Disclosure of ICU patient's personal data. We know the position of the hospital and the President of the Office for Personal Data Protection

The RPO's action is related to a high-profile case from early April. At the time, an article was published on the website of a national radio station, describing the case of a patient who died while waiting eight days for transfer to the ICU in Legnica. The family of the deceased filed a notice with the prosecutor's office, from which it appeared that a place in the intensive care unit had been blocked for several months by the husband of a well-known MP. The prosecutor's office refused to open proceedings.

According to press reports regarding possible irregularities in the operations of the Provincial Specialized Hospital, it appears that personal data of the people involved has probably been disclosed. In particular, the data of a patient in the intensive care unit was disclosed.

Another thread of the case is the issue of revealing the personalities of the person who reported irregularities and repeatedly contacted the hospital. According to press reports, they were also revealed in terms of the person's filing of a notice to the prosecutor's office.

Accordingly, RPO Marcin Wiącek is asking UODO President Jan Nowak whether proceedings have been initiated regarding the protection of the personal data of the named individuals. Also, the director of the Provincial Specialized Hospital is asking for information on whether actions have been taken regarding possible violations of personal data protection.

The hospital director wrote back, among other things, that at the time of admission the patient was a public figure, widely known in the region due to his many years of active union, educational and local government activities. In connection with the press articles, the hospital conducted an investigation. It concluded that there was no need to initiate proceedings related to possible data protection violations.

In contrast, the President of the DPA in his response emphasizes that it is the law enforcement authorities who are authorized to conduct investigations, in which they investigate all the circumstances of the case, including the sources of obtaining information. In the case presented, given the numerous press articles, the provisions of the Press Law should be kept in mind. The DPA cannot encroach into the domain of the Press Law. The investigation of possible violations of personal data protection and journalistic ethics belongs to the National Broadcasting Council, which is provided with legal instruments in this regard.

Being aware of the investigation initiated by the KRRiT, the authority sent an expert position on the matter to the KRRiT. It pointed out that journalists, in their activity of editing, preparing, creating or publishing press materials, are not exempt from the obligation to respect the right to privacy, including the right to the protection of personal data.

This is because the provisions of the Press Law, which shape a number of conditions for the legal publication of certain personal information, among which is the obligation to obtain permission for publication (Article 14), are applicable in such a situation. According to Article 14(6) of the Press Law, it is inadmissible to publish without the consent of the person concerned information and data concerning the private sphere of his life, unless it is directly related to the public activities of the person concerned.

In summary, at present, law enforcement agencies have the power to establish all the circumstances related to determining the actual source of obtaining and further publicizing the data of the persons identified in Mr. Ombudsman's letter.

Elaborated. based on: BRPO