The Finnish government violated Article 8 of the European Convention on Human Rights (pdf) for “domestic authorities’ failure to protect, at the relevant time, the applicant’s patient records against unauthorised access,” according to a ruling from the European Court of Human Rights.
In I v. Finland, No. 20511/03, the Finnish citizen had worked for several years as a contract nurse at an eye diseases clinic at a hospital. During that time, she learned she was HIV-positive and began seeking treatment at another clinic within the same hospital. She suspected her colleagues had learned of her treatment and sought data on who had accessed her medical records and when.
“At that time hospital staff had free access to the patient register which contained information on patients’ diagnoses and treating doctors,” the Court said. However, the system did not retain enough data on who accessed patients’ records so that the hospital could not compile a complete list of individuals who accessed her record and when.
The nurse argued that “[t]he data system should have indicated who had accessed her patient record so as to make it possible to find out whether access had been lawful. The domestic courts rejected her claim for compensation for the reason that she could not identify a person who had obtained information about her illness from her patient record. She was, however, unable to prove her claims only because the data control system in the hospital was inadequate at the relevant time,” according to the Court. After reviewing the nurse’s allegations and the hospital’s security systems and procedures, the Court unanimously ruled, “Personal information relating to a patient undoubtedly belongs to his or her private life. Article 8 is therefore applicable in the instant case.”
In the European Convention on Human Rights:
Article 8 — Right to respect for private and family life
1. Everyone has the right to respect for his private and family life, his home and his correspondence.
2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.
The Court continued:
Although the object of Article 8 is essentially that of protecting the individual against arbitrary interference by the public authorities, it does not merely compel the State to abstain from such interference: in addition to this primarily negative undertaking, there may be positive obligations inherent in an effective respect for private or family life […] These obligations may involve the adoption of measures designed to secure respect for private life even in the sphere of the relations of individuals between themselves.
The Court found the nurse’s Article 8 rights had been violated. She was awarded EUR 5,771.80 in pecuniary damages, EUR 8,000 in respect of non-pecuniary damages, and EUR 20,000 for costs and expenses.