EHRM, 17-07-2008, nr. 20511/03

The applicant submitted that the measures taken by the domestic authorities to safeguard her right to respect for her private life had not been sufficient. At the relevant time, at the beginning of the 1990s, the hospital's data system was not controlled as provided in the law. Anyone working in the hospital could have accessed her patient record as the hospital register retained only the five most recent users' identification data (usually not the users' names but only their working units). Furthermore, the data were deleted after the file was returned to the archives. It was only after the decision of the County Administrative Board of 20 October 1997 that the hospital's data system was changed.

In her view a retrospective control would have been of vital importance. The data system should have indicated who had accessed her patient record so as to make it possible to find out whether access had been lawful. The domestic courts rejected her claim for compensation for the reason that she could not identify a person who had obtained information about her illness from her patient record. She was, however, unable to prove her claims only because the data control system in the hospital was inadequate at the relevant time.

The Government considered that there was no violation of the applicant's right within the meaning of Article 8 as the Finnish legislation at the time guaranteed the secrecy of a person's health information and, in principle, all patient information was kept secret. Only those participating in the patient's treatment were entitled to process data concerning him or her.

Further, the data controller was obliged to ensure that unauthorised persons could not see and process personal data. The controller was responsible for protecting personal data and had as a matter of strict liability to compensate any damage caused. Furthermore, although the legislation did not contain any detailed provisions on the keeping and retention of log-in files, the data controller had a general legal obligation to control the use of personal data files.

As to the instant case, the Government admitted that in the early 1990s the use of the patient register in the hospital concerned was controlled by storing the identification data of the five most recent users of a patient record. Later, in 1998, the management system was changed so that each consultation of a patient record was logged and stored.

The Government further stressed that a hospital's system for recording and retrieving patient information could only be based on detailed instructions and their observance, the high moral standards of the personnel, and a statutory secrecy obligation. Relevant detailed instructions had been drafted at the hospital; the personnel were allowed to obtain information from the register only for strictly limited purposes. It would not have been possible for the hospital to create a system verifying in advance the authenticity of each request for information as patient records were often needed urgently and immediately. Finally, the Government pointed out that the procedural guarantees were fulfilled in that the applicant had the right to initiate court proceedings in the event of any defective handling of her patient data.

The hospital was a public hospital for whose acts the State is responsible for the purposes of the Convention (see Glass v. the United Kingdom, no. 61827/00, § 71, ECHR 2004-II). The processing of information relating to an individual's private life comes within the scope of Article 8 § 1 (see Rotaru v. Romania[GC], no. 28341/95, § 43, ECHR 2000-V, Leander v. Sweden, judgment of 26 March 1987, Series A no. 116, § 48). Personal information relating to a patient undoubtedly belongs to his or her private life. Article 8 is therefore applicable in the instant case. Indeed, this has not been contested by the parties.

Although the object of Article 8 is essentially that of protecting the individual against arbitrary interference by the public authorities, it does not merely compel the State to abstain from such interference: in addition to this primarily negative undertaking, there may be positive obligations inherent in an effective respect for private or family life (see Airey v. Ireland, judgment of 9 October 1979, Series A no. 32, p. 17, § 32). These obligations may involve the adoption of measures designed to secure respect for private life even in the sphere of the relations of individuals between themselves (see X and Y v. the Netherlands, judgment of 26 March 1985, Series A no. 91, p. 11, § 23; Odièvre v. France[GC], no. 42326/98, ECHR 2003-III).

The Court observes that it has not been contended before it that there was any deliberate unauthorised disclosure of the applicant's medical data such as to constitute an interference with her right to respect for her private life. Nor has the applicant challenged the fact of compilation and storage of her medical data. She complains rather that there was a failure on the part of the hospital to guarantee the security of her data against unauthorised access, or, in Convention terms, a breach of the State's positive obligation to secure respect for her private life by means of a system of data protection rules and safeguards. The Court will examine the case on that basis, having regard in particular to the fact that in the domestic proceedings the onus was on the applicant to prove the truth of her assertion.

The protection of personal data, in particular medical data, is of fundamental importance to a person's enjoyment of his or her right to respect for private and family life as guaranteed by Article 8 of the Convention. Respecting the confidentiality of health data is a vital principle in the legal systems of all the Contracting Parties to the Convention. It is crucial not only to respect the sense of privacy of a patient but also to preserve his or her confidence in the medical profession and in the health services in general. The above considerations are especially valid as regards protection of the confidentiality of information about a person's HIV infection, given the sensitive issues surrounding this disease. The domestic law must afford appropriate safeguards to prevent any such communication or disclosure of personal health data as may be inconsistent with the guarantees in Article 8 of the Convention (see Z v. Finland, judgment of 25 February 1997, Reports of Judgments and Decisions 1997-I, §§ 95–96).

The Court notes that at the beginning of the 1990s there were general provisions in Finnish legislation aiming at protecting sensitive personal data. The Court attaches particular relevance to the existence and scope of the Personal Files Act of 1987 (see paragraph 19 above). It notes that the data controller had to ensure under section 26 that personal data were appropriately secured against, among other things, unlawful access. The data controller also had to make sure that only the personnel treating a patient had access to his or her patient record.

Undoubtedly, the aim of the provisions was to secure personal data against the risk of unauthorised access. As noted in Z v. Finland, the need for sufficient guarantees is particularly important when processing highly intimate and sensitive data, as in the instant case, where, in addition, the applicant worked in the same hospital where she was treated. The strict application of the law would therefore have constituted a substantial safeguard for the applicant's right secured by Article 8 of the Convention, making it possible, in particular, to police strictly access to an disclosure of health records.

However, the County Administrative Board found that, as regards the hospital in issue, the impugned health records system was such that it was not possible to retroactively clarify the use of patient records as it revealed only the five most recent consultations and that this information was deleted once the file had been returned to the archives. Therefore, the County Administrative Board could not determine whether information contained in the patient records of the applicant and her family had been given to or accessed by an unauthorised third person (see paragraph 10 above). This finding was later upheld by the Court of Appeal following the applicant's civil action. The Court for its part would also note that it is not in dispute that at the material time the prevailing regime in the hospital allowed for the records to be read also by staff not directly involved in the applicant's treatment.

It is to be observed that the hospital took ad hoc measures to protect the applicant against unauthorised disclosure of her sensitive health information by amending the patient register in summer 1992 so that only the treating personnel had access to her patient record and the applicant was registered in the system under a false name and social security number (see paragraph 7 above). However, these mechanisms came too late for the applicant.

The Court of Appeal found that the applicant's testimony about the events, such as her colleagues' hints and remarks beginning in 1992 about her HIV infection, was reliable and credible. However, it did not find firm evidence that her patient record had been unlawfully consulted (see paragraph 15 above).

The Court notes that the applicant lost her civil action because she was unable to prove on the facts a causal connection between the deficiencies in the access security rules and the dissemination of information about her medical condition. However, to place such a burden of proof on the applicant is to overlook the acknowledged deficiencies in the hospital's record keeping at the material time. It is plain that had the hospital provided a greater control over access to health records by restricting access to health professionals directly involved in the applicant's treatment or by maintaining a log of all persons who had accessed the applicant's medical file, the applicant would have been placed in a less disadvantaged position before the domestic courts. For the Court, what is decisive is that the records system in place in the hospital was clearly not in accordance with the legal requirements contained in section 26 of the Personal Files Act, a fact that was not given due weight by the domestic courts.

The Government have not explained why the guarantees provided by the domestic law were not observed in the instant hospital. The Court notes that it was only in 1992, following the applicant's suspicions about an information leak, that only the treating clinic's personnel had access to her medical records. The Court also observes that it was only after the applicant's complaint to the County Administrative Board that a retrospective control of data access was established (see paragraph 11 above).

Consequently, the applicant's argument that her medical data were not adequately secured against unauthorised access at the material time must be upheld.

The Court notes that the mere fact that the domestic legislation provided the applicant with an opportunity to claim compensation for damages caused by an alleged unlawful disclosure of personal data was not sufficient to protect her private life. What is required in this connection is practical and effective protection to exclude any possibility of unauthorised access occurring in the first place. Such protection was not given here.

The Court cannot but conclude that at the relevant time the State failed in its positive obligation under Article 8 § 1 of the Convention to ensure respect for the applicant's private life.

There has therefore been a violation of Article 8 of the Convention.