The Protection of Personal Data & The Sad Story of “Z”

“If I maintain my silence about my secret it is my prisoner…if I let it slip from my tongue, I am ITs prisoner.”
Arthur Schopenhauer

One important aspect of privacy is recognised in common law – that of the confidentiality of medical information.   Patients should be free of the fear that they will be harmed by disclosure of clinical information as a result of engaging with a doctor.

In the UK there are various statutes and statutory instruments that require doctors to reveal information, which would otherwise be considered confidential. For example the reporting of notifiable diseases (Public Health Control of Diseases Act 1984) or notification of terminations of pregnancy (Abortion Regulations, 1991).  The Abortion Regulations provides a good example of the clarity given to the subject’s protections when medical information has to be disclosed, its section 5 specifically refers to the restrictions placed on disclosure of information.   There are ten parts to this section that explicitly spells out the limited remit of any information disclosed to the Chief Medical Officer and his delegates relating to abortions and the narrow window that it can be processed.

It is by no accident then, that the Police (Injury) Benefit Regulations (PIBR) does not reference at all the words ‘medical records’ or ‘medical notes’.  Given this fact, that no mention of the limitations of disclosure is made, such as you’ll read in the Abortion Regulations, it is clear that there is no requirement for disclosure in the first place!

There is also no implied obligation to do so because it would involve the state asserting an unqualified right to inspect confidential medical records.

Think on this for a second:  There is only one small sample of the UK populace who is frequently threatened to disclose all and every piece of medical information ever written about them in their entire life on a whim of a non-medical HR agent working for a police force.  Fail to acquiesce and a HR minion will terrorise a disabled former police officer by saying they will stop the injury award that person receives.

Everyone else in the UK is protected from such a menace – but the HR minion authoring the threats blithely continues onwards without pause.

Bureaucrats such as the medical retirement officer from Merseyside police demands full medical records from birth, ignorant (or not caring) that a request for such medical records isn’t mandated by any law.  If the former officer is female, the fact that these medical records may contain records of an abortion and therefore protected by the statutory instrument mentioned above, is criminally overlooked by the officious functionary.

When a statutory instrument calls for medical information, this is what you’ll find:

“A notice given or any information furnished to a Chief Medical Officer in pursuance of these Regulations shall not be disclosed except that disclosure may be made…[]”STATUTORY INSTRUMENTS 1991 No. 499 MEDICAL PROFESSION The Abortion Regulations 1991

Their ignorance is beyond comprehension.  In reality everyone, those with injury awards included, also have protections under the Human Rights legislation.

Don’t take our word for it.  Just listen to the European Court of Human Rights (ECHR).

It will not surprise our constant readers that the European court found that domestic law must afford appropriate safeguards to prevent any such communication or disclosure of personal health data as may be inconsistent with the guarantees in Article 8 of the Convention.

In other words there has to be effective and adequate safeguards against the possibility that either irrelevant or medically inaccurate information recorded would be re-circulated and used out of its original context to the prejudice of the person.  Such safeguards as exampled in the UK Abortion Regulations!

Before we go on an exploration of a judgement made by the European Court of Human Rights it’s worth saying first that Brexit will not change anything about the point we will make here.

The ECHR is not part of the EU and will not change on Brexit as it is completely separate from the EU.  The ECHR was drafted in the aftermath of the Second World War and adopted by the Council of Europe in 1950. It was incorporated into UK law through the Human Rights Act 1998.  Arguably, the Great Repeal Bill, which will become an Act in 2019 or 2020, will do quite the opposite of repealing anything: although the Bill will remove the 1972 European Communities Act (ECA), which gives EU law authority, first it will adopt EU law lock stock and barrel into UK law

OK.  Proviso dealt with.

We are going to talk about what the ECHR thinks of “The State” using it’s authority to demand things of it’s citizens – specifically personal data.

In 1997 “Z” applied to the European Court of Human Rights alleging that her right to privacy under the Convention was violated when her HIV status was disclosed by the media during her husband’s criminal trial.

Z v. FINLAND – 22009/93 – Chamber Judgment [1997] ECHR 10 (25 February 1997)

You are here: BAILII >> Databases >> European Court of Human Rights >> Z v. FINLAND – 22009/93 – Chamber Judgment [1997] ECHR 10 (25 February 1997) URL: Cite as: 25 EHRR 371, (1999) 45 BMLR 107, [1997] ECHR 10, (1998) 25 EHRR 371

This ECHR case turned on issues of privacy as Z was the applicant complaining that Finland’s legal system had not protected her privacy rights under Article 8 of the European Convention on Human Rights throughout the process.

The Finnish police tried to investigate when X, the spouse of Z, became HIV positive to prove an attempted manslaughter charge against X;  subsequent to the victims being raped by X.   At the 1993 manslaughter hearing, Z’s doctor was called as a prosecution witness and told the court about Z’s medical history, specifically a blood test taken from Z three years earlier.   Z also took the witness stand and told the court that she had not been infected with HIV by X.

All the medical records of Z were seized by the Finnish police who added them all to items of evidence in the case files.  These records comprised some thirty documents.  Such seizure would be unlawful in the UK by virtue of the Police and Criminal Evidence Act 1984 (PACE)*.

*PACE Sections 8 and 9 and schedule 1 (see R v. Central Criminal Court ex parte Brown (1992) TLR Sept 7th) in the absence of agreement by those holding the records the police have no powers to seize or have access to ‘documentary and other records’.

X was convicted of attempted manslaughter for the three rapes he committed in 1992 and solely rape for the offence committed in 1991.   The court sentenced X to seven years imprisonment and decreed that the reasoning and case files (including Z’s medical records) should be kept confidential for a decade.

Just after the first trial a leading national newspaper reported the seizing of Z’s medical records under the headline “Prosecutor obtains medical records of wife of man accused of HIV rape”.  The article published the first name and family name of Z.

In December 1993 the convictions were upheld by Finland’s Court of Appeal.  Further, the 1991 rape as well as newly introduced 1992 rape charge was now judged to have been attempted manslaughter.  The reasoning was released to the media.  It contained a passage where Z was named as a carrier of HIV and that as the wife of X, this gave X reasonable suspicion to think he was also infected.  In any case, the Court of Appeal sentenced X to a further four years.

The media again published identifiable information of both Z and X after the Court of Appeal sent the decision by fax on the day the hearing was concluded to several newspapers.

Under Finnish law, the Court of Appeal had the power to omit any identifiers of individuals in their judgements.  The ECHR heard whether the Court of Appeal was justified to release the disclosure of Z’s identity and HIV status in the Court of Appeal’s judgement made available to the press.

It was explained to the ECHR that X’s lawyers had petitioned for the confidentially order of a decade to be extended and that Z remained anonymous.  The Court of Appeal had paid no heed.

The EHCR ruled that the publication of Z’s identity and medical condition was not supported by any cogent reasons and accordingly the publication gave rise to a violation of Z’s right to respect for her family and private life as guaranteed by Article 8.  The EHCR also made a ruling on the special nature of medical data:

In this connection, the Court will take into account that the protection of personal data, not least medical data, is of fundamental importance to a person’s enjoyment of his or her right to respect for private and family life as guaranteed by Article 8 of the Convention (art. 8).

The court made it clear that health data has a special preeminence:

Respecting the confidentiality of health data is a vital principle in the legal systems of all the Contracting Parties to the Convention. It is crucial not only to respect the sense of privacy of a patient but also to preserve his or her confidence in the medical profession and in the health services in general.

We are fortunate in the UK.   Existing primary legislation such as PACE, Access to Medical Reports Act and the Data Protection Act ‘should‘ prevent medical records floating around so many of the case file bundles as happened in the case of Z.

Would the story of Z reached the ECHR if not for the media leak?  Perhaps, perhaps not.  But that’s not the point.  The point is, once medical records are ‘released into the wild‘ the subject loses control over them.

Clearly UK lawmakers know this and that is why the Abortion Regulations puts safeguards on such sensitive medical information.  The ECHR ruled that medical information needs unrivalled protection and that is why the PIBR, as a similar statutory instrument, does not call for medical records by not referencing them and by not implementing safeguards on any, HR or SMP invented, ‘implied disclosure’.

When a HR minion demands full medical records from birth there is always a possibility that your medical records will fall into the hands of those not entitled to access them.  And as a consequence the material is misused.  The story of Z is an extreme case but the Finnish Court of Appeal still made a massive mistake that potentially can be repeated if medical records aren’t treated as the most sensitive and confidential of all personal documentation and never disclosed in full just because a SMP wants to see the “whole picture”.

Are you sufficiently confident that the Finnish Court of Appeal is more incompetent than the Occupational Health unit of a police service you used to serve with?  And that your own confidential data couldn’t be used in untoward processing?  Do you know whether your medical data relates to any 3rd party?

Murphy’s law comes into play here.  The adage that is typically stated as: Anything that can go wrong, will go wrong.  No public organisation is beyond making the same mistake as one of the highest Finnish court.  Indeed, given how often police HR departments cock things up and the frequency that the Police Injury Benefit Regulations are contravened there is a much higher probability that the HR department could lose and misuse such sensitive medical data.

Talking about the original ten year confidentially order (breached by the Court of Appeal) the EHCR stated plainly that:

the interference with the applicant’s private and family life which the contested orders entailed was thus subjected to important limitations and was accompanied by effective and adequate safeguards against abuse

We’ll repeat this again: There are no limitations and there are no safeguards provided by the Police Injury Benefit Regulations in relation to confidential medical records.  Why?  Because there is no mention of confidential medical records in the Regulations.

A police force asks for full medical records from birth because their default position is that the injury award grant was wrong.  And they want their double jeopardy.  They want to reduce their financial commitment and will gladly look for a medical incident when you were 11 years old to justify their malevolence.

Case law is quite clear in this matter.  Pollard, Turner and Laws all state the last decision is final.  There is no right for them to have any medical records.  The clock cannot be ‘turned back’.

Tell them this and refer them to this blog if the HR minion disagrees.

How would the HR minion react if they themselves, or close family members, were victims of such bullying and bureaucratic blundering?  You would hear their personal outcries of injustice in their own reaction to a public authority, decades after their own retirement, sending a missive demanding disclosure to their own full medical history.

Best they realise now that following ‘orders’ gives them no protection.  They should think very carefully before signing letters demanding things they have no legal justification to demand.








The Protection of Personal Data & The Sad Story of “Z”

7 thoughts on “The Protection of Personal Data & The Sad Story of “Z”

  • 2017-04-30 at 10:40 am

    Great blog!

    The only medical records they have a right to see are the RELEVANT ones that describe the condition which caused the IOD retirement, and any treatment or substantial deterioration or improvement of that condition. It seems that the latest trend is to apply apportionment to any IOD officer or pensioner being retired or reviewed. In most cases this would have been unlawful. They have gotten away with this for years because most IOD’s have not known the correct way to challenge this.

    IODPA is now making a huge difference to the IOD’s remaining victims of the unlawful tactics being used in retirements and reviews and they are now getting things put right even if it means cases going to High Court to do that.


  • 2017-04-20 at 12:31 pm

    An excellent blog, as always.

    As a female, former officer, there are a number of very personal details held within my medical records relating to the complications which occurred during the birth of my children and other, significant gynaecological matters which have been read, and undoubtedly discussed, by unknown HR individuals from my Force.

    It is extremely traumatic to think of who is now aware of my private, personal issues, which are absolutely nothing to do with my injury on duty and which I was forced to disclose to the Force under the threat of my injury on duty award being reduced or removed.

    This vile treatment by my Force has had a tremendous impact on my health and well being.

    I have withdrawn my consent in writing for the Force to read, retain or use this medical information and I have repeatedly requested that the records be returned to me. More than 9 months later the Force have still not returned my personal, confidential information for which they have no consent to hold.

    They are quite literally criminals.

  • 2017-04-16 at 5:42 am

    Well written, the plod clearly think they are above the law . When I asked for my data back I was told by the Mighty Met they could keep it until “I die”. There levels of ignorance and arrogance are top notch.

  • 2017-04-15 at 4:28 pm

    This blog has provided an articulate summary of the DPA 1998 in relation to medical records.
    The Data Protection Act is there to protect personal information and that includes personal sensitive information.
    Who is the data controller?
    The Data Controller is a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be, processed. Consent. The only personnel permitted to see this information are those who it is considered have a legitimate interest by the Data Controller. Now, this raises questions…who is the Data Controller in the police…..
    You are not obliged under the DPA 1998 to consent to your full medical records being made available to the SMP , solicitor or HR. Particularly HR.
    Imagine, you have personal information in your records unrelated to your injury: sexually transmitted diseases, sexual problems, termination of pregnancy, marital problems. Many of these entries will involve documentation regarding a partner or family member.
    Would you or YOUR PARTNER want YOUR employer / former employer having access to this sensitive information that is none of their business?
    I am aware of many retired and serving officers unwilling to visit their GP for fear of their health problems being recorded and later submitted to a PA where a civilian employee, including a legal employee and personnel minion can potentially have a good nose and snigger with a colleague over a coffee and a kitkat…Let us face it, the professional and educated status of these individuals is very questionable.

  • 2017-04-15 at 3:29 pm

    I will be writing tothe HR department of my Force and telling them to return the Gp records that they hold on me with a proviso that they have not copied them and do not hold any other medical records on me.
    My reasoning is that I have not given them permission to examine them and I know for a fact three doctors have looked at the without my permission I will name them in my letter but to do so here will only lead to them identifying me. Perhaps some good sole could give me an idea of what to quote?

  • 2017-04-15 at 12:05 pm

    Another brilliant blog which clarifies what a lot of us have been thinking for some time. We all know that the only reason for demanding medical records is so that they can carry out what is effectively a reassessment of the original decision, unlawfully applying apportionment wherever they can in order to try and justify a reduction in banding. Any IOD undergoing a review must insist that the regulations are followed to the letter and refuse to comply with anything not covered by the regs.
    The only question up for discussion at a review is “Has there been a SUBSTANTIAL alteration since the last final assessment/review?” In the vast majority of cases the answer will be “No”. It is highly unlikely that anyone will have made a miraculous recovery and even if that were the case, it is even less plausible that the person would make an appointment to see his/her GP to let them know that they are feeling well!
    It follows that there will hardly, if ever, be medical evidence of improvement in the IOD injury, so the only purpose in SMPs trawling through records is to look at any other unrelated injuries or conditions. – None of their business!!

  • 2017-04-15 at 11:33 am

    I have recently been through this horrendous process of an ‘injury on duty appeal… all medical records were disclosed… giving the Police information that is not relevant, and also extremely, extremely personal. Information that has now been made public to all those involved with my case. (we all know having worked for the Police – things should be confidential but are very rarely kept confidential). Surely only relevant medical history should be included in your file. Even though I have been under my GP for over 18 years struggling with back pain – my case was dismissed as…. ‘normal wear and normal spinal degenerative process’. If this was the case then surely every person under 50 would also be on constant medication, having regular spinal injections, pain patches, acupuncture, physiotherapy…. the list goes on. They would also like myself be registered disabled, receiving industrial injury payments for life (due to injuries on duty where I hurt my back)… do I need to say anymore…. yet even though six separate incidents were registered with industrial injuries when I hurt my back (all on duty) these were all dismissed…. as normal spinal degeneration??……..I saw four separate FMAs that restricted my duties and hours due to back problems – but apparently this information is irrelevant when it comes to the appeal, as it is the view of the SMP that is taken. My GP/Specialist etc all reiterate that my back condition is unlikely to be resolved….. yet miraculously Drs on panel believe that with a change of medication, constant physiotherapy that ‘normal duties of a police officer could be full filled’. (even though I have been on restricted duties permanently for over 8 years)
    Therefore….. if you hurt your back on duty…….. and report it and record it correctly… and have all the history from your GP, physios etc….. please do not get disappointed when an ‘injury on duty award is not awarded’ and your case is dismissed. These individuals do not have to live with the constant battle of being in pain, how this impacts on absolutely every area of your life. How your concentration, sleep etc are affected and impacted.
    Also, if you have anything ‘painful’ from your past, that you have discussed with GP, or any Drs, psychiatrists etc – please remember the police have access to ‘everything’.

    For all going through this process…. or who have been through this process ‘GOOD LUCK’
    There is one positive point…… not being eligible for IOD means that I now have ‘freedom from the Police – constantly calling me back in to be reviewed and assessed.

    Who would think a career in the Police would end like this……………

Comments are closed.