Disclosure of ICU patient's personal data. Responses from the hospital, UODO and KRRiT

According to press reports on possible irregularities in the operations of the Provincial Specialized Hospital, the personal data of the people involved is likely to have been disclosed. In particular, the data of a patient in the intensive care unit was disclosed. 

Another thread of the case is the issue of revealing the personalities of the person who reported irregularities and repeatedly contacted the hospital. According to press reports, they were also revealed in terms of the person's filing of a notice to the prosecutor's office.

Accordingly, RPO Marcin Wiącek is asking UODO President Jan Nowak whether proceedings have been initiated to protect the personal data of the named individuals.

Also, the director of the Regional Specialized Hospital is asking for information on whether action has been taken regarding a possible data protection violation.

There is a response from the hospital management 

The hospital director wrote back, among other things, that at the time of his admission to our hospital, the patient was a public figure, widely known in the region due to his many years of active union, educational and local government activity (including serving as a member of the county board and also as a county councilman).

In connection with the press articles, the hospital conducted an investigation. As a result of it, it was concluded, taking into account the above, as well as taking into account the hospital's standards and procedures related to personal data protection, that there was no need to initiate proceedings related to a possible violation of personal data protection.

Response from the President of the DPA Jan Nowak 

In response, the DPA President stresses that it is the law enforcement agencies that have the authority to conduct investigations, in which they examine all the circumstances of the case, including the sources of obtaining the information.

In the case presented - given the numerous press articles - the provisions of the Press Law must be kept in mind. The Data Protection Authority cannot encroach on the domain of the Press Law. The investigation of possible violations of personal data protection and journalistic ethics belongs to the National Broadcasting Council, which is provided with legal instruments in this regard.

Being aware of the investigation initiated by the KRRiT, the authority sent an expert position on the matter to the KRRiT. It pointed out that journalists, in their activity of editing, preparing, creating or publishing press materials, are not exempt from the obligation to respect the right to privacy, including the right to the protection of personal data. 

This is because the provisions of the Press Law, which shape a number of conditions for the legal publication of certain personal information, among which is the obligation to obtain permission for publication (Article 14), are applicable in such a situation. According to Article 14(6) of the Press Law, it is inadmissible to publish without the consent of the person concerned information and data concerning the private sphere of his life, unless it is directly related to the public activities of the person concerned.

In summary, at present, law enforcement agencies have the power to establish all the circumstances related to determining the actual source of obtaining and further publicizing the data of the persons identified in Mr. Ombudsman's letter.

Response from Chairman of the National Broadcasting Council Maciej Swirski

The chairman of the National Broadcasting Council wrote to the RPO that the President of the Office for Personal Data Protection had presented his position in connection with the investigation of the case.

At the same time, Maciej Swirski stressed that the KRRiT's proceedings concern only the program activities of the broadcaster with respect to the provisions of the Broadcasting Act of December 29, 1992. It will - in accordance with the KRRiT's statutory powers - be resolved only with regard to possible violations by the broadcaster of the provisions of the aforementioned law.

He also informed that he has in his possession an expert opinion on the matter, drawn up at the request of the KRRiT, by Dr. n. prawny. Rafal Kubiak, a professor at the University of Lodz and a professor at the Medical University of Lodz, from which it follows, among other things, that certain entities, in particular medical personnel, are obliged to maintain medical secrecy. This obligation does not apply to third parties, including family members of the patient and representatives of the media.

It also follows from Prof. R. Kubiak's opinion that the exclusion of liability for violations of medical secrecy, under the principles set forth in medico-legal regulations, does not exclude the possibility of considering the unlawfulness of the conduct on other levels, particularly for violations of personal rights and illegal processing of personal data. However, it is not part of the KRRiT's statutory tasks to resolve both of these issues.

Source: RPO