The Protection of Personal Data & The Sad Story of “Z”

“If I maintain my silence about my secret it is my prisoner…if I let it slip from my tongue, I am ITs prisoner.”
― Arthur Schopenhauer

One important aspect of privacy is recognised in common law – that of the confidentiality of medical information.   Patients should be free of the fear that they will be harmed by disclosure of clinical information as a result of engaging with a doctor.

In the UK there are various statutes and statutory instruments that require doctors to reveal information, which would otherwise be considered confidential. For example the reporting of notifiable diseases (Public Health Control of Diseases Act 1984) or notification of terminations of pregnancy (Abortion Regulations, 1991).  The Abortion Regulations provides a good example of the clarity given to the subject’s protections when medical information has to be disclosed, its section 5 specifically refers to the restrictions placed on disclosure of information.   There are ten parts to this section that explicitly spells out the limited remit of any information disclosed to the Chief Medical Officer and his delegates relating to abortions and the narrow window that it can be processed.

It is by no accident then, that the Police (Injury) Benefit Regulations (PIBR) does not reference at all the words ‘medical records’ or ‘medical notes’.  Given this fact, that no mention of the limitations of disclosure is made, such as you’ll read in the Abortion Regulations, it is clear that there is no requirement for disclosure in the first place!

There is also no implied obligation to do so because it would involve the state asserting an unqualified right to inspect confidential medical records.

Think on this for a second:  There is only one small sample of the UK populace who is frequently threatened to disclose all and every piece of medical information ever written about them in their entire life on a whim of a non-medical HR agent working for a police force.  Fail to acquiesce and a HR minion will terrorise a disabled former police officer by saying they will stop the injury award that person receives.

Everyone else in the UK is protected from such a menace – but the HR minion authoring the threats blithely continues onwards without pause.

Bureaucrats such as the medical retirement officer from Merseyside police demands full medical records from birth, ignorant (or not caring) that a request for such medical records isn’t mandated by any law.  If the former officer is female, the fact that these medical records may contain records of an abortion and therefore protected by the statutory instrument mentioned above, is criminally overlooked by the officious functionary.

When a statutory instrument calls for medical information, this is what you’ll find:

“A notice given or any information furnished to a Chief Medical Officer in pursuance of these Regulations shall not be disclosed except that disclosure may be made…[]”STATUTORY INSTRUMENTS 1991 No. 499 MEDICAL PROFESSION The Abortion Regulations 1991

Their ignorance is beyond comprehension.  In reality everyone, those with injury awards included, also have protections under the Human Rights legislation.

Don’t take our word for it.  Just listen to the European Court of Human Rights (ECHR).

It will not surprise our constant readers that the European court found that domestic law must afford appropriate safeguards to prevent any such communication or disclosure of personal health data as may be inconsistent with the guarantees in Article 8 of the Convention.

In other words there has to be effective and adequate safeguards against the possibility that either irrelevant or medically inaccurate information recorded would be re-circulated and used out of its original context to the prejudice of the person.  Such safeguards as exampled in the UK Abortion Regulations!

Before we go on an exploration of a judgement made by the European Court of Human Rights it’s worth saying first that Brexit will not change anything about the point we will make here.

The ECHR is not part of the EU and will not change on Brexit as it is completely separate from the EU.  The ECHR was drafted in the aftermath of the Second World War and adopted by the Council of Europe in 1950. It was incorporated into UK law through the Human Rights Act 1998.  Arguably, the Great Repeal Bill, which will become an Act in 2019 or 2020, will do quite the opposite of repealing anything: although the Bill will remove the 1972 European Communities Act (ECA), which gives EU law authority, first it will adopt EU law lock stock and barrel into UK law

OK.  Proviso dealt with.

We are going to talk about what the ECHR thinks of “The State” using it’s authority to demand things of it’s citizens – specifically personal data.

In 1997 “Z” applied to the European Court of Human Rights alleging that her right to privacy under the Convention was violated when her HIV status was disclosed by the media during her husband’s criminal trial.

Z v. FINLAND – 22009/93 – Chamber Judgment [1997] ECHR 10 (25 February 1997)

You are here: BAILII >> Databases >> European Court of Human Rights >> Z v. FINLAND – 22009/93 – Chamber Judgment [1997] ECHR 10 (25 February 1997) URL: http://www.bailii.org/eu/cases/ECHR/1997/10.html Cite as: 25 EHRR 371, (1999) 45 BMLR 107, [1997] ECHR 10, (1998) 25 EHRR 371

This ECHR case turned on issues of privacy as Z was the applicant complaining that Finland’s legal system had not protected her privacy rights under Article 8 of the European Convention on Human Rights throughout the process.

The Finnish police tried to investigate when X, the spouse of Z, became HIV positive to prove an attempted manslaughter charge against X;  subsequent to the victims being raped by X.   At the 1993 manslaughter hearing, Z’s doctor was called as a prosecution witness and told the court about Z’s medical history, specifically a blood test taken from Z three years earlier.   Z also took the witness stand and told the court that she had not been infected with HIV by X.

All the medical records of Z were seized by the Finnish police who added them all to items of evidence in the case files.  These records comprised some thirty documents.  Such seizure would be unlawful in the UK by virtue of the Police and Criminal Evidence Act 1984 (PACE)*.

*PACE Sections 8 and 9 and schedule 1 (see R v. Central Criminal Court ex parte Brown (1992) TLR Sept 7th) in the absence of agreement by those holding the records the police have no powers to seize or have access to ‘documentary and other records’.

X was convicted of attempted manslaughter for the three rapes he committed in 1992 and solely rape for the offence committed in 1991.   The court sentenced X to seven years imprisonment and decreed that the reasoning and case files (including Z’s medical records) should be kept confidential for a decade.

Just after the first trial a leading national newspaper reported the seizing of Z’s medical records under the headline “Prosecutor obtains medical records of wife of man accused of HIV rape”.  The article published the first name and family name of Z.

In December 1993 the convictions were upheld by Finland’s Court of Appeal.  Further, the 1991 rape as well as newly introduced 1992 rape charge was now judged to have been attempted manslaughter.  The reasoning was released to the media.  It contained a passage where Z was named as a carrier of HIV and that as the wife of X, this gave X reasonable suspicion to think he was also infected.  In any case, the Court of Appeal sentenced X to a further four years.

The media again published identifiable information of both Z and X after the Court of Appeal sent the decision by fax on the day the hearing was concluded to several newspapers.

Under Finnish law, the Court of Appeal had the power to omit any identifiers of individuals in their judgements.  The ECHR heard whether the Court of Appeal was justified to release the disclosure of Z’s identity and HIV status in the Court of Appeal’s judgement made available to the press.

It was explained to the ECHR that X’s lawyers had petitioned for the confidentially order of a decade to be extended and that Z remained anonymous.  The Court of Appeal had paid no heed.

The EHCR ruled that the publication of Z’s identity and medical condition was not supported by any cogent reasons and accordingly the publication gave rise to a violation of Z’s right to respect for her family and private life as guaranteed by Article 8.  The EHCR also made a ruling on the special nature of medical data:

In this connection, the Court will take into account that the protection of personal data, not least medical data, is of fundamental importance to a person’s enjoyment of his or her right to respect for private and family life as guaranteed by Article 8 of the Convention (art. 8).

The court made it clear that health data has a special preeminence:

Respecting the confidentiality of health data is a vital principle in the legal systems of all the Contracting Parties to the Convention. It is crucial not only to respect the sense of privacy of a patient but also to preserve his or her confidence in the medical profession and in the health services in general.

We are fortunate in the UK.   Existing primary legislation such as PACE, Access to Medical Reports Act and the Data Protection Act ‘should‘ prevent medical records floating around so many of the case file bundles as happened in the case of Z.

Would the story of Z reached the ECHR if not for the media leak?  Perhaps, perhaps not.  But that’s not the point.  The point is, once medical records are ‘released into the wild‘ the subject loses control over them.

Clearly UK lawmakers know this and that is why the Abortion Regulations puts safeguards on such sensitive medical information.  The ECHR ruled that medical information needs unrivalled protection and that is why the PIBR, as a similar statutory instrument, does not call for medical records by not referencing them and by not implementing safeguards on any, HR or SMP invented, ‘implied disclosure’.

When a HR minion demands full medical records from birth there is always a possibility that your medical records will fall into the hands of those not entitled to access them.  And as a consequence the material is misused.  The story of Z is an extreme case but the Finnish Court of Appeal still made a massive mistake that potentially can be repeated if medical records aren’t treated as the most sensitive and confidential of all personal documentation and never disclosed in full just because a SMP wants to see the “whole picture”.

Are you sufficiently confident that the Finnish Court of Appeal is more incompetent than the Occupational Health unit of a police service you used to serve with?  And that your own confidential data couldn’t be used in untoward processing?  Do you know whether your medical data relates to any 3rd party?

Murphy’s law comes into play here.  The adage that is typically stated as: Anything that can go wrong, will go wrong.  No public organisation is beyond making the same mistake as one of the highest Finnish court.  Indeed, given how often police HR departments cock things up and the frequency that the Police Injury Benefit Regulations are contravened there is a much higher probability that the HR department could lose and misuse such sensitive medical data.

Talking about the original ten year confidentially order (breached by the Court of Appeal) the EHCR stated plainly that:

the interference with the applicant’s private and family life which the contested orders entailed was thus subjected to important limitations and was accompanied by effective and adequate safeguards against abuse

We’ll repeat this again: There are no limitations and there are no safeguards provided by the Police Injury Benefit Regulations in relation to confidential medical records.  Why?  Because there is no mention of confidential medical records in the Regulations.

A police force asks for full medical records from birth because their default position is that the injury award grant was wrong.  And they want their double jeopardy.  They want to reduce their financial commitment and will gladly look for a medical incident when you were 11 years old to justify their malevolence.

Case law is quite clear in this matter.  Pollard, Turner and Laws all state the last decision is final.  There is no right for them to have any medical records.  The clock cannot be ‘turned back’.

Tell them this and refer them to this blog if the HR minion disagrees.

How would the HR minion react if they themselves, or close family members, were victims of such bullying and bureaucratic blundering?  You would hear their personal outcries of injustice in their own reaction to a public authority, decades after their own retirement, sending a missive demanding disclosure to their own full medical history.

Best they realise now that following ‘orders’ gives them no protection.  They should think very carefully before signing letters demanding things they have no legal justification to demand.