EHRM, 29-04-2014, nr. 52019/07

The Government maintained that the interference had been in accordance with the law. They relied on the conclusions reached by the Senate of the Supreme Court to the effect that the MADEKKI was authorised to check the quality of health care not only in situations where it had received a complaint from a patient. The Senate was of the opinion that a provider of health care services, ‘with the aim of protecting public interests, is also entitled to request the assessment of the quality of medical care’ in order that, should any irregularities be found, they might be eliminated and their recurrence with respect to other patients avoided in the future.

The Government further relied on the conclusions of the Senate that sections 10 (see paragraph 24 above) and 50 (see paragraph 30 above) of the Medical Treatment Law in combination with the relevant provisions of the statute of the MADEKKI (the Government referred, inter alia, to paragraphs 1, 3.3, 3.4, 3.6, 4.1 and 4.2 of the statute), and taking into account the exception to the prohibition of the processing of personal data contained in section 11(5) of the Personal Data Protection Law, entitled the MADEKKI to collect and process the applicant's sensitive data ‘in order to monitor the quality of medical care, which in turn is part of the provision of heath care services’.

The Government submitted that the MADEKKI had collected the applicant's data in order to establish whether the treatment administered to her on 16 June 1997 had complied with the legislation in force at the material time. If any violations of the applicable legislation had been found, it would have helped to prevent similar situations from arising in the future. Thus the purpose of collecting the applicant's personal data had been to protect public health and the rights and freedoms of others.

In addition, referring to a statement made by the director of the Cēsis hospital during the hearing before the Administrative District Court, the Government pointed out that the MADEKKI assessment had been ordered in order to determine whether the doctor at the Cēsis hospital who had performed the tubal ligation had committed any crime.

The Government further submitted that the hospital requested the MADEKKI to assess the treatment administered to the applicant

The Government submitted that the interference with the applicant's right to respect for her private life had been of an ‘insignificant level’. The MADEKKI, upon having completed its examination of the applicant's data, had only informed the Cēsis hospital of the conclusions of its report (see paragraph 12 above), without making the full report available. The Government thus concluded that the MADEKKI had processed the applicant's data very carefully and had respected the applicable national data protection legislation.

The applicant argued that the domestic law did not grant the MADEKKI the right to collect confidential medical data without receiving the patient's prior consent. She submitted that section 50 of the Medical Treatment Law on which the Government sought to rely did not give the MADEKKI the right to acquire information about patients. Rather, that provision left the decision whether or not to give information about patients to the discretion of the medical institutions in possession of such information. Should the medical institution be of the opinion that disclosure would be at odds with the data protection legislation or other laws, it had an obligation to decline the MADEKKI's request.

The applicant further criticised the Government's reliance on the exception contained in section 11(5) of the Personal Data Protection Law, arguing that it was doubtful that medical treatment dispensed in 1997 could be considered to have been ‘administered’ in 2004.

The applicant considered that the statute of the MADEKKI, having been approved by the Cabinet of Ministers, which is an executive and not a legislative body, could not be considered ‘law’ for the purposes of Article 8 § 2 of the Convention.

The applicant argued that the only aim for which her personal data were collected by the MADEKKI had been to assist the Cēsis hospital in gathering evidence for use in the litigation concerning her sterilisation, as evidenced by the fact that the Cēsis hospital only sent its request to the MADEKKI after the applicant had set about initiating settlement negotiations with regard to her sterilisation. The applicant disagreed with the submission of the Government that the information had been collected in order to establish potential criminal liability of the doctor of the Cesis hospital.

The applicant was critical of the proposition that the MADEKKI had collected her personal data to protect public health or the rights and freedoms of others, as no threat to anyone's health, rights or freedoms had been identified.

The applicant argued that the interference in the present case had not been necessary in a democratic society. Even assuming that the actions of the MADEKKI had pursued a legitimate aim in aiding the Cēsis hospital in the process of ascertaining the lawfulness of its employees' actions, it could have done so by using means less restrictive of individual rights. For instance, the Cēsis hospital could have forwarded the applicant's data to the MADEKKI without disclosing her name.

The applicant also disagreed with the Government's submission that the interference with her right to respect for her private life had been insignificant. Citing I. v. Finland (no. 20511/03, § 38, 17 July 2008), the applicant submitted that the collection of her personal data had undermined her confidence in the medical profession and in the health services in general.

The Court refers to the interpretation given to the phrase ‘in accordance with the law’ in its case-law (as summarised in S. and Marper v. the United Kingdom [GC], nos. 30562/04 and 30566/04, §§ 95–96, ECHR 2008). Of particular relevance in the present case is the requirement for the impugned measure to have some basis in domestic law, which should be compatible with the rule of law, which, in turn, means that the domestic law must be formulated with sufficient precision and must afford adequate legal protection against arbitrariness. Accordingly the domestic law must indicate with sufficient clarity the scope of discretion conferred on the competent authorities and the manner of its exercise.

The Court takes note of the Government's argument that in the light of the Senate of the Supreme Court's interpretation of the domestic law the MADEKKI was authorised to assess the quality of medical care provided in medical institutions not only upon receiving complaints from patients but also in response to ‘requests’, which to the Senate meant requests from medical institutions. In the course of carrying out such checks the statute of the MADEKKI as well as section 50 of the Medical Treatment Law entitled the MADEKKI to collect information and documents relating to questions within its field of competence.

The Court reiterates that according to Article 19 of the Convention its duty is to ensure the observance of the engagements undertaken by the Contracting Parties to the Convention. In particular, it is not its function to deal with errors of fact or law allegedly committed by a national court unless and in so far as they may have infringed rights and freedoms protected by the Convention (see García Ruiz v. Spain [GC], no. 30544/96, § 29, ECHR 1999-I). Against this background, the Court turns to the interpretation of section 11(5) of the Personal Data Protection Law given by the Senate of the Supreme Court (see paragraph 28 above).

The Court notes that in the present case the MADEKKI started to collect the applicant's medical data in 2004, seven years after her sterilisation and at a time when the applicant was involved in civil litigation with the Cēsis hospital. In the Court's view this lengthy delay raises a number of questions, such as the one highlighted by the applicant, namely, whether data collection in 2004 can be deemed to have been ‘necessary for the purposes of medical treatment [or] the provision or administration of heath care services’ within the meaning of section 11(5) of the Data Protection Law, if the actual health care services had been provided seven years earlier, in 1997. Such a broad interpretation of an exception to the general rule militating against the disclosure of personal data might not offer sufficient guarantees against the risk of abuse and arbitrariness (see S. and Marper, cited above, § 99).

In this context the Court finds it noteworthy that the applicant had never been informed that the MADEKKI had collected and processed her personal data in order to carry out a general control of the quality of health care provided by the Cēsis hospital to patients in situations comparable to the one of the applicant. The hospital itself was never given any recommendations on how to improve the services provided by it. The only information that was received by the hospital pertained specifically to the actions of the doctor responsible for the applicant's treatment and that information was provided to the hospital at a time when there was an ongoing litigation between the applicant and the hospital.

The Court notes that the applicable legal norms described the competence of the MADEKKI in a very general fashion. The Senate of the Supreme Court did not explain which of its functions the MADEKKI had been carrying out or what public interest it had been pursuing when it issued a report on the legality of the applicant's treatment. Accordingly the Senate did not and could not examine the proportionality of the interference with the applicant's right to respect for her private life against any public interest, particularly since it came to the conclusion that such weighing had already been done by the legislator (see paragraph 22 above).

Moreover, this took place against the background of domestic law, as in force at the relevant time, which did not provide for the right of the data subject to be informed that the MADEKKI would be processing his or her medical data before it started collecting the data. Thus the MADEKKI was under no legal obligation to take decisions concerning the processing of medical data in such a way as to take the data subject's views into account, whether simply by asking for and potentially receiving the data subject's consent or by other means (see Z v. Finland, cited above, § 101, referring to W. v. the United Kingdom, 8 July 1987, § 64, Series A no. 121).

The Court cannot accept the Government's suggestion that the MADEKKI was collecting information concerning the applicant's medical history in order to determine whether the doctor who had performed the tubal ligation had to be held criminally liable. Firstly, seven years after the event the prosecution had certainly become time-barred (depending on the legal classification of the potentially criminal act, the statutory limit was most likely two years but certainly no more than five years). Secondly, neither the director of the Cēsis hospital nor the MADEKKI had the legal authority to determine, even on a preliminary basis, the criminal liability of private individuals.

Turning to the Government's argument that the MADEKKI was authorised by the law to assist the hospital in litigation, in order to curtail the legal costs (see paragraph 38 above), the Court notes that the MADEKKI is part of the State administration structure, the raison d'être of which is to serve the interests of the general public within the limits of its competence. According to the Government, a hospital, which at the time was a respondent party in private-law litigation, was authorised to seek independent expert advice from the MADEKKI. Such a hypothesis was not discussed by the Senate of the Supreme Court. The Court has difficulties in understanding the legal basis for the argument of the Government, since, at least prima facie, none of the legal norms cited by the Government states that providing independent expert advice in ongoing litigation is one of the functions of the MADEKKI.

The Court reiterates that the protection of personal data, not least medical data, is of fundamental importance to a person's enjoyment of the right to respect for his or her private life as guaranteed by Article 8 of the Convention. Respecting the confidentiality of health data is a vital principle in the legal systems of all the Contracting Parties to the Convention. It is crucial not only to respect the sense of privacy of a patient but also to preserve confidence in the medical profession and in the health services in general (see Z v. Finland, cited above, § 95, and Varapnickaitė-Mažylienė v. Lithuania, no. 20376/05, § 44, 17 January 2012).

The Court notes that the applicable law did not limit in any way the scope of private data that could be collected by the MADEKKI. In the present case the MADEKKI collected the applicant's medical data concerning a period spanning seven years, starting one year before the disputed tubal ligation and ending six years after it. The medical information collected and analysed by the MADEKKI originated from three different medical institutions. The relevance and sufficiency of the reasons for collecting information about the applicant that was not directly related to the procedures carried out at the Cēsis hospital in 1997 appear not to have been examined at any stage of the domestic procedure (see Z v. Finland, cited above, § 110).

The Court notes that the MADEKKI appears to have collected the applicant's medical data indiscriminately, without any prior assessment of whether the data collected would be ‘potentially decisive’, ‘relevant’ or ‘of importance’ (see M.S. v. Sweden, cited above, §§ 38, 42 and 43, and L.L. v. France, no. 7508/02, § 46, ECHR 2006-XI) for achieving whatever aim might have been pursued by the MADEKKI's inquiry. In this context it becomes less relevant whether the staff of the MADEKKI had a legal duty to maintain the confidentiality of personal data (see paragraph 20 above and compare M.S. v. Sweden, cited above, § 43).

In the light of the above considerations the Court cannot find that the applicable Latvian law was formulated with sufficient precision and afforded adequate legal protection against arbitrariness. Neither did it indicate with sufficient clarity the scope of discretion conferred on the competent authorities and the manner of its exercise.

The Court accordingly concludes that the interference with the applicant's right to respect for her private life was not in accordance with the law within the meaning of Article 8 § 2 of the Convention. Consequently there has been a violation of Article 8.