Inconsistency with GDPR and the Constitution. Ministry of Health projects criticized by the head of the data protection office

The President of the Office for Personal Data Protection, Mirosław Wróblewski, draws the attention of the Ministry of Health to the fact that the processing of special category data (e.g. concerning the health of citizens) should take place in a document of statutory rank and not on the basis of an implementing regulation.

Criticism has appeared before ("many times", as the head of the UODO points out). Most recently, during public consultations on the draft amendment to the regulation on guaranteed benefits in the field of hospital treatment (which is to introduce the requirement to register recordings of endometriosis procedures), as well as an amendment to the draft concerning the pilot program in mental health centers .

In both cases, Mirosław Wróblewski points out that, in accordance with the constitutional principles, as well as the conditions resulting from the GDPR, in the scope of processing sensitive data, including health or genetic data, an appropriately constructed legal basis should be introduced in statutory provisions.

The statutory regulation should specify the legal basis for the processing of special category personal data. Not only in terms of the purposes of such processing, but also: what data will be collected, how it will be processed for the purposes of treating patients and, for example, the program being conducted during its duration and after its completion. In addition, how long the information will be stored, on what terms and to whom and in what manner it will be made available.

- The criteria for processing data of this category should result from an act of statutory rank, and implementing regulations should only specify the principles of program implementation. This will ensure respect for the principle of legalism, reliability and transparency, referred to in art. 5 sec. 1 letter a of regulation 2016/679 - emphasizes Mirosław Wróblewski.

The head of the UODO also does not spare words of criticism regarding the idea of ​​the Ministry of Health, assuming the introduction of the obligation to document the medical procedure of treating endometriosis in the form of an audio-video recording, constituting part of the medical documentation. According to Wróblewski, this is a solution that deeply interferes with the right to privacy of patients and the right to the protection of their personal data. And this is especially problematic in the context of the fact that the solution is introduced in the form of an annex to the regulation, and not an act.

Mirosław Wróblewski once again emphasizes that the drafter does not indicate the legal basis, purpose or conditions under which the procedure is to be recorded. It also does not regulate the period of storing the recordings. The regulation is to concern the provision of services related to the particularly intimate sphere of the patient (including, for example, recordings of genitals). The material is also to be part of medical documentation, and therefore potentially can be made available to a wide range of entities referred to in Article 26 of the Act on Patients' Rights and the Patient Rights Ombudsman.

- Therefore, the proposed regulation raises serious doubts from the point of view of proportionality of the introduced restrictions on the rights and freedoms of persons, in particular the right to privacy and the right to personal data protection - indicates Mirosław Wróblewski.

The head of the supervisory authority adds that the planned solutions, in the absence of appropriate statutory guarantees, cannot constitute a stand-alone basis for the mandatory use of audio-video devices in every case of an endometriosis procedure performed by a service provider.

All the more so because - as the head of the UODO points out - the drafter "did not in any way justify the need to introduce such restrictions on the rights and freedoms of patients, or the method of recording the procedure. In particular, he did not conduct an assessment of the impact of the regulation on data protection, required by Art. 35 and in connection with Art. 25 of the GDPR".

According to our information, the criticism of the president of the supervisory body has had an effect. The Ministry of Health has decided to abandon, for now, the regulation regulating the obligation to register endometriosis treatment procedures. However, it has declared further work in this area.

- Taking into account the monitoring of the quality of the services provided and the educational purpose, we will work on solutions in the field of, among others, the aspect of data security, the method/form and duration of their storage - Rynek Zdrowia hears from the Ministry of Health.

Write to the author: [email protected]

Copyrighted material - reprint rules are specified in the regulations .