“I” v Finland – Data Protection and Privacy | Where is My Data?


On 17th July 2008, at the European Court of Human Rights, in the case of I v Finland the court found for “I” and against Finland. The ECHR, based in Strasbourg,   awarded  “I” over €13,000 in damages and €20,000 in costs.

The full court decision,  I v Finland (case number 20511/03)  is available here.

Over View of the case

The applicant “I”, now 48 years old, stated that her private medical records were accessed by the other people, who did not need to and as a result of which she possibly lost her job as a nurse.

The access, which occurred around 1992  was not recorded, as there was no records to record access to medical records in Finland in the early 1990s.

The ECHR decided that as the hospital was controlled by the State (Finland), the  Finnish government was therefore responsible for the actions at the hospital and access to the medical records.

A key finding of the case was that the  court stated that personal information relating to a patient undoubtedly belongs to his or her private life. Therefore  Article 8, freedom to a private life, is applicable in this case. Based on this the European Court of Human Rights found that a person’s right to respect for their private life (under the ECHR,) may be breached where the State fails to take appropriate steps to secure data, so that it cannot be accessed improperly.

Article 8  not only means that the government must not interfere unduly into a person’s private life, but the government must also undertake positive actions to prevent such interference, e.g to produce or enforce  systems and protocols to protect data.

This case is particularly interesting as there no statement that there was deliberate and unauthorized access of data, only that there was failure to secure the data appropriately. i.e a breach of Finland’s positive obligations under Article 8 of the Human Rights Act

Summary: The ECHR found that if personal data is not secured adequately, and the State does not take positive steps to do so (and not just legislation but technical and procedural steps as well), then the state is in breach of Article 8.

Full case background


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: