In the case of L.H. v. Latvia (Application no. 52019/07) the ECtHR found a violation of Article 8 of the Convention regarding the processing of health data without sufficient legal basis by a Latvian authority.
Facts
While the applicant, L. H., was giving birth in 1997, a Caesarian section
was used and in the course of that surgery a tubal ligation, resulting in
sterilisation, was performed without her consent. Following an unsuccessful
attempt to achieve an out-of-court settlement, she brought civil proceedings against
the district hospital in February 2005 and, in December 2006, was awarded
compensation for the unauthorised sterilisation. In the meantime, in February
2004, the Inspectorate of Quality Control for Medical Care and Fitness for Work
(MADEKKI), on request by the district hospital’s director, initiated an administrative
inquiry concerning the gynaecological and childbirth assistance provided to Ms
H. from 1996 to 2003. The MADEKKI received medical files from three medical
institutions and, in May 2004, issued a report containing sensitive medical
details, and the summary of the conclusions was sent to the hospital director. Ms
H.’s lawyer lodged a claim before the administrative courts, complaining that
the inquiry had been unlawful, in particular since its essential purpose had
been to help the hospital to gather evidence for the impending litigation,
which was outside the MADEKKI’s remit. The lawyer also requested to annul the report.
Ms H.’s claim was rejected by the Administrative District Court in a decision
eventually upheld by the Supreme Court (SC) in February 2007.
In her application Ms. L.H. complained that the collection of her personal medical data by a State agency had violated the
right to respect for her private life, guaranteed by Article 8 of the
Convention.
Violation of Article 8
Since there was no contradiction between the
parties that the applicant’s medical data formed part of her private
life and therefore the collection of such data by the MADEKKI constituted an
interference with her right to respect for her private life, the Court proceeded to analyze
whether the interference complied with the requirements of the second paragraph
of Article 8 of the Convention.
The ECtHR reiterated that the expression “in
accordance with the law” requires that
the impugned measure to have some basis in domestic
law, which should be compatible with the rule of law, which, in turn, means
that the domestic law must be formulated with sufficient precision and must
afford adequate legal protection against arbitrariness. Accordingly the
domestic law must indicate with sufficient clarity the scope of discretion
conferred on the competent authorities and the manner of its exercise.
In this respect it noted that the Government referred to interpretation of the domestic law of the
SC regarding the relevant domestic law, according to
which the authority may assess the quality of medical care provided in medical
institutions upon receiving requests from medical institutions, and was
authorized to collect information and documents relating to questions within
its field of competence.Therefore, since errors of fact or law allegedly
committed by a national court falls under the Court’s supervision in so far as
they may have infringed rights and freedoms protected by the Convention, it turned
to the interpretation of section 11(5) of the Personal Data Protection Law (DPL)
given by the Supreme Court. This section provides that personal data may be
processed without the consent of the data subject if it is necessary for the
purposes of medical treatment or the provision or administration of heath care services.
It noted that the MADEKKI started to collect the
applicant’s medical data seven years after her sterilisation, during the civil
litigation. In the Court’s view this lengthy delay raises a number of
questions: whether data collection can be deemed to have been necessary for the
purposes set out in section 11(5) of the DPL, if the actual health care
services had been provided years earlier. “Such
a broad interpretation of an exception to the general rule militating against
the disclosure of personal data might not offer sufficient
guarantees against the risk of abuse and arbitrariness.” Secondly, the applicant had never been informed that the
MADEKKI had collected and processed her personal data. And thirdly, the hospital
itself was never given any recommendations on how to improve its services, it only
received information pertained specifically to the actions of the doctor
responsible for the applicant’s treatment.
The
ECtHR further found that that the applicable legal norms describing the
competence of the MADEKKI are formulated in a very general fashion. However the
SC failed to explain which of its functions the MADEKKI had been carrying out
or what public interest it had been pursuing when it issued a report on the
legality of the applicant’s treatment. Accordingly it did not and could not examine the proportionality of the interference
with the applicant’s right to respect for her private life against any public
interest. Moreover,
the relevant domestic law in force at the time did not provide for the right of
the data subject to be informed that the MADEKKI would be processing his or her
data before the commencement of the collecting. The authority therefore was
under no legal obligation to take the data subject’s views into account concerning
decisions related to its data processing.
The ECtHR reiterated
that
the protection of personal data, not least medical data, is of fundamental
importance to a person’s enjoyment of the right to respect for his or her
private life as guaranteed by Article 8 of the Convention. Respecting the
confidentiality of health data is a vital principle in the legal systems of all
the Contracting Parties to the Convention. It is crucial not only to respect
the sense of privacy of a patient but also to preserve confidence in the
medical profession and in the health services in general […].
The Court found that the applicable Latvian law
did not limit in any way the scope of private data that could be collected by
the MADEKKI: the authority processed data concerning a period of seven years,
and originating from three different institutions. The relevance and
sufficiency of the reasons for collecting information not directly related to
the procedures carried out at the hospital in 1997 has not been examined at any
stage of the domestic procedure. The MADEKKI has collected the applicant’s
medical data indiscriminately, without any prior assessment of whether the data
processed would be relevant.
Finally, the Court found that the applicable Latvian law was not
formulated with sufficient precision and afforded no adequate legal protection
against arbitrariness. Neither did it indicate with sufficient clarity the
scope of discretion conferred on the competent authorities and the manner of
its exercise. The interference with the applicant’s right to respect for her
private life was not in accordance with the law within the meaning of
Article 8 § 2 of the Convention. Consequently there has been a
violation of Article 8.
