The Commissioner for Information of Public Importance and Personal Data Protection in the letter addressed to the Ministry of Justice asked from the Ministry to take steps to eliminate inconsistent, mutually contradictory solutions in certain laws that are the source of the dilemma regarding the right to personal data protection and a constant source of violation of that right.
Heads of health institutions have addressed the Commissioner confronted with requests from the police and prosecutor's offices, referring to the Code of Criminal Procedure or the Law on Prevention of Domestic Violence, to make available to them information on the state of health of patients, which, in view of the provisions of the Law on Patients' Rights cause dilemmas - whether they can give these data on request or can only give them with the consent of the patient, or on the basis of a court decision.
The Commissioner pointed to several things he considered relevant.
According to the Law on Personal Data Protection, health data is classified as particularly sensitive data that can be processed only with freely given consent, and without consent only if it is explicitly prescribed by law.
The Law on Patients' Rights particularly guarantees the right to confidentiality of personal data and explicitly prescribes the obligation to preserve confidentiality of data, from which it frees only the patient's consent or a court decision.
On the other hand, the Code of Criminal Procedure prescribes, among other things, the power to collect data that the prosecutor can collect alone or through the police. This is a general authorization that does not specifically refer to patients' personal data.
The Law on Patients' Rights is a separate law (lex specialis), since the processing of data on health status in this law is regulated in particular with regard to the general provision on the collection of data under the Code of Criminal Procedure. The Law on Patients' Rights is the latter law (lex posterior), since the amendments to the Code did not apply to the provisions on access to data. According to the well-defined principles of interpretation and application of the law: Lex specialis derogat legi generali and lex posterior derogat legi priori, it must have been clear that the nprovisions of the Law on Patients' Rights have priority.
As regards the Law on Prevention of Domestic Violence, this law prescribes the obligation of the competent police officer to assess the risk of immediate danger and, in particular, to take into account whether the perpetrator is mentally ill or misuses psychoactive substances. However, it is possible to consult only centres for social work, not health institutions, and in particular their obligation to provide patient data is not prescribed. Accordingly, neither the provisions of this law can imply the exclusion of the obligation of healthcare professionals prescribed by the Law on Patients' Rights.
The Commissioner reminded that this is not the first time this problem appears, that he has pointed out several times the non-compliance of the law, the legal uncertainty of all persons, as well as the specific problematic actions of the police and the prosecution in requests for access to health data, to the Republic Public Prosecutor and the Minister of Health, but there has been no expected result in terms of amending the law.
