U-I-70/12

 

 

 

 

 

 

U-I-70/12

21 March 2014

 

 

On the basis of the first paragraph of Article 30 of the Rules of Procedure of the Constitutional Court (Official Gazette RS, Nos. 86/07, 54/10, and 56/11), the Constitutional Court hereby issues the following

 

 

 

I

 

The Decision

 

In proceedings to review the constitutionality of a law initiated upon the request of the Human Rights Ombudsman, the Constitutional Court decided, by Decision No. U-I-70/12, dated 21 March 2014, that the Protection of Documentary and Archival Material and Archival Institutions Act (Official Gazette RS, No. 30/06 – hereinafter referred to as the PDAMAIA) is inconsistent with the Constitution insofar as it also classifies as archival material the [documentary] materials of medical service providers defined in this Act as entities of public law that contain personal data regarding the treatment of patients. At the same time, the Constitutional Court determined the manner of the implementation of its Decision. In order to safeguard the rights of patients, the Constitutional Court decided that until a different statutory regulation enters into force the regulation determined by the PDAMAIA and by the implementing regulations adopted on the basis thereof shall not apply as regards the [documentary] materials of providers of medical services defined by this Act as entities of public law that are classified as public archival material in accordance with this Act and contain personal data regarding the treatment of patients.

 

The Constitutional Court adopted the Decision unanimously, composed of nine judges.

 

The fundamental point of the present Decision is that the general regulation of archiving as determined by the PDAMAIA cannot apply to [archival] material as specific as medical records.

 

 

II

 

The Principal Grounds for the Decision

 

The Constitutional Court proceeded (by taking into account the statutory definitions of the fundamental terms and allegations of the applicant) from the assumption that the term “archival material” contained in the PDAMAIA also includes documents and material produced during the medical treatment of patients. The applicant challenged the statutory provision that imposed on the providers of medical services as a public service the obligation to hand over, i.e. transfer, the selected medical records containing personal data to an archival institution. However, this statutory obligation was not the only decisive factor in the assessment of the case at issue. What was decisive for the assessment of the Constitutional Court was the definition itself of the term “archival material”, which also includes medical records, and the tightly interlinked issue of (the subsequent) public accessibility and usefulness of such archival material for scientific and cultural purposes, and the legal certainty of persons.

 

The Constitutional Court carried out the assessment from the viewpoint of the right to the protection of personal data (Article 38 of the Constitution) and by taking into consideration that the effect of the interference at issue also extends to the inviolability of personal dignity, thus jeopardising it (Article 34 of the Constitution).

 

One of the fundamental starting points of the review of constitutionality was respect for human dignity as one of the most fundamental societal values. This starting point is important for the formulation of priorities, selections, and limitations. What are emphasised in the context at issue are the duty and responsibility of society and the state to enable individuals to maintain their dignity during treatment, in their life with a certain diagnosis, as well as at the time of their death and afterwards. Data collected in medical records reveal, on the one hand, information from the personal life of patients, which are protected within the framework of the inviolability of one’s privacy (Article 35 of the Constitution) even before they become recorded data and thus a part of medical records; while, on the other hand, their disclosure jeopardises the personal dignity of patients, their dependents, and even their descendants, namely due to the stigma in society that is associated with certain illnesses or conditions. Therefore, the need to protect such data once they are recorded in medical records, which constitute a sui generis database of sensitive personal data, is all the more pronounced. In this respect it must be underlined that merely appropriately strict and abstractly envisioned legal guarantees of the protection of the privacy of patients do not suffice, in particular where the personal data concerned are as sensitive as those that are the subject of consideration in the present case. The decisive factor in building the expectation of the protection of the privacy of patients, which is based on the self-evident medical secrecy, is respect for these guarantees and the implementation thereof at all levels of society. Hence, consistent respect for medical secrecy is an indispensable part of the implementation of the right of patients to the protection of their personal data collected in medical records.

 

The mere storage of sensitive personal data contained in medical records by a public authority – as well as archiving and transferring [archival] material from the health care institution or hospital whence it originates to a public archival institution in order to enable public access to such materials – entails an interference with the right of patients to the protection of personal data (Article 38 of the Constitution) and with the right to the protection of their privacy (Article 35 of the Constitution), while at the same time it also jeopardises the inviolability of personal dignity (Article 34 of the Constitution). In accordance with the established constitutional case law, an interference with human rights is admissible under the conditions determined by the third paragraph of Article 15 of the Constitution. In such framework, the Constitutional Court first had to assess whether the legislature pursued a constitutionally admissible objective by the challenged statutory regulation.

 

When the matter concerns interferences with two human rights as important as was the case regarding the two rights in the case at issue, the legislature must all the more take into consideration that these rights may only be limited due to objectives that are entirely clearly and concretely defined, and only as such can they become constitutionally admissible grounds for limiting these rights. Namely, only a regulation that has a precisely determined objective can enable an assessment of whether the pursued objectives are at all compatible with the primary purpose of the collection of data and whether it is reasonable to assume – precisely because they are compatible – that they do not depart from the primary objective of their collection to such an extent that their further use would conflict with the prohibition determined by the second sentence of the first paragraph of Article 38 of the Constitution.

 

By the challenged statutory regulation, the legislature pursued the objective of preserving the originality of this archival material and ensuring its public accessibility and usefulness for the purposes of science and culture, as well as the legal certainty of persons. In the assessment of the Constitutional Court, the objective of a statutory regulation that was so generally defined does not reflect the due diligence and responsibility of the legislature as regards the handling of medical data (i.e. that which is required when handling medical records both at the time when they are created and also after the patient’s death). Namely, an objective defined in such a manner does not reflect that the legislature took into account the following: (1) the importance of the protection of sensitive personal data contained in the medical records whose disclosure may also entail an interference with the personal dignity of patients and their dependents; (2) medical secrecy as a necessary prerequisite for the confidentiality of the relationship between patient and doctor; and (3) the constitutional guarantees that patients are ensured in order to exercise their right to the protection of personal data, with a special emphasis on the prohibition of using personal data contrary to the purpose of the collection thereof. Therefore, the Constitutional Court could not deem the mentioned general objective of the legislature to entail a constitutionally admissible objective, which every statutory regulation by which constitutionally protected human rights and fundamental freedoms are interfered with must have in a state governed by the rule of law.

 

Considering all of the above, the Constitutional Court established that the challenged statutory regulation was inconsistent with the right to the protection of personal data (Article 38 of the Constitution) and indirectly also with the right to the inviolability of one’s personal dignity (Article 34 of the Constitution).

 

 

                                                                                              Mag. Miroslav Mozetič

                                                                                              President

 

 

U-I-70/12

21 March 2014

 

 

 

At a session held on 21 March 2014, in proceedings to review constitutionality initiated upon the request of the Human Rights Ombudsman, the Constitutional Court

 

decided as follows:

 

 

 

3. Until a different statutory regulation enters into force, the regulation determined by the Protection of Documentary and Archival Material and Archival Institutions Act and by the implementing regulations adopted on the basis thereof shall not apply as regards the [documentary] materials of providers of medical services defined by this Act as entities of public law that are classified as public archival material in accordance with this Act and that contain personal data regarding the treatment of patients.

 

REASONING

 

 

 

1. The Human Rights Ombudsman (hereinafter referred to as the applicant) challenges the first paragraph of Article 40 of the Protection of Documentary and Archival Material and Archival Institutions Act (hereinafter referred to as the PDAMAIA), which determines that “entities of public law”[1] must hand over archival material to the [competent] archival institution within 30 years of its creation. This obligation also applies to archival material containing sensitive personal data, which includes [medical records containing] data regarding individuals’ health condition (e.g. regarding psychiatric treatment).

 

2. According to the applicant, the mentioned statutory provision is inconsistent with Articles 2, 14, 34, 35, and 38 of the Constitution. In its view, the alleged inconsistency lies in the fact that the Act does not specifically regulate the conditions for handing over medical records to the Archival Institution of the Republic of Slovenia. The applicant believes that records of treatments of mental patients should not be automatically (in accordance with the provisions of the PDAMAIA) defined as archival material, as this is, allegedly, in clear contrast to the purpose of the collection and further processing of such personal data, and contrary to the principle of proportionality in collecting such data. In such context, the applicant draws attention to the conflict of the purposes of the collection and processing of these data: on the one hand, the purpose of the collection and processing of medical (including psychiatric) data is to provide health care and to monitor and evaluate the treatment of patients; while on the other, the main purpose of the storage of archival material as items of cultural significance (Article 7 of the PDAMAIA) is to preserve original and authentic archival material, i.e. regarding the usefulness of its content, proceeding from the principle of providing access thereto to various users. Since archival material is stored for a purpose that is different than the purpose of the collection of medical data, the admissibility of transferring such archival material, the accessibility thereof, and its handling should have been specifically regulated in the PDAMAIA. According to the applicant, no public interest can prevail over the interest of individuals who enter a treatment process with the expectancy that their intimate data will remain confidential and only be used for the purposes of their treatment. The PDAMAIA should have specifically regulated the conditions for handing over such data to the public archival institution and specifically determine the manner in which such material may be further used [i.e. processed]. Both the handing over and the further use and processing of these data should only be admissible on the basis of the prior personal consent of the data subjects, or, as regards data concerning deceased persons, only on the basis of the consent of their relatives. The further processing of such data in public archival institutions and access thereto should be specifically regulated by the Act. In this regard, the applicant draws attention to respect for the rights determined by Articles 34 and 35 of the Constitution. Medical data, in particular data regarding mental health, fall among the most sensitive personal data, in his opinion, therefore they can be a powerful tool as regards misuse and interference with the personality rights and dignity of individuals. In such context, the applicant underlines both the right of a deceased person to be respected and the possible material and social repercussions for family members who could be negatively affected in their search for employment or in relationships with their partners and other dependents. In the opinion of the applicant, free access to medical data would also cause long-lasting damage to the trust between patients and doctors. The applicant finds it unacceptable that the public interest (which is not even clearly defined) would have priority over the concrete interests of patients and their dependents. With regard to the above, the applicant also refers to Opinion of the Medical Ethics Committee of the Republic of Slovenia No. 19/09/11, dated 31 August 2011, in which the mentioned aspects are particularly underlined. The applicant substantiates the alleged inconsistency of the challenged statutory provision with Article 14 of the Constitution by claiming that the obligation to hand over archival material that contains sensitive medical data only applies to entities of public law (and not also to entities of private law). This allegedly indicates an unjustified differentiation between patients depending on the manner of the exercise of the medical service, as private providers of medical services are not obliged in the same manner as providers of medical services as a public service to hand over medical records to the Archival Institution of the Republic of Slovenia. According to the applicant, there are no reasonable grounds for such a differentiation.

 

3. The National Assembly did not reply to the allegations in the request.

 

 

4. By Order No. U-I-70/12, dated 24 May 2012, the Constitutional Court suspended the challenged statutory provision until a final decision by the Constitutional Court. It assessed that its implementation could cause irreparable damage to those individuals (and their family members) whose data on psychiatric treatment would be included in the selected medical records that would be handed over to the archival institution as public archival material. Irrespective of the fact that the time limits in which such archival material becomes accessible are longer (the second paragraph of Article 65 of the PDAMAIA) and irrespective of the provisions regarding the protection of personal data (the fifth paragraph of Article 63 of the PDAMAIA and the provisions of the Personal Data Protection Act, Official Gazette RS, No. 94/07 – official consolidated text – hereinafter referred to as the PDPA-1), it would namely be impossible to remedy ex post the consequences of the possible accessibility of such sensitive personal data.

 

 

 

5. The applicant challenges the first paragraph of Article 40 of the PDAMAIA, which imposes on entities of public law the obligation to hand over public archival material to the competent archival institution within 30 years of its creation, including archival material that contains personal data, including sensitive personal data (the first indent of the first paragraph of Article 40 of the PDAMAIA). It draws attention to the contradiction between the purpose of the collection and processing of medical data in treatment procedures and the purpose of the storage of archival material. It underlines that the point of dispute is particularly the duty of psychiatric hospitals to hand over selected medical records that are defined as archival material to the archival institution.

 

6. The Constitutional Court concurs with the applicant that the psychiatric treatment database is one of the most sensitive databases of medical data. It refers to a particularly vulnerable group of patients. Considering the widespread social stigma associated with the mental health of individuals and the burdensome effect of heredity in this area, the accessibility of psychiatric treatment data outside of treatment procedures in itself jeopardises the personal dignity of patients, their dependents, and even their descendants. The obligation to respect and preserve the dignity of patients, which is included in the code of ethics of the majority of medical professions and which requires heightened and continuous attention to ensure that these obligations are implemented in all fields of medical care are only even more pronounced in the field of mental health. The position of this particularly vulnerable group imposes on society as a whole the duty to understand this position and to accordingly and consistently respect and implement the ethical principles that serve as the guideline for the relationship between doctor and patient. In this respect, one should not overlook the particularities of this relationship that are characteristic of the mental health field and that are characterised by the relative loss of privacy and often also by a lack of understanding of treatment procedures, all of which additionally intensifies the negative experience of the illness. However, the stigma and fear thereof are not associated only with psychiatric treatment. Such negative responses and experiences are also associated with other diseases and conditions in which individuals need health care (e.g. sexually transmitted diseases, AIDS, abortion, assisted conception procedures, etc.); also severe chronic diseases must not be overlooked (e.g. oncologic diseases). It must be stressed at the onset that merely appropriately strict and abstractly envisioned legal guarantees of the protection of the privacy of patients do not suffice, in particular where the personal data concerned are as sensitive as those that are the subject of consideration in the present case. The decisive factor in building the expectation of the protection of the privacy of patients is consistent respect for these guarantees and the implementation thereof at all levels of society. The fundamental guideline in this respect is the duty and responsibility of society and the state to enable individuals to maintain their dignity during treatment, in their life with a certain diagnosis, as well as at the time of their death and afterwards. All of the above serves to preserve the unblemished image of individuals, which necessitates a diligent and responsible attitude towards handling the data stored in medical databases.

 

7. Hence, the case at issue addresses the issue of the attitude towards the positions of a particularly vulnerable group of persons and in general towards positions characterised by numerous specificities that are characteristic of the maintenance of health as a value that occupies a high position in the life of individuals and society as a whole. The constitutional assessment of the case at issue therefore requires an accordingly broader view, in which respect for human dignity as a constructive value of society occupies the central position. Such a starting point is important for the formulation of priorities, selections, and limitations. When human dignity is jeopardised or violated, it is the whole community, i.e. society, that suffers, thus it is not only the autonomy of individuals that is affected.[2]

 

8. Considering the mentioned starting points, the constitutional review in the case at issue requires an answer to the question of whether the entire regulation as determined by the PDAMAIA – which classifies as archival material also the documentary materials of all providers of medical services as a public service (not only psychiatric hospitals), including such material that contains personal data regarding the treatment of patients defined as sensitive personal data – is in conformity with the Constitution.

 

9. In fact, the PDAMAIA only provides a general definition of the term public archival material and an assessment criteria for determining which documentary material is archival material (cf. the eighth paragraph of Article 40 of the PDAMAIA), while the concretisation thereof is left to the expert instructions of the commission of the competent archival institution. In accordance with the eleventh indent of Article 2 of the PDAMAIA, documentary material that has a lasting significance for science and culture or for the legal certainty of persons in accordance with the expert instructions of the competent archival institutions is considered archival material. Public archival material is selected from documentary material on the basis of the written expert instructions of the competent archival institution and the additional written expert instructions of the representatives of the competent archival institution during the selection itself (cf. the fourteenth indent of Article 2 of the PDAMAIA). The manner of and procedure for selecting archival material from documentary material and the procedure for handing over public archival material is determined in more detail by the Decree on the Custody of Documentary and Archival Material (Official Gazette RS, No. 86/06 – hereinafter referred to as the Decree).

 

10. Considering the statutory definitions of the fundamental terms (cf. Article 2 and the second paragraph of Article 65 of the PDAMAIA), the general regulation under the PDAMAIA also includes medical records. In accordance with the third paragraph of Article 55 of the Decree, documentary material that due to its importance is, as a general rule, always considered to be archival material, is determined by Appendix 1 of the Decree. Listed therein are also, in accordance with Point 1 of the Appendix, official, i.e. public, databases, including all personal data databases and other databases that are managed, in accordance with regulations, by health care authorities (i.e. files). Also the applicant stresses that under the umbrella term “archival material” there also fall the files of concrete patients and other documents produced during treatment procedures.[3] The National Assembly did not reply to the allegations of the applicant. Taking the above into consideration, it must be concluded from this assumption that the term “archival material” contained in the PDAMAIA also includes documents and material produced during the medical treatment of patients.

 

11. The purpose of archival material is to preserve the collective and individual memory, i.e. the knowledge of individuals and society of their past. In order to achieve such purpose, the legislature enshrined the principle of free access to public archival material (the first paragraph of Article 63 of the PDAMAIA). This principle enables archiving experts to carry out their vocation, which is not only to store and protect public archival material, but also, and in particular, to enable access to and the usefulness of such material (for scientific and cultural purposes, as well as for ensuring the legal certainty of persons).[4] In fact, concerning sensitive personal data, the legislature prescribed an exemption as regards free access to public archival material by determining a longer period of inaccessibility. Namely, in accordance with the second paragraph of Article 65 of the PDAMAIA (provided that other regulations do not determine otherwise), public archival material containing sensitive personal data (including one's health condition) becomes available for use 75 years after it is produced, or ten years after the death of the person that it concerns, provided that the date of death is known. In addition, the legislature imposed on the users of archival material the obligation to sign, before using such material, a declaration that they are aware that any misuse of confidential and personal data is punishable under the Criminal Code and other regulations, and that they will use such data exclusively for purposes that are legal (the fifth paragraph of Article 62 of the PDAMAIA). In this context, it should be underlined that the duty to hand over, i.e. to transfer, the selected medical records containing personal data to the public archival institution is in itself not essential for consideration of the case at issue. Even if the archival material of providers of medical services as a public service that contains data on the treatment of patients remained stored in the archival facilities of medical institutions and hospitals (i.e. if they themselves stored the archival material), these institutions and hospitals would namely be obliged, in accordance with the PDAMAIA and the PDPA-1, to enable access to and the use of the archival material.[5] It transpires that the crucial point is the definition itself of the term “archival material”, which is tightly interlinked with the issue of the public accessibility thereof (subsequently) and the usefulness of such archival material for scientific and cultural purposes, as well as for ensuring the legal certainty of persons.

 

12. Medical records contain sensitive personal data, which in accordance with international instruments,[6] the legal order of the EU,[7] and the PDPA-1[8] enjoy special protection. The processing thereof is prohibited as a general rule, while exemptions are only admissible if special protective measures are determined at the same time.[9] As the applicant emphasises, the primary purpose of recording (collecting) information that communicates various personal data of patients is to provide patients health care and to monitor and evaluate the treatment itself. Allegedly, these data should only be stored for as long as they are necessary to attain the purpose for which they were collected or further processed (cf. the first paragraph of Article 21 of the PDPA-1). Once the purpose of the processing is attained, personal data are, as a general rule, erased, destroyed, blocked, or anonymised, which, however, does not apply to personal data that on the basis of the PDAMAIA are defined as archival material (cf. the second paragraph of Article 21 of the PDPA-1). Archiving medical data and the transfer of material from the medical institutions and hospitals in which they were produced to a public archival institution in order to enable the accessibility of such material to the public entail using personal data outside of the primary purpose of their collection (i.e. the further processing of personal data).[10] Hence, this constitutes a departure from the principle of finality as one of the fundamental principles of personal data protection.[11]

 

13. It is characteristic of medical records that they are created (as a general rule) with the patient’s consent and in the form of a collection (a string) of personal data for the purpose of the patient’s treatment. The patient entrusts information regarding him- or herself to the doctor while in a very sensitive position. For such (confidential) relationship, medical secrecy is self-evident[12] because it is precisely medical secrecy that reduces or eliminates even the most minor feelings of supervision, which is what ultimately enables the patient to freely speak of the issues due to which he or she decided to consult a doctor and which are key to treatment. The patient therefore justifiably expects respect from the authorities as regards the confidentiality of the relationship between him or her and the doctor. It must be taken into consideration that data in medical records reveal numerous very intimate details, characteristics, and the conditions of the patient and of his or her dependents. Consequently, the accessibility of data regarding the individual’s health condition and different forms of treatments as well as the use thereof entail a severe interference with the personal dignity of patients and their dependents. These data reveal much more than just information necessary for the identification of a certain person. Data collected in such a manner reveal, on the one hand, information from the personal life of patients, which are protected within the framework of the inviolability of one’s privacy (Article 35 of the Constitution) even before they become recorded data and thus a part of medical records; while, on the other hand, their disclosure jeopardises the personal dignity of patients, their dependents, and even their descendants, namely due to the stigma in society that is associated with certain illnesses or conditions. Therefore, the need to protect such data once they are recorded in medical records, which constitute a sui generis database of sensitive personal data, is all the more pronounced.[13] Any transfer of such data to a different storage facility additionally increases the risk that these data might be used for purposes inconsistent with the requirements of the protection of the human rights of the data subjects.

 

14. Considering the above-stated, there is no doubt that the mere storage of sensitive personal data contained in medical records by a public authority[14] – as well as archiving and transferring [archival] material from the health care institution or hospital whence it originates to a public archival institution in order to enable public access to such materials – entails an interference with the right of patients to the protection of personal data (Article 38 of the Constitution) and with the right to the protection of their privacy (Article 35 of the Constitution), while at the same time it also jeopardises the inviolability of personal dignity (Article 34 of the Constitution). The substance of the right determined by Article 38 of the Constitution is tightly interlinked with the substance of the general right to the protection of privacy determined by Article 35 of the Constitution.[15] The purpose of the protection of personal data is to ensure respect for a special aspect of privacy, in particular under the conditions imposed by the information society. The Constitutional Court has emphasised a number of times that the constitution-framers, by Article 38 thereof, protected one of the aspects of the privacy of individuals in particular, namely so-called information privacy.[16] The fundamental underlying value of this constitutional provision is the realisation that individuals have the right to keep information regarding themselves private and that, essentially, it is they who decide how much information about themselves they will reveal and to whom.[17] Considering the above-mentioned, the Constitutional Court carried out an assessment from the viewpoint of the right to the protection of personal data, taking into consideration that the effect of this interference also extends to the inviolability of one’s personal dignity, thus jeopardising it.

 

15. Article 38 of the Constitution determines in more detail the constitutional guarantees concerning the implementation of the right to the protection of personal data. The first paragraph of Article 38 of the Constitution prohibits the use of personal data contrary to the purpose for which they were collected. This express constitutional prohibition serves to prevent the threat of transmitting already collected personal data about a certain individual irrespective of or contrary to his or her will, and strengthens the trust of such individual as regards the transmission of information regarding him- or herself in a certain relation and for a designated purpose. Without this prohibition, the possibility of data subjects to have an influence on when, how, and in what scope the information regarding them will be transmitted to others would be limited.[18] Furthermore, the Constitution determines that the collection, processing, designated use, supervision, and protection of the confidentiality of personal data are subject to statutory regulation (the second paragraph of Article 38 of the Constitution) and grants everyone the right of access to the collected personal data that relates to him or her and also the right to judicial protection in the event of any abuse of such data (the third paragraph of Article 38 of the Constitution).

 

16. In accordance with the established constitutional case law, any processing of personal data entails an interference with the constitutional right to the protection of privacy, i.e. with the right of individuals to retain information about themselves that they do not want others to learn of (information privacy).[19] In the context of the case at issue, the fact that an interference with the right to the protection of personal data (Article 38 of the Constitution) also jeopardised the inviolability of one’s personal dignity (Article 34 of the Constitution) must also be taken into consideration. An interference with human rights is admissible under the conditions determined by the third paragraph of Article 15 of the Constitution. In such framework, the Constitutional Court must assess whether the legislature pursued a constitutionally admissible objective and whether the interference is consistent with the general principle of proportionality (Article 2 of the Constitution).[20]

 

17. It follows from the legislative file that the fundamental objective of the PDAMAIA was to comprehensively regulate the protection of documentary material, and, under this umbrella term, the protection of archival material in particular.[21] An important guideline in defining the legislative objective was also the fundamental principles of the PDAMAIA (namely, the principle of the preservation of documentary material, i.e. as regards the usefulness of its content, the principle of permanence, the principle of completeness, the principle of accessibility, and the principle of the protection of items of cultural significance) and the statutory definition itself, which defines archival material as documentary material that is of lasting significance for science and culture or for the legal certainty of persons (cf. the eleventh indent of Article 2 of the PDAMAIA). This definition in particular demonstrates that the legislative objective was conditional upon the function of the archival material. By adopting the challenged statutory provision, the legislature pursued the needs of science and culture (which can be classified as falling within the meaning of the right to the freedom of scientific and artistic endeavour determined by Article 59 of the Constitution) and the need to ensure the legal certainty of persons (which falls within the framework of the principles of a state governed by the rule of law determined by Article 2 of the Constitution).

 

18. The question that the Constitutional Court must answer first is how clearly and precisely the legislature must define the objective of the challenged regulation, which interferes with the exercise of the right of individuals determined by Article 38 of the Constitution in the field of the protection of sensitive personal data, the disclosure of which can at the same time also jeopardise the inviolability of one’s personal dignity (Article 34 of the Constitution). When interfering with rights that individuals are guaranteed in order to exercise their right to the protection of personal data,[22] the legislature must namely not overlook the constitutional guarantees contained in Article 38 of the Constitution.

 

19. The purpose of the constitutional guarantees determined by Article 38 of the Constitution is to reduce or eliminate the danger of inadmissible interferences with the right of individuals to make decisions regarding their information privacy and thus to strengthen the trust of individuals that personal data about themselves that they reveal will be used for the designated purpose, and in no event will such be used contrary to the purpose for which they were collected. There is no doubt that the mentioned constitutional guarantees significantly affect the willingness, i.e. consent, of individuals to entrust their personal data for a designated purpose. In the context at issue, the required diligence of the legislature is additionally emphasised because the case concerns the issue of the protection of particularly sensitive personal data that originate from the confidential relationship between patient and doctor and the disclosure of which could jeopardise the inviolability of the personal dignity of the patient and that of his or her dependents. It must be taken into consideration that the patient provides the information about him- or herself and his or her dependents to the doctor for the purposes of treatment, and justly relies on the confidentiality of this relationship. The fear of the social stigma connected with the possibility that these data might be revealed is not without a negative influence on the confidentiality of the relationship between doctor and patient. Due to his or her fear, the patient may become reserved as regards offering information regarding him- or herself to the doctor, which may compromise or even prevent the realisation of the primary purpose of the recording of such data, i.e. the treatment itself. Consistent respect for medical secrecy is therefore an indispensable part of the patient’s exercise of his or her right to the protection of his or her personal data collected in the medical record. In ensuring the protection of constitutional values that are so sensitive, there is an evident need for a clear and precise definition of the legislative objective by which the legislature justifies this interference with the rights of the affected individuals protected by Article 38 (and also Article 34) of the Constitution. Only a regulation that has a precisely determined objective can enable an assessment of whether the pursued objectives are at all compatible with the primary purpose of the collection of the data and whether it is reasonable to assume – precisely because they are compatible – that they do not depart from the primary objective of their collection to such an extent that their further use would conflict with the prohibition determined by the second sentence of the first paragraph of Article 38 of the Constitution. The time dimension (the time lag) of access to medical data is not crucial for the assessment at issue. Of key importance is namely the question of how society as a whole handles medical data (both at the time when they are created and also after the patient’s death) and whether such conduct reflects the due diligence of society and the state as regards maintaining and respecting human dignity. When the matter concerns interferences with two human rights as important as is the case regarding the two rights in the case at issue, the legislature must all the more take into consideration that these rights may only be limited due to objectives that are entirely clearly and concretely defined, and only as such can they become constitutionally admissible grounds for limiting these rights.

 

20. It is evident from the above that the PDAMAIA and the legislative file include merely the generally defined objective of the statutory regulation, namely the comprehensive protection of archival material for the purposes of science and culture, as well as the legal certainty of persons. It cannot be deduced from an objective that is so generally defined that the legislature took into consideration the following: (1) the importance of the protection of sensitive personal data contained in medical records whose disclosure may also entail an interference with the personal dignity of patients and their dependents; (2) medical secrecy as an essential prerequisite for the confidentiality of the relationship between patient and doctor; and (3) the constitutional guarantees that patients are ensured in order to exercise their right to the protection of personal data, with a special emphasis on the prohibition of using personal data contrary to the purpose of the collection thereof.[23] Therefore, this objective cannot be deemed to be constitutionally admissible as regards the assessed interference with the rights of patients protected by Articles 38 and 34 of the Constitution.

 

21. Consequently, the Constitutional Court established (without assessing the conditions in accordance with the strict test of proportionality) that the PDAMAIA is inconsistent with the Constitution insofar as it also classifies as public archival material the [documentary] materials of medical service providers defined in this Act as entities of public law that contain personal data regarding the treatment of patients.

 

22. On the basis of the first paragraph of Article 48 of the Constitutional Court Act (Official Gazette RS, Nos. 64/07 – official consolidated text and 109/12 – hereinafter referred to as the CCA), the Constitutional Court adopted a declaratory decision (Point 1 of the operative provisions). As follows from the reasoning above, the general regulation of archiving determined by the PDAMAIA cannot also apply to material as specific as medical records. The mere abrogation of the first indent of the first paragraph of Article 40 of the PDAMAIA that the applicant expressly challenged would not allow for constitutionally consistent application of the statutory regulation in the part that is the subject of consideration in this Decision. The established unconstitutionality in fact refers to multiple provisions of the PDAMAIA, including some fundamental definitions contained in Article 2 of the PDAMAIA. Since the PDAMAIA is drafted in such a manner that the abrogation of individual provisions would not allow for constitutionally consistent application of the statutory regulation concerning the archival material of providers of medical services as a public service, the Constitutional Court adopted a declaratory decision. In accordance with the second paragraph of Article 48 of the CCA, the Constitutional Court imposed on the legislature the obligation to remedy the established unconstitutionality within one year following the publication of the present Decision in the Official Gazette of the Republic of Slovenia (Point 2 of the operative provisions). Considering the reasons contained in this Decision, the legislature will have to assess whether it is necessary to adopt, in addition to the existing regulation determined by the HCDA (which regulates databases in the field of medical care), an appropriate statutory regulation that will regulate the archiving of medical documentation (and include the possibility that the providers of medical services themselves archive such documents), with regard to which the constitutional starting points from the present Decision must apply regardless of whether such concerns providers of medical services within the framework of a public medical service network or providers that operate in private networks. Although this Decision refers to providers of medical services as a public service (which in the PDAMAIA are defined as entities of public law), the constitutional starting points in this Decision must apply to all medical service providers (in public and private networks). When adopting a specific statutory regulation regarding the archiving of medical records, the legislature will have to sufficiently ensure the protection of the human rights of patients and their dependents, in particular from the viewpoint of the exercise of the right to the protection of personal data and the protection of the inviolability of personal dignity.

 

23. On the basis of the second paragraph of Article 40 of the CCA, the Constitutional Court also determined the manner of the implementation of its decision (Point 3 of the operative provisions). In order to ensure respect for the rights of patients determined by Articles 38 and 34 of the Constitution, the Constitutional Court determined that until a different (i.e. specific) statutory regulation enters into force, the regulation determined by the PDAMAIA and the implementing regulations adopted on the basis thereof shall not apply as regards the [documentary] materials of providers of medical services defined by this Act as entities of public law that are classified as public archival material in accordance with the PDAMAIA and contain personal data regarding the treatment of patients. This is intended to prevent the possible violation of the human rights and fundamental freedoms of patients and their dependents in concrete procedures. It should be underlined in this context that the same reasons that led to the establishment of the unconstitutionality of the PDAMAIA also apply to the Decree that was adopted on the basis of the Act and that classifies as archival material also official, i.e. public, databases, including all personal data databases and other databases that, in accordance with the regulations, are managed by health care authorities (i.e. files). Such entails that when deciding in concrete procedures the competent authorities and courts will also be prevented from applying the mentioned Decree insofar as it refers to the [documentary] materials of providers of medical services in the public medical service network.

 

24. Since the Constitutional Court established the inconsistency of the PDAMAIA with Articles 38 and 34 of the Constitution, it did not assess the other allegations of the applicant.

 

 

 

25. The Constitutional Court adopted this Decision on the basis of the second paragraph of Article 40 and Article 48 of the CCA, composed of: Mag. Miroslav Mozetič, President, and Judges Dr Mitja Deisinger, Dr Dunja Jadek Pensa, Mag. Marta Klampfer, Dr Etelka Korpič – Horvat, Dr Ernest Petrič, Jasna Pogačar, Dr Jadranka Sovdat, and Jan Zobec. The Decision was adopted unanimously.

 

 

                                                                                              Mag. Miroslav Mozetič

                                                                                              President

 

 

 

 

Notes:

[1] In accordance with the twelfth indent of Article 2 of the PDAMAIA, “entities of public law” are state authorities, self-governing local community authorities, bearers of public authority, and providers of public services.

[2] For more on this subject, see N. Jacobson, Dignity and Health: A Review, Revus, No. 10 (2009), p. 48.

[3] This also transpires from the constitutional complaint and petition that are the subject of consideration of the Constitutional Court in case No. Up-637/11, U-I-120/11. In that case, the Inspectorate of the Republic of Slovenia for Culture and Media imposed on the complainant (i.e. the Ljubljana Psychiatric Clinic), inter alia, the obligation to hand over to the Archival Institution of the Republic of Slovenia archival material collected up to and including 1945 and archival material collected up to and including 1977 – except for the archival material that is still in use for the purpose of the treatment of patients – which must be put in order and include an inventory in accordance with the directions of the Archival Institution of the Republic of Slovenia. The complainant filed an action against the mentioned inspection decision, which was then dismissed by the Administrative Court. The complainant then filed an appeal before the Supreme Court, which rejected it. Against the order of the Supreme Court, the complainant filed a constitutional complaint and at the same time also a petition to initiate proceedings for the review of the constitutionality of the first paragraph of Article 40 of the PDAMAIA.

[4] It is stressed in the Recommendation of the Committee of Ministers of the Council of Europe No. R (2000) 13 concerning access to archival material, adopted on 13 July 2000, that access to public archival material is not a privilege but a right. In 2012, the International Council on Archives adopted the Principles of Access to Archives. The first and the basic principle is that the public has the right to access archives created by public authorities, while at the same time, archives should be accessible to the greatest extent possible irrespective of whether they are public or private. For more on the substance of these principles, see M. Košir, Od načel Mednarodnega arhivskega sveta o dostopnosti arhivskega gradiva do kritičnih pripomb k predlogu nove evropske uredbe o varstvu osebnih podatkov [The International Council on Archives’ Principles of Access to Archives and Critical Remarks regarding the Draft of the New European Regulation on the Protection of Personal Data], Arhivi, No. 1 (2013), pp. 75–83. 

[5] It follows from the Opinion of the Information Commissioner No. 0712-2/2009/2, dated 24 November 2009, that regardless of who the data controller controlling sensitive personal data is, the data controller is obliged to handle such as required by the PDPA-1, whereas after the documents are archived and the time limit determined by the second paragraph of Article 65 of the PDAMAIA expires, these documents become publicly accessible.

[6] The Republic of Slovenia is bound by the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Official Gazette RS, No. 11/94, MP, No. 3/94 – hereinafter referred to as the CPIAPPD), which includes a special principle on the limitation of the processing of certain categories of personal data. In accordance with Article 6 of the CPIAPPD, personal data revealing racial origin, political opinions or religious or other beliefs, as well as personal data concerning health or sexual life, may not be processed automatically unless domestic law provides appropriate safeguards.

[7] Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23 November 1995, pp. 31–50 – hereinafter referred to as the Directive) in principle prohibits the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life (the first paragraph of Article 8 of the Directive). The exemptions in which the prohibition of processing sensitive categories of data does not apply are determined by the second paragraph of Article 8 of the Directive. Subject to the provision of suitable safeguards, Member States may, for reasons of substantial public interest, lay down exemptions in addition to those laid down in paragraph 2 [of that Article] either by national law or by a decision of the supervisory authority (the fourth paragraph of Article 8 of the Directive).

[8] The PDPA-1 includes provisions on the specific protection of sensitive personal data and exhaustively defines the legal grounds on which they may be processed (cf. Article 13 of the PDPA-1). One of these grounds is where another law so provides in order to implement the public interest (point 8 of Article 13 of the PDPA-1). The legislature may only regulate, by (a specific) law, the statutory authorisation for processing personal data if the processing of such data is absolutely necessary for implementing a substantial public interest and the interest of the public prevails over the interest of individuals. Cf. R. Jay: Data Protection, Law and Practice, 3^rd Edition, Sweet & Maxwell, London 2007, pp. 286 et seq. The same is also stated by M. Prelesnik in: N. Pirc Musar (Ed.): Zakon o varstvu osebnih podatkov s komentarjem [The Personal Data Protection Act with Commentary], GV Založba, Ljubljana 2006, p. 135.

[9] It follows from Recital 34 of the Directive and also from the fourth paragraph of Article 8 of the Directive that whereas Member States must also be authorised, when justified by reasons of important public interest, to derogate from the prohibition on processing sensitive categories of data (where important reasons of public interest so justify in areas such as public health, social protection, scientific research, and government statistics), it is incumbent on them, however, to provide specific and suitable safeguards so as to protect the fundamental rights and the privacy of individuals.

[10] The term “processing of personal data” is defined by point 3 of Article 6 of the PDPA-1. It follows from Opinion of the Information Commissioner No. 0712-2/2009/2, dated 24 November 2009, that any use of archival material that includes sensitive personal data entails the processing of such personal data within the meaning of Point 3 of Article 6 of the PDPA-1.

[11] This principle follows from Article 5 of the CPIAPPD and Article 6 of the Directive. The latter determines that personal data must be collected for specified, explicit, and legitimate purposes and not further processed in a way incompatible with those purposes. Further processing of data for historical, statistical, or scientific purposes is not considered as incompatible provided that Member States provide appropriate safeguards (point (b) of the first paragraph of Article 6 of the Directive). A similar provision is contained in point (e) of the first paragraph of Article 6 of the Directive, in accordance with which personal data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed. Member States shall lay down appropriate safeguards for personal data stored for longer periods for historical, statistical, or scientific use.

[12] Both the Health Care Services Act (Official Gazette RS, Nos. 23/05 – official consolidated text, 23/08, and 14/13) and the Medical Practitioners Act (Official Gazette RS, Nos. 72/06 – official consolidated text and 58/08) bind medical personnel to protect professional secrecy. An equal obligation is determined by the first paragraph of Article 45 of the Patient Rights Act (Official Gazette RS, No. 15/08 – hereinafter referred to as the PRA). In general, the PRA devotes special attention to the protection of privacy in carrying out medical services (Article 43) and in protecting the personal data of patients (Article 44). Such protection is also emphasised by some sectoral laws (cf. Article 18 of the Mental Health Act, Official Gazette RS, No. 77/08).

[13] The Health Care Databases Act (Official Gazette RS, No. 65/2000 – hereinafter referred to as the HCDA) determines health care databases, as well as the collection, processing, and transmission of data that are controlled, used, and mutually exchanged between legal entities and natural persons who carry out medical service. In the Appendix, which is a component part of the Act, the following are determined: the types and content of individual health care databases, their purpose, periodic reports, who must transmit the data and when, the data controller, the manner of transmitting data, and the time period for which the data are to be stored.

[14] The European Court of Human Rights (hereinafter referred to as the ECtHR) has ruled a number of times that the fact that a public authority stores data on the private life of individuals constitutes an interference with the right to respect for their private life, which is guaranteed by the first paragraph of Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms (Official Gazette RS, No. 33/94, MP, No. 7/94), with regard to which the Court explained that it is irrelevant for which purpose these data are used. Cf. the Judgment of the ECtHR in Amann v. Switzerland, dated 16 February 2000.

[15] It follows from the Judgment of the Court of Justice of the European Union in the joined cases Volker und Markus Schecke GbR (C-92/09) and Hartmut Eifert v. Land Hessen (C-93/09), dated 9 November 2010, that the right to the protection of personal data is so tightly interlinked with the right to the protection of privacy that it can be deemed that the rights determined by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (OJ C 83, 30 March 2010, pp. 389–403) define “respect for the right to private life with regard to the processing of personal data.”

[16] See, e.g., Decision of the Constitutional Court No. U-I-238/99, dated 9 November 2000 (Official Gazette RS, No. 113/2000, and OdlUS IX, 257), Para. 16 of the reasoning. Cf. the following Decisions of the Constitutional Court: No. U-I-92/01, dated 28 February 2002 (Official Gazette RS, No. 22/02, and OdlUS XI, 25); No. U-I-298/04, dated 27 October 2005 (Official Gazette RS, No. 100/05, and OdlUS XIV, 77); No. U-I-57/06, dated 29 March 2007 (Official Gazette RS, No. 33/07, and OdlUS XVI, 22); No. U-I-464/06, dated 5 July 2007 (Official Gazette RS, No. 65/07, and OdlUS XVI, 67); No. U-I-411/06, dated 19 June 2008 (Official Gazette RS, No. 68/08, and OdlUS XVII, 43); and No. U-I-98/11, dated 26 September 2012 (Official Gazette RS, No. 79/12).

[17] See Decision of the Constitutional Court No. U-I-98/11, Para. 12 of the reasoning.

[18] Cf. J. Čebulj in: L. Šturm (Ed.), Komentar Ustave Republike Slovenije [Commentary on the Constitution of the Republic of Slovenia], Fakulteta za podiplomske državne in evropske študije, Ljubljana 2002, p. 409, Para. 6.

[19] See the Decisions of the Constitutional Court cited in note No. 18.

[20] Cf. Decision of the Constitutional Court No. U-I-18/02, dated 24 October 2003 (Official Gazette RS, No. 108/03, and OdlUS XII, 86).

[21] Gazette of the National Assembly, No. 3/06, EPA 654-IV.

[22] Cf. J. Čebulj in: L. Šturm (Ed.), op. cit., p. 410, Para. 11. In his commentary to Article 38 of the Constitution, the author emphasised that there are two manners in which interferences with the protection of personal data are possible. The first manner is processing personal data contrary to the principles and requirements of the Constitution, contrary to the statutory regulation of personal data protection based thereon, and contrary to the statutory regulation that regulates the processing of personal data in individual domains. The second manner is an interference with the rights that the legislation gives to individuals in order to exercise their constitutional right to the protection of personal data.

[23] See Recommendation of the Committee of Ministers of the Council of Europe No. R (97) 5 on the Protection of Medical Data, dated 13 February 1997. In accordance with this Recommendation, medical data may only be kept for as long as it is absolutely necessary to achieve the purpose for which they were collected and processed. At the request of the data subject, his or her medical data must be erased unless they are stored in an anonymous form or these data are such that they must be stored in the public interest, and their security – and hence the anonymity of the patient – is guaranteed. The Recommendation also determines the rules for using medical data for scientific research purposes. The fundamental rule is that medical data used for scientific research purposes should be in an anonymous form. In exceptional circumstances, it is admissible, within the framework of an individual scientific research project, to disclose personal data if the competent national authority has given its consent in order to protect an important public interest, but only if the data subject was not expressly opposed to such disclosure, and if the interests of the research project justify such disclosure.