Confidentiality of personal information concerning health
II. RELEVANT NATIONAL LAW A. Legal regulation of the MADEKKI 24. Section 10 of the Medical Treatment Law ( Ārstniecības likums ) at the relevant time provided that the MADEKKI was the institution responsible for monitoring the quality of medical care provided in medical institutions. 25. The MADEKKI ’ s work at the relevant time was governed in more detail by its statute ( nolikums ), which had been approved by the Cabinet of Ministers. The statute provided that the MADEKKI was a government institution, whose main functions were to inspect and monitor the professional quality of health care in medical institutions irrespective of their ownership status (paragraph 1). Paragraph 3 of the statute listed the principal functions of the MADEKKI, such as to examine complaints in order to protect the rights of patients (paragraph 3.3), to oversee and issue reports concerning the professional quality of medical care in the event of complaints (paragraph 3.4), to issue reports on the quality of medical care in medical institutions (paragraph 3.6) and the like. 26. According to its statute the MADEKKI had a right to carry out scheduled (“ plānveida ”) checks on the quality of medical care as well as to carry out the required checks in response to complaints and requests (paragraph 4.1). Paragraph 4.2 authorised the MADEKKI “to request from private individuals and officials documents and information concerning questions within its field of competence”. If the MADEKKI found that laws had been broken in the course of providing health care, it was authorised to apply administrative fines and issue warnings, as well as to give appropriate recommendations to doctors and administrators of medical institutions. 27. Lastly, section 7 2 of the MADEKKI statute provided that its staff had to maintain confidentiality with regard to any information obtained in the performance of their professional duties. B. Personal data 28. The Personal Data Protection Law ( Fizisko personu datu aizsardzības likums ) provides, in section 11, that the processing ( which is defined as any activities with personal data, including collecting, registering, using, and so on) of sensitive personal data (including information about a person ’ s health) is permitted only after having received written consent from the data subject. Without such consent personal data may be processed only in a limited number of situations, including “ if ... necessary for the purposes of medical treatment [or] the provision or administration of heath care services” (section 11(5)). 29. Section 7 of the Personal Data Protection Law provided more generally that processing of personal data was allowed only if that law did not provide otherwise and if at least one of the other conditions was present. One of the additional conditions was that the processing of the data was necessary for a system administrator to carry out his legal duties (section 7(3)). A “system administrator” for the purposes of this Law was “a natural or legal person who determines the aims of a data processing system and the means of processing [ of the data]”. 30. As in force at the relevant time, section 50 of the Medical Treatment Law provided that information concerning patients ’ treatment and diagnosis could only be provided to a limited number of institutions, including the MADEKKI. THE LAW I. ALLEGED VIOLATION OF ARTICLE 8 OF THE CONVENTION 31. The applicant complained that the MADEKKI had violated her right to respect for her private life, protected Article 8 of the Convention, which, in so far as is relevant, reads as follows: “1. Everyone has the right to respect for his private ... life .... 2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.” A. Admissibility 32. The Court notes that the application is not manifestly ill-founded within the meaning of Article 35 § 3 (a) of the Convention. It further notes that it is not inadmissible on any other grounds. It must therefore be declared admissible. B. Merits 33. The parties agreed that the applicant ’ s medical data formed part of her private life and that the collection of such data by the MADEKKI constituted an interference with her right to respect for her private life. The Court sees no reason to hold otherwise. Therefore there has been an interference with the applicant ’ s right to respect for her private life. It remains to be determined whether the interference complied with the requirements of the second paragraph of Article 8 of the Convention. 1. Submissions of the parties 34. The Government maintained that the interference had been in accordance with the law. They relied on the conclusions reached by the Senate of the Supreme Court to the effect that the MADEKKI was authorised to check the quality of health care not only in situations where it had received a complaint from a patient. The Senate was of the opinion that a provider of health care services, “with the aim of protecting public interests, is also entitled to request the assessment of the quality of medical care ” in order that, should any irregularities be found, they might be eliminated and their recurrence with respect to other patients avoided in the future. 35. The Government further relied on the conclusions of the Senate that sections 10 (see paragraph 24 above) and 50 (see paragraph 30 above) of the Medical Treatment Law in combination with the relevant provisions of the statute of the MADEKKI (the Government referred, inter alia, to paragraphs 1, 3.3, 3.4, 3.6, 4.1 and 4.2 of the statute), and taking into account the exception to the prohibition of the processing of personal data contained in section 11(5) of the Personal Data Protection Law, entitled the MADEKKI to collect and process the applicant ’ s sensitive data “in order to monitor the quality of medical care, which in turn is part of the provision of heath care services”. 36. The Government submitted that the MADEKKI had collected the applicant ’ s data in order to establish whether the treatment administered to her on 16 June 1997 had complied with the legislation in force at the material time. If any violations of the applicable legislation had been found, it would have helped to prevent similar situations from arising in the future. Thus the purpose of collecting the applicant ’ s personal data had been to protect public health and the rights and freedoms of others. 37. In addition, referring to a statement made by the director of the Cēsis hospital during the hearing before the Administrative District Court, the Government pointed out that the MADEKKI assessment had been ordered in order to determine whether the doctor at the Cēsis hospital who had performed the tubal ligation had committed any crime. 38. The Government further submitted that the hospital requested the MADEKKI to assess the treatment administered to the applicant “ as a result of the applicant ’ s attempts to achieve an out-of-court settlement with the hospital seeking to recover compensation for damage caused by the allegedly unauthorised tubal ligation. Given that [the hospital] was the respondent in a civil case which may have resulted in significant legal and financial implications, it is natural that it sought independent expert advice. It must specifically be noted that [the hospital] sought expert advice from the national independent institution competent to deal with the issue, the same institution that would have been consulted by courts, had the case proceeded further”. 39. The Government submitted that the interference with the applicant ’ s right to respect for her private life had been of an “insignificant level”. The MADEKKI, upon having completed its examination of the applicant ’ s data, had only informed the Cēsis hospital of the conclusions of its report (see paragraph 1 2 above), without making the full report available. The Government thus concluded that the MADEKKI had processed the applicant ’ s data very carefully and had respected the applicable national data protection legislation. 40. The applicant argued that the domestic law did not grant the MADEKKI the right to collect confidential medical data without receiving the patient ’ s prior consent. She submitted that section 50 of the Medical Treatment Law on which the Government sought to rely did not give the MADEKKI the right to acquire information about patients. Rather, that provision left the decision whether or not to give information about patients to the discretion of the medical institutions in possession of such information. Should the medical institution be of the opinion that disclosure would be at odds with the data protection legislation or other laws, it had an obligation to decline the MADEKKI ’ s request. 41. The applicant further criticised the Government ’ s reliance on the exception contained in section 11(5) of the Personal Data Protection Law, arguing that it was doubtful that medical treatment dispensed in 1997 could be considered to have been “administered” in 2004. 42. The applicant considered that the statute of the MADEKKI, having been approved by the Cabinet of Ministers, which is an executive and not a legislative body, could not be considered “law” for the purposes of Article 8 § 2 of the Convention. 43. The applicant argued that the only aim for which her personal data were collected by the MADEKKI had been to assist the Cēsis hospital in gathering evidence for use in the litigation concerning her sterilisation, as evidenced by the fact that the Cēsis hospital only sent its request to the MADEKKI after the applicant had set about initiating settlement negotiations with regard to her sterilisation. The applicant disagreed with the submission of the Government that the information had been collected in order to establish potential criminal liability of the doctor of the Cesis hospital. 44. The applicant was critical of the proposition that the MADEKKI had collected her personal data to protect public health or the rights and freedoms of others, as no threat to anyone ’ s health, rights or freedoms had been identified. 45. The applicant argued that the interference in the present case had not been necessary in a democratic society. Even assuming that the actions of the MADEKKI had pursued a legitimate aim in aiding the Cēsis hospital in the process of ascertaining the lawfulness of its employees ’ actions, it could have done so by using means less restrictive of individual rights. For instance, the Cēsis hospital could have forwarded the applicant ’ s data to the MADEKKI without disclosing her name. 46. The applicant also disagreed with the Government ’ s submission that the interference with her right to respect for her private life had been insignificant. Citing I. v. Finland (no. 20511/03, § 38, 17 July 2008), the applicant submitted that the collection of her personal data had undermined her confidence in the medical profession and in the health services in general. 2. Assessment of the Court 47. The Court refers to the interpretation given to the phrase “in accordance with the law” in its case-law (as summarised in S. and Marper v. the United Kingdom [GC], nos. 30562/04 and 30566/04, §§ 95-96, ECHR 2008 ). Of particular relevance in the present case is the requirement for the impugned measure to have some basis in domestic law, which should be compatible with the rule of law, which, in turn, means that the domestic law must be formulated with sufficient precision and must afford adequate legal protection against arbitrariness. Accordingly the domestic law must indicate with sufficient clarity the scope of discretion conferred on the competent authorities and the manner of its exercise. 48. The Court takes note of the Government ’ s argument that in the light of the Senate of the Supreme Court ’ s interpretation of the domestic law the MADEKKI was authorised to assess the quality of medical care provided in medical institutions not only upon receiving complaints from patients but also in response to “requests”, which to the Senate meant requests from medical institutions. In the course of carrying out such checks the statute of the MADEKKI as well as section 50 of the Medical Treatment Law entitled the MADEKKI to collect information and documents relating to questions within its field of competence. 49. The Court reiterates that according to Article 19 of the Convention its duty is to ensure the observance of the engagements undertaken by the Contracting Parties to the Convention. In particular, it is not its function to deal with errors of fact or law allegedly committed by a national court unless and in so far as they may have infringed rights and freedoms protected by the Convention ( see García Ruiz v. Spain [GC], no. 30544/96, § 29, ECHR 1999 ‑ I ). Against this background, the Court turns to the interpretation of section 11(5) of the Personal Data Protection Law given by the Senate of the Supreme Court (see paragraph 28 above). 50. The Court notes that in the present case the MADEKKI started to collect the applicant ’ s medical data in 2004, seven years after her sterilisation and at a time when the applicant was involved in civil litigation with the Cēsis hospital. In the Court ’ s view this lengthy delay raises a number of questions, such as the one highlighted by the applicant, namely, whether data collection in 2004 can be deemed to have been “ necessary for the purposes of medical treatment [ or ] the provision or administration of heath care services ” within the meaning of section 11(5) of the Data Protection Law, if the actual health care services had been provided seven years earlier, in 1997. Such a broad interpretation of an exception to the general rule militating against the disclosure of personal data might not offer sufficient guarantees against the risk of abuse and arbitrariness ( see S. and Marper, cited above, § 99 ). 51. In this context the Court finds it noteworthy that the applicant had never been informed that the MADEKKI had collected and processed her personal data in order to carry out a general control of the quality of health care provided by the Cēsis hospital to patients in situations comparable to the one of the applicant. The hospital itself was never given any recommendations on how to improve the services provided by it. The only information that was received by the hospital pertained specifically to the actions of the doctor responsible for the applicant ’ s treatment and that information was provided to the hospital at a time when there was an ongoing litigation between the applicant and the hospital. 52. The Court notes that the applicable legal norms described the competence of the MADEKKI in a very general fashion. The Senate of the Supreme Court did not explain which of its functions the MADEKKI had been carrying out or what public interest it had been pursuing when it issued a report on the legality of the applicant ’ s treatment. Accordingly the Senate did not and could not examine the proportionality of the interference with the applicant ’ s right to respect for her private life against any public interest, particularly since it came to the conclusion that such weighing had already been done by the legislator (see paragraph 22 above). 53. Moreover, this took place against the background of domestic law, as in force at the relevant time, which did not provide for the right of the data subject to be informed that the MADEKKI would be processing his or her medical data before it started collecting the data. Thus the MADEKKI was under no legal obligation to take decisions concerning the processing of medical data in such a way as to take the data subject ’ s views into account, whether simply by asking for and potentially receiving the data subject ’ s consent or by other means (see Z v. Finland, cited above, § 101, referring to W. v. the United Kingdom, 8 July 1987, § 64, Series A no. 121 ). 54. The Court cannot accept the Government ’ s suggestion that the MADEKKI was collecting information concerning the applicant ’ s medical history in order to determine whether the doctor who had performed the tubal ligation had to be held criminally liable. Firstly, seven years after the event the prosecution had certainly become time-barred (depending on the legal classification of the potentially criminal act, the statutory limit was most likely two years but certainly no more than five years). Secondly, neither the director of the Cēsis hospital nor the MADEKKI had the legal authority to determine, even on a preliminary basis, the criminal liability of private individuals. 55. Turning to the Government ’ s argument that the MADEKKI was authorised by the law to assist the hospital in litigation, in order to curtail the legal costs (see paragraph 38 above), the Court notes that the MADEKKI is part of the State administration structure, the raison d ’ être of which is to serve the interests of the general public within the limits of its competence. According to the Government, a hospital, which at the time was a respondent party in private ‑ law litigation, was authorised to seek independent expert advice from the MADEKKI. Such a hypothesis was not discussed by the Senate of the Supreme Court. The Court has difficulties in understanding the legal basis for the argument of the Government, since, at least prima facie, none of the legal norms cited by the Government states that providing independent expert advice in ongoing litigation is one of the functions of the MADEKKI. 56. The Court reiterates that the protection of personal data, not least medical data, is of fundamental importance to a person ’ s enjoyment of the right to respect for his or her private life as guaranteed by Article 8 of the Convention. Respecting the confidentiality of health data is a vital principle in the legal systems of all the Contracting Parties to the Convention. It is crucial not only to respect the sense of privacy of a patient but also to preserve confidence in the medical profession and in the health services in general (see Z v. Finland, cited above, § 95, and Varapnickaitė-Mažylienė v. Lithuania, no. 20376/05, § 44, 17 January 2012 ). 57. The Court notes that the applicable law did not limit in any way the scope of private data that could be collected by the MADEKKI. In the present case the MADEKKI collected the applicant ’ s medical data concerning a period spanning seven years, starting one year before the disputed tubal ligation and ending six years after it. The medical information collected and analysed by the MADEKKI originated from three different medical institutions. The relevance and sufficiency of the reasons for collecting information about the applicant that was not directly related to the procedures carried out at the Cēsis hospital in 1997 appear not to have been examined at any stage of the domestic procedure (see Z v. Finland, cited above, § 110). 58. The Court notes that the MADEKKI appears to have collected the applicant ’ s medical data indiscriminately, without any prior assessment of whether the data collected would be “potentially decisive”, “relevant” or “of importance” ( see M.S. v. Sweden, cited above, §§ 38, 42 and 43, and L.L. v. France, no. 7508/02, § 46, ECHR 2006 ‑ XI ) for achieving whatever aim might have been pursued by the MADEKKI ’ s inquiry. In this context it becomes less relevant whether the staff of the MADEKKI had a legal duty to maintain the confidentiality of personal data (see paragraph 20 above and compare M.S. v. Sweden, cited above, § 43). 59. In the light of the above considerations the Court cannot find that the applicable Latvian law was formulated with sufficient precision and afforded adequate legal protection against arbitrariness. Neither did it indicate with sufficient clarity the scope of discretion conferred on the competent authorities and the manner of its exercise. 60. The Court accordingly concludes that the interference with the applicant ’ s right to respect for her private life was not in accordance with the law within the meaning of Article 8 § 2 of the Convention. Consequently there has been a violation of Article 8. II. APPLICATION OF ARTICLE 41 OF THE CONVENTION 61. Article 41 of the Convention provides: “If the Court finds that there has been a violation of the Convention or the Protocols thereto, and if the internal law of the High Contracting Party concerned allows only partial reparation to be made, the Court shall, if necessary, afford just satisfaction to the injured party.” A. Damage 62. The applicant claimed 20,000 euros (EUR) in respect of non ‑ pecuniary damage. 63. The Government argued that the applicant had not substantiated her claim in respect of non-pecuniary damage. The Government submitted that, should the Court decide to award the applicant anything under this head, the award should not exceed EUR 3,500. 64. The Court considers that the applicant must have suffered distress and anxiety on account of the violation it has found. Ruling on an equitable basis, it awards the applicant EUR 1 1 ,000 in respect of non-pecuniary damage. B. Costs and expenses 65. The applicant also claimed EUR 2,183 for the costs and expenses incurred before the domestic courts and EUR 1,435 for those incurred before the Court. 66. According to the Court ’ s established case-law, costs and expenses will not be awarded under Article 41 unless it is established that they were actually and necessarily incurred and were also reasonable as to quantum (see The Sunday Times v. the United Kingdom (no. 1) (Article 50), 6 November 1980, § 23, Series A no. 38 ). 67. The Government referred to the applicant ’ s submission that owing to her poor financial situation she had not actually paid the two invoices issued by her representative for the costs and expenses of her representation before the Court. Therefore, according to the Government, the costs and expenses were not “actually incurred”. 68. The Court notes that, although the applicant has not yet actually paid part of the legal fees and expenses, she is bound to pay them pursuant to a contractual obligation. Accordingly, in so far as the applicant ’ s representative is entitled to seek payment of her fees and expenses under the contract, the legal fees were “actually incurred” ( see Tebieti Mühafize Cemiyyeti and Israfilov v. Azerbaijan, no. 37083/03, § 106, ECHR 2009 ). 69. The Government further submitted that the sum claimed by the applicant with respect to the domestic proceedings was “exorbitant”. To support that argument, the Government relied upon the law setting down the rates to be paid by the State to legal-aid lawyers in the Latvian legal system. 70. In the light of the complexity and the scope of the domestic proceedings, the Court, having taken into account the documents in its possession, finds the sum claimed in that respect reasonable as to quantum. The Court further notes that the Government have not disputed the applicant ’ s claim in so far as it relates to the costs and expenses incurred in respect of the proceedings before the Court. The Court considers the applicant ’ s claim in that respect reasonable as to quantum as well. 71. Therefore the Court considers it reasonable to award the sum of EUR 2, 76 8, covering costs under all heads, which represents the requested sum, less EUR 850 already paid to the applicant ’ s lawyer in legal aid. C. Default interest 72. The Court considers it appropriate that the default interest rate should be based on the marginal lending rate of the European Central Bank, to which should be added three percentage points.
The Court recalled the importance of the protection of medical data to a person’s enjoyment of the right to respect for private life. It held that there had been a violation of Article 8 (right to respect for private and family life) of the Convention in the applicant’s case, finding that the applicable law had failed to indicate with sufficient clarity the scope of discretion conferred on competent authorities and the manner of its exercise.