Results:
On 17th July 2008, at the European Court of Human Rights, in the case of I v Finland the court found for “I” and against Finland. The ECHR, based in Strasbourg, awarded “I” over €13,000 in damages and €20,000 in costs.
The full court decision, I v Finland (case number 20511/03) is available here.
Over View of the case
The applicant “I”, now 48 years old, stated that her private medical records were accessed by the other people, who did not need to and as a result of which she possibly lost her job as a nurse.
The access, which occurred around 1992 was not recorded, as there was no records to record access to medical records in Finland in the early 1990s.
The ECHR decided that as the hospital was controlled by the State (Finland), the Finnish government was therefore responsible for the actions at the hospital and access to the medical records.
A key finding of the case was that the court stated that personal information relating to a patient undoubtedly belongs to his or her private life. Therefore Article 8, freedom to a private life, is applicable in this case. Based on this the European Court of Human Rights found that a person’s right to respect for their private life (under the ECHR,) may be breached where the State fails to take appropriate steps to secure data, so that it cannot be accessed improperly.
Article 8 not only means that the government must not interfere unduly into a person’s private life, but the government must also undertake positive actions to prevent such interference, e.g to produce or enforce systems and protocols to protect data.
This case is particularly interesting as there no statement that there was deliberate and unauthorized access of data, only that there was failure to secure the data appropriately. i.e a breach of Finland’s positive obligations under Article 8 of the Human Rights Act
Summary: The ECHR found that if personal data is not secured adequately, and the State does not take positive steps to do so (and not just legislation but technical and procedural steps as well), then the state is in breach of Article 8.
