collected and processed her personal data. And thirdly, the hospital itself was never given any recommendations on how to improve its services, it only received information pertained specifically to the actions of the doctor responsible for the applicant’s treatment.

The ECtHR further found that that the applicable legal norms describing the competence of the MADEKKI are formulated in a very general fashion. However the SC failed to explain which of its functions the MADEKKI had been carrying out or what public interest it had been pursuing when it issued a report on the legality of the applicant’s treatment. Accordingly it did not and could not examine the proportionality of the interference with the applicant’s right to respect for her private life against any public interest. Moreover, the relevant domestic law in force at the time did not provide for the right of the data subject to be informed that the MADEKKI would be processing his or her data before the commencement of the collecting. The authority therefore was under no legal obligation to take the data subject’s views into account concerning decisions related to its data processing.

The ECtHR reiterated that

the protection of personal data, not least medical data, is of fundamental importance to a person’s enjoyment of the right to respect for his or her private life as guaranteed by Article 8 of the Convention. Respecting the confidentiality of health data is a vital principle in the legal systems of all the Contracting Parties to the Convention. It is crucial not only to respect the sense of privacy of a patient but also to preserve confidence in the medical profession and in the health services in general […].

The Court found that the applicable Latvian law did not limit in any way the scope of private data that could be collected by the MADEKKI: the authority processed data concerning a period of seven years, and originating from three different institutions. The relevance and sufficiency of the reasons for collecting information not directly related to the procedures carried out at the hospital in 1997 has not been examined at any stage of the domestic procedure. The MADEKKI has collected the applicant’s medical data indiscriminately, without any prior assessment of whether the data processed would be relevant.

Finally, the Court found that the applicable Latvian law was not formulated with sufficient precision and afforded no adequate legal protection against arbitrariness. Neither did it indicate with sufficient clarity the scope of discretion conferred on the competent authorities and the manner of its exercise. The interference with the applicant’s right to respect for her private life was not in accordance with the law within the meaning of Article 8 § 2 of the Convention. Consequently there has been a violation of Article 8.