Disclosure of personal data
II. Relevant domestic law and practice A. The general principle of freedom of information 15. Under sections 1 and 2 of chapter 2 of the Freedom of the Press Act ( Tryckfrihetsförordningen ), which is part of the Swedish Constitution, everyone is entitled to access to public documents, subject to exceptions set out in the Secrecy Act ( Sekretesslagen, 1980:100). B. Confidentiality of medical information 16. One of the exceptions to this general rule relates to confidentiality of information in the field of health and medical care and is set out in chapter 7, section 1, of the Secrecy Act, which provides as follows: “Secrecy applies ... in the field of health and medical care to information on the individual's state of health or otherwise concerning his or her private life, unless it is clear that the information can be disclosed without any harm to the individual or persons closely related to him or her ...” C. Duty to submit information 17. Notwithstanding the above rule of confidentiality, in certain circumstances health and medical-care authorities are required to submit information to another public authority. Thus, chapter 14, section 1, of the Secrecy Act provides the following: “Secrecy does not prevent ... the disclosure of information to another authority, if an obligation to disclose the information is laid down in an act of law or a government ordinance.” 18. Such an obligation follows from chapter 8, section 7, of the Insurance Act, which reads as follows: “A public authority ... [is] obliged to submit, on request, to the courts, the National Social Insurance Service [ Riksförsäkringsverket ] [or] the Social Insurance Office ... information on a named person concerning circumstances of importance to the application of this Act ...” In this context, a doctor employed by a public hospital (as in the present case) is regarded as a representative of a public authority. In addition, the person applying for compensation under the Insurance Act is obliged to provide the Social Insurance Office with information of importance to the claim (chapter 8, section 6, of the Insurance Act). 19. The Social Insurance Office is under a corresponding duty to obtain a physician's opinion in relation to each reported industrial injury (section 13 of the Ordinance on Industrial Injury Insurance and State Injury Compensation Guarantee – Förordning om arbetsskadeförsäkring och statligt personskadeskydd, 1977:284). 20. Information which is submitted to the Office is protected by the rule of confidentiality provided by chapter 7, section 7, of the Secrecy Act: “Secrecy applies at the Social Insurance Office, the National Social Insurance Service and the courts in matters arising under the legislation on ... industrial injury assurance ... in respect of information on an individual's state of health or otherwise concerning his or her private life, if it can be assumed that the individual concerned or persons closely related to him or her will be harmed if the information is disclosed ...” D. Remedies 21. Under the Freedom of the Press Act and the Secrecy Act, there is a right to appeal against a decision not to grant access to public documents. There is, however, no such right in respect of decisions to grant access to information contained in public documents. Furthermore, there is no right for the individual concerned to be consulted before such information is disclosed or to be notified of the disclosure afterwards. 22. Under chapter 20, section 3, of the Penal Code ( Brottsbalken ), a physician who, intentionally or through negligence, discloses information which should be kept confidential according to law is guilty of breach of professional secrecy. Proceedings may be brought in the ordinary courts by the public prosecutor or, if the public prosecutor decides not to prosecute, the aggrieved individual. Such a breach of professional secrecy may also constitute a basis for claiming damages under chapter 2, section 1, or chapter 3, section 1, of the Damage Compensation Act ( Skadeståndslagen, 1972:207). Action may be taken by the individual against the physician or his or her employer. 23. Public authorities and their employees are, furthermore, subject to the supervision of the Chancellor of Justice ( Justitiekanslern ) and the Parliamentary Ombudsman ( Justitieombudsmannen ). The Chancellor and the Ombudsman investigate whether those exercising public powers abide by laws and follow applicable instructions and may prosecute a certain individual or refer the matter to disciplinary action by the relevant authority. PROCEEDINGS BEFORE THE COMMISSION 24. Ms M.S. lodged her application (no. 20837/92) with the Commission on 23 September 1992. She complained, under Article 8 of the Convention, that the submission of her medical records to the Social Insurance Office constituted an unjustified interference with her right to respect for private life and, under Articles 6 and 13, that she had no remedy she could use to challenge this measure. 25. The Commission declared the application admissible on 22 May 1995. In its report of 11 April 1996 (Article 31), the Commission expressed the opinion that there had been no violation of Article 8 of the Convention (twenty-two votes to five), that there had been no violation of Article 6 § 1 of the Convention (twenty-four votes to three) and that no separate issue arose under Article 13 of the Convention (twenty votes to seven). The full text of the Commission's opinion and of the five separate opinions contained in the report is reproduced as an annex to this judgment [4]. FINAL SUBMISSIONS TO THE COURT 26. At the hearing on 18 March 1997 the Government, as they had done in their memorial, invited the Court to hold that there had been no violation of the Convention in the present case. 27. On the same occasion the applicant reiterated her request to the Court stated in her memorial to find that there had been violations of Articles 6, 8 and 13 and to award her just satisfaction under Article 50 of the Convention. AS TO THE LAW I. ALLEGED VIOLATION OF ARTICLE 8 OF THE CONVENTION 28. The applicant maintained that the communication of her medical records by the clinic to the Social Insurance Office constituted a violation of her right to respect for private life under Article 8 of the Convention, which reads: “1. Everyone has the right to respect for his private and family life, his home and his correspondence. 2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.” 29. The Government disputed that Article 8 § 1 was applicable to the matter complained of by the applicant and maintained that, in any event, there had been no interference with any of her rights guaranteed by that provision. In the alternative, they argued that the measure had been justified under paragraph 2 of the Article. 30. The Commission was of the opinion that paragraph 1 of Article 8 applied, that there had been an interference with the applicant's right to respect for her private life under that provision but that the interference had been justified under paragraph 2. A. Article 8 § 1 1. Was Article 8 § 1 applicable? 31. In contesting the applicability of Article 8 § 1 the Government submitted that, by having initiated the compensation proceedings, the applicant had waived her right to confidentiality with regard to the medical data which the clinic had communicated to the Office (see paragraph 11 above). The measure had constituted a foreseeable application of the relevant Swedish law, from which it clearly followed that the Office was under an obligation to request the information in issue, which the clinic had a corresponding duty to impart (see paragraphs 18–19 above). In this connection, they stressed that the data had not been made public but remained confidential in the Office (see paragraph 16 above). 32. The Court observes that under the relevant Swedish law, the applicant's medical records at the clinic were governed by confidentiality (see paragraph 16 above). Communication of such data by the clinic to the Office would be permissible under the Insurance Act only if the latter authority had made a request and only to the extent that the information was deemed to be material to the application of the Insurance Act (see paragraph 18 above). This assessment was left exclusively to the competent authorities, the applicant having no right to be consulted or informed beforehand (see paragraph 21 above). It thus appears that the disclosure depended not only on the fact that the applicant had submitted her compensation claim to the Office but also on a number of factors beyond her control. It cannot therefore be inferred from her request that she had waived in an unequivocal manner her right under Article 8 § 1 of the Convention to respect for private life with regard to the medical records at the clinic. Accordingly, the Court considers that this provision applies to the matters under consideration. 2. Was there an interference? 33. With reference to the arguments set out in paragraph 31 above, the Government disputed that the communication of the data in question amounted to an interference with the applicant's right to respect for her private life under Article 8. 34. The applicant and the Commission, stressing that information of a private and sensitive nature had been disclosed without her consent to a certain number of people at the Office, maintained that the measure constituted an interference. 35. The Court notes that the medical records in question contained highly personal and sensitive data about the applicant, including information relating to an abortion. Although the records remained confidential, they had been disclosed to another public authority and therefore to a wider circle of public servants (see paragraphs 12–13 above). Moreover, whilst the information had been collected and stored at the clinic in connection with medical treatment, its subsequent communication had served a different purpose, namely to enable the Office to examine her compensation claim. It did not follow from the fact that she had sought treatment at the clinic that she would consent to the data being disclosed to the Office (see paragraph 10 above). Having regard to these considerations, the Court finds that the disclosure of the data by the clinic to the Office entailed an interference with the applicant's right to respect for private life guaranteed by paragraph 1 of Article 8. It remains to be determined whether the interference was justified under paragraph 2 of Article 8. B. Article 8 § 2 1. “In accordance with the law” 36. The applicant submitted that the disclosure of her medical records by the clinic had exceeded the Office's request. Whilst the Office had onlyasked for medical records relating to the time of her back injury allegedly sustained at work on 9 October 1981, the clinic had produced records covering a period up to February 1986 (see paragraph 12 above). The information disclosed did not therefore meet the requirement contained in chapter 8, section 7, of the Insurance Act that only data requested should be produced (see paragraph 18 above), and its communication had consequently not been “in accordance with the law”. 37. However, in the Court's view the terms of the above provision suggest that the decisive factor in determining the scope of the imparting authority's duty to provide information is the relevance of the information rather than the precise wording of the request (see paragraph 18 above). The Court is satisfied that the interference had a legal basis and was foreseeable; in other words, that it was “in accordance with the law”. 2. Legitimate aim 38. The object of the disclosure was to enable the Office to determine whether the conditions for granting the applicant compensation for industrial injury had been met. The communication of the data was potentially decisive for the allocation of public funds to deserving claimants. It could thus be regarded as having pursued the aim of protecting the economic well-being of the country. Indeed this was not disputed before the Court. On the other hand, the Court does not consider it necessary to examine the second aim invoked by the Government, namely protection of the “rights ... of others”. 3. “Necessary in a democratic society” 39. In the applicant's submission, the disclosure of her medical records could not be regarded as having been necessary in a democratic society. She maintained that, while there was no dispute as to the fact that her disability prevented her from working, there was disagreement as to its cause, whether it was spondylolisthesis or the alleged work injury (see paragraphs 9–10 above). Information about her abortion in 1985 had been irrelevant to the issue to be determined by the Office (see paragraphs 12–13 above). In addition, she argued that the duty of confidentiality to which public servants at the Office were subject provided a weaker protection of the applicant's interests than that applying to medical personnel at the clinic. Thus, whilst it was for the patient to show that he or she had suffered damage as a result of disclosure by an ordinary public servant, a doctor had to show that disclosure had not caused damage. In addition, she maintained that an effective protection of her rights under Article 8 required that she should have been notified of the clinic's intention to communicate the data and afforded an opportunity to exercise judicial remedies against that decision before it was implemented (see paragraph 21 above). 40. The Government and the Commission were of the view that the disclosure was “necessary”. Not only had the medical records been relevant to the Office's decision but the fact that they might be relevant must also have been apparent to her when she made her claim. Even the information concerning the abortion had related to her back problems (see paragraph 13 above). If the Office had been requested to rely exclusively on the applicant's submissions, there would have been a risk of her withholding relevant evidence. Since the data remained confidential while they were in the possession of the Office (see paragraph 16 above), the interference which the disclosure had entailed was of a limited nature. 41. The Court reiterates that the protection of personal data, particularly medical data, is of fundamental importance to a person's enjoyment of his or her right to respect for private and family life as guaranteed by Article 8 of the Convention. Respecting the confidentiality of health data is a vital principle in the legal systems of all the Contracting Parties to the Convention. It is crucial not only to respect the sense of privacy of a patient but also to preserve his or her confidence in the medical profession and in the health services in general. The domestic law must afford appropriate safeguards to prevent any such communication or disclosure of personal health data as may be inconsistent with the guarantees in Article 8 of the Convention (see the Z v. Finland judgment of 25 February 1997, Reports of Judgments and Decisions 1997-I, p. 347, § 95). Bearing in mind the above considerations and the margin of appreciation enjoyed by the State in this area, the Court will examine whether, in the light of the case as a whole, the reasons adduced to justify the interference were relevant and sufficient and whether the measure was proportionate to the legitimate aim pursued (ibid., § 94). 42. Turning to the particular circumstances, the Court notes that the applicant's medical data were communicated by one public institution to another in the context of an assessment of whether she satisfied the legal conditions for obtaining a benefit which she herself had requested (see paragraphs 11–14 above). It recognises that, in deciding whether to accept the applicant's compensation claim, the Office had a legitimate need to check information received from her against data in the possession of the clinic. In the absence of objective information from an independent source, it would have been difficult for the Office to determine whether the claim was well-founded. That claim concerned a back injury which she had allegedly suffered in 1981, and all the medical records produced by the clinic to the Office, including those concerning her abortion in 1985 and the treatment thereafter, contained information relevant to the applicant's back problems. As appears from the records of 1985, her back pains constituted the main reason for the termination of pregnancy (see paragraphs 12–13 above). Moreover, the data covered the period in respect of which she claimed compensation under the Insurance Act (see paragraphs 10–11 above). In the Court's view, the applicant has not substantiated her allegation that the clinic could not reasonably have considered her post-1981 medical records to be material to the Office's decision. 43. In addition, under the relevant law it is a condition for imparting the data concerned that the Office has made a request and that the information be of importance for the application of the Insurance Act (see paragraph 18 above). Staff at the clinic could incur civil and/or criminal liability had they failed to observe these conditions (see paragraph 22 above). The Office, as the receiver of the information, was under a similar duty to treat the data as confidential, subject to similar rules and safeguards as the clinic (see paragraphs 20 and 22 above). In the circumstances, the contested measure was therefore subject to important limitations and was accompanied by effective and adequate safeguards against abuse (see the above-mentioned Z v. Finland judgment, p. 350,§ 103). 44. Having regard to the foregoing, the Court considers that there were relevant and sufficient reasons for the communication of the applicant's medical records by the clinic to the Office and that the measure was not disproportionate to the legitimate aim pursued. Accordingly, it concludes that there has been no violation of the applicant's right to respect for her private life, as guaranteed by Article 8 of the Convention. II. ALLEGED VIOLATION OF ARTICLE 6 § 1 OF THE CONVENTION 45. The applicant further alleged a breach of Article 6 § 1 of the Convention, which, in so far as is relevant, reads: “In the determination of his civil rights and obligations ..., everyone is entitled to a ... hearing ... by [a] … tribunal ...” She complained in particular that, contrary to this provision, she had not been afforded a possibility, prior to the communication of her medical records by the clinic, to challenge the measure before a court (see paragraph 21 above). 46. The Government disputed that Article 6 § 1 was applicable and maintained that, in any event, it had been complied with in the present case (see paragraphs 22–23 above). The Commission, for its part, considered that the provision was applicable and had been complied with (see paragraph 22 above). 47. The Court must first examine whether Article 6 § 1 was applicable to the disagreement between the applicant and the Swedish authorities as to the disclosure of her medical records. It reiterates that, according to the principles laid down in its case-law (see the judgments of Zander v. Sweden, 25 November 1993, Series A no. 279-B, p. 38, § 22, and Kerojärvi v. Finland, 19 July 1995, Series A no. 322, p. 12, § 32), it must ascertain whether there was a dispute (“ contestation ”) over a “right” which can be said, at least on arguable grounds, to be recognised under domestic law. The dispute must be genuine and serious; it may relate not only to the existence of a right but also to its scope and the manner of its exercise; and the outcome of the proceedings must be directly decisive for the right in question. Finally, the right must be civil in character. 48. Under the rule on confidentiality in chapter 7, section 1, of the Secrecy Act, a duty of confidentiality applied to the data in issue in the present case (see paragraph 16 above). The provision was evidently designed to protect a patient's interest in non-disclosure of medical data. 49. On the other hand, according to chapter 14, section 1, of the Secrecy Act the rule of confidentiality did not apply where a statutory obligation required the disclosure of information to another authority (see paragraph 17 above). In the case under consideration, the clinic had been under an obligation to supply the Office with “information on [the applicant] concerning circumstances of importance to the application of [the] Act ...” (chapter 8, section 7, of the Insurance Act). Thus, the obligation incumbent on the imparting authority vis-à-vis the requesting authority depended exclusively on the relevance of the data in its possession; it comprised all data which the clinic had in its possession concerning the applicant and which were potentially relevant to the Office's determination of her compensation claim. In addition to the scope of this obligation as described above, the Court notes that the clinic enjoyed a very wide discretion in assessing what data would be of importance to the application of the Insurance Act. In this regard, it had no duty to hear the applicant's views before transmitting the information to the Office (see paragraph 21 above). Accordingly, it appears from the very terms of the legislation in issue that a “right” to prevent communication of such data could not, on arguable grounds, be said to be recognised under national law (see the Masson and Van Zon v. the Netherlands judgment of 28 September 1995, Series A no. 327-A, pp. 19–20, §§ 49–52). No evidence suggesting the contrary has been adduced before the Court. 50. Having regard to the foregoing, the Court reaches the conclusion that Article 6 § 1 was not applicable to the proceedings under consideration and has therefore not been violated in the present case. III. ALLEGED VIOLATION OF ARTICLE 13 OF THE CONVENTION 51. Relying on essentially the same arguments as with regard to Article 6 § 1, the applicant claimed that there had also been a violation of Article 13 of the Convention, which provides: “Everyone whose rights and freedoms as set forth in [the] Convention are violated shall have an effective remedy before a national authority notwithstanding that the violation has been committed by persons acting in an official capacity.” She maintained that, since the disclosure of confidential data was a measure that could not be reversed, it was crucial for the effectiveness of a remedy against disclosure that the interested person should be able to exercise it beforehand. 52. The Government contended that Article 13 was not applicable, as they did with regard to Articles 6 § 1 and 8. However, they accepted that if the Court found Article 8 applicable and Article 6 § 1 inapplicable, a separate issue would arise under Article 13. In their view, the aggregate of remedies (see paragraphs 21–23 above) available to the applicant in order to obtain redress for breach of confidentiality satisfied the requirements of that provision. 53. The Commission, having found that Article 6 § 1 was applicable and had been complied with in the present case, did not deem it necessary to examine the applicant's complaint also under Article 13. Since the requirements in Article 13 were less strict than, and were absorbed by, those in Article 6 § 1, it concluded that no separate issue arose under the former provision. 54. In view of its conclusions with respect to the applicant's complaints under Articles 8 and 6 § 1 (see paragraphs 32 and 50 above), the Court considers that a separate issue arises with regard to her complaint under Article 13. Article 13 of the Convention guarantees the availability of a remedy at national level to enforce the substance of the Convention rights and freedoms in whatever form they may happen to be secured in the domestic legal order. The effect of Article 13 is thus to require the provision of a domestic remedy allowing the competent “national authority” both to deal with the substance of the relevant Convention complaint and to grant appropriate relief, although Contracting States are afforded some discretion as to the manner in which they conform to their obligations under Article 13 (see, for instance, the Chahal v. the United Kingdom judgment of 15 November 1996, Reports of Judgments and Decisions 1996-V, pp. 1869–70, § 145). However, the Article 13 guarantee applies only in respect of grievances under the Convention which are arguable (see, for example, the Boyle and Rice v. the United Kingdom judgment of 27 April 1988, Series A no. 131, p. 23, § 52). 55. The applicant's complaint under Article 8 was essentially that the clinic had communicated to the Office certain data which in her view were irrelevant to the latter's examination of her compensation claim (see paragraphs 36 and 39 above). Having regard to its findings under Article 8 above, the Court is satisfied that she had an arguable claim for the purposes of Article 13. It remains to examine whether she was afforded an effective remedy. In this regard, it was open to her to bring criminal and civil proceedings before the ordinary courts against the relevant staff of the clinic and to claim damages for breach of professional secrecy (see paragraph 22 above). Thus the applicant had access to an authority empowered both to deal with the substance of her Article 8 complaint and to grant her relief. Having regard to the limited nature of the disclosure and to the different safeguards (see paragraphs 16–18, 20 and 22 above), in particular the Office's obligation to secure and maintain the confidentiality of the information, the Court finds that the various ex post facto remedies referred to above satisfied the requirements of Article 13. 56. Accordingly, the Court finds no violation of Article 13 of the Convention in the present case.
The Court held that there had been no violation of Article 8 of the Convention, finding that there had been relevant and sufficient reasons for the communication of the applicant's medical records by the clinic to the social-security body and that the measure had not been disproportionate to the legitimate aim pursued, namely, by enabling the social-security body to determine whether the conditions for granting the applicant compensation for industrial injury had been met, to protect the economic well-being of the country. Moreover, the contested measure was subject to important limitations and was accompanied by effective and adequate safeguards against abuse.