Data Protection Flashcards
When can a data protection issue be brought to the European Court of Human Rights?
It needs to be an issue that concerns the right to protection of private life, stated in the ECHR. But the Court can only rule when all national procedures have been exhausted. The rulings are addressed to Member States only, not to individuals. the court’s judgments are binding and can lead governments to alter their legislations
What is the case I vs. Finland and what does it say about positive obligations of member states?
I vs. Finland is a case brought to the European Court of Human Rights. A nurse worked on a fixed-term contract in an eye clinic at a public hospital. She also started having regular visits to the same hospital in which she worked, as she had been diagnosed as HIV-positive. She started suspecting that her colleagues were aware of her illness, and, at the time, the hospital staff had free access to any patient’s records.
After the nurse told this to her doctor, the hospital amended its register, so that only the treating clinic’s personnel would have access to the files. She was registered in the register under a false name.
After her contract ended, she complained to the County Administrative Board, requesting it to examine who had accessed her record. the director of the hospital stated that it was not possible to find out who, if anyone, had accessed the applicant’s patient record as the data system revealed only the five most recent consultations, and this information was deleted once the file was returned to the archives.
as it is not possible to retroactively clarify the use of the patient records, the County Administrative Board cannot further rule on whether information contained in the patient records had been used by or given to an outsider. The CAB finds, however that the system should record any consultation of the patient files as a safeguard of privacy.
Subsequently, in 1998, the hospitalºs register was amended and it became possible to identify any person who had accessed a patient record.
Then, the patient instituted civil proceedings against the District Health Authority, responsible for the hospital’s patient register, claiming non’pecuniary and pecuniary damage. The court dismissed it, as it did not find firm evidence that the applicant’s patient record had been unlawfully consulted. The court of appeal also concluded that it did not find evidence that the record had been unlawfully consulted.
ECtHR assessment:
“Although the object of Article 8 is essentially that of protecting the individual against arbitrary interference by the public authorities, it does not merely compel the State to abstain from such interference: in addition to this primarily negative undertaking, there may be positive obligations inherent in an effective respect for private or family life”
- The Court notes that the mere fact that the domestic legislation provided the applicant with an opportunity to claim compensation for damages caused by an alleged unlawful disclosure of personal data was not sufficient to protect her private life. What is required in this connection is practical and effective protection to exclude any possibility of unauthorised access occurring in the first place. Such protection was not given here.
- The Court cannot but conclude that at the relevant time the State failed in its positive obligation under Article 8 § 1 of the Convention to ensure respect for the applicant’s private life.
- There has therefore been a violation of Article 8 of the Convention.
What does the Leander v Sweden case say about the right to individual autonomy?
What is the convention 108?
Which court has jurisdiction to determine if Member States have fulfilled obligations under EU data protection law?
What is the relationship between ECHR and CJEU
Timeline of the binding instruments on DP (focus on Europe)
limitations in ECHR
Case Malone vs UK
Limitations EU Charter
Case Huber v. Germany
