By Nicole Pérez
With the recent pronouncement by the World Health Organization – WHO – where Covid-19 was classified as a pandemic, the collective hysteria has increased, and the fear of being infected has caused certain citizens to request information about those infected by the virus, in order to determine whether or not they have been contacts and, therefore, been infected with the disease, or also, if they are closed to the risk of being infected.
It is important to note that we are facing a case where a patient’s privacy may be affected. Personal data is all information that identifies or makes a person identifiable. Consequently, if information such as an exact address, name, surname, including email is published, the Health Authority would be violating the patient’s right to privacy.
Another necessary consideration is the classification of this type of data, in which case we are faced with a type of sensitive data, defined as follows by Law 81 of 2019 on Protection of Personal Data:
“That which refers to the intimate sphere of its owner, or whose misuse may give rise to discrimination or entail a serious risk to it. By way of example, data related to health (…) are considered sensitive data (…)”
In Panama, through Law 68 of 2003, which regulates the rights and obligations of patients, in terms of information and free and informed decision, Patient’s Right to Privacy was established, as follows:
“Everyone has the right to respect the confidentiality of data that refers to their health. Likewise, the patient has the right that no one can access their data relative to health without their authorization, except as provided by current legislation.”
It should be noted that failure to comply with the foregoing legal excess can bring legal consequences in both criminal and civil law.
Despite the fact, that Law 81 of 2019 has yet to be enforced, it is important to take into account this legislation, as well as the international regulations on data protection, in this case in particular, because of the possibility of having nationals or residents of the European Union in our country, diagnosed with Covid-19 or another disease.
As for the data protection regulations in Panama, the law establishes the power that health professionals have, at public and private levels, to collect and process the patient’s health data, consequently becoming responsible for the treatment. Nevertheless, they must keep professional secrecy and the dispositions ruled on special regulations, as is the case of Law 68 of 2003.
Likewise, the Law recognizes that sensitive data may only be disclosed or published in specific cases, we highlight two important assumptions in this case:
- When the owner has given his explicit authorization
- When there are statistical or scientific purposes.
In the second case, it is necessary that measures be taken to dissociate the owner of the data, this means that the owner of the data can be separate from the data in such way that would be impossible to recognize the identity of the owner, as the Ministry of Health of Panama has been doing so far.
Meanwhile, the General Data Protection Regulation of the European Union considers all information related to the health, past, present or future of the owner, including information obtained from tests or examinations of a body substance.
Likewise, as Panamanian legislation, European legislation, contemplates that health data cannot be transferred unless one of the assumptions established in article 9 is met, in which case it is important to point out the exception contemplated in subsection i):
“Treatment is necessary for reasons of public interest in the context of public health, such as protection against serious cross-border threats to health (…) on the basis of Union or Member State law establishing appropriate measures and specifically to protect the rights and freedoms of the interested party, particularly professional secrecy.”
This means that even if we are currently facing a public health situation at the international level, such as a pandemic, the right to privacy of patient’s sensitive data must be assured and respected. Therefore, even though we are victims of fear, we cannot forget that those who are under treatment for Covid-19 are human beings with rights, which must be assured at all times.
Inclusively, it is of vital importance to avoid violations of rights by all the States that have a patient diagnosed with Covid-19 who is a resident or citizen of the European Union, the compliance of the guidelines of the European standard on data protection, to avoid violation of Rights that may later end in a legal repercussion for the State.
It is important that both public and private levels practice the dissociation of health data. Transparency and access to information in times of pandemic is vital for the tranquility of the population, but for such transparency to exist, it is not necessary to ventilate the identity of the patient.