With the recent pronouncement by the World Health Organization
– WHO – where Covid-19 was classified as a pandemic,
the collective hysteria has increased, and the fear of being
infected has caused certain citizens to request information about
those infected by the virus, in order to determine whether or not
they have been contacts and, therefore, been infected with the
disease, or also, if they are closed to the risk of being
infected.
It is important to note that we are facing a case where a
patient’s privacy may be affected. Personal data is all
information that identifies or makes a person identifiable.
Consequently, if information such as an exact address, name,
surname, including email is published, the Health Authority would
be violating the patient’s right to privacy.
Another necessary consideration is the classification of this
type of data, in which case we are faced with a type of sensitive
data, defined as follows by Law 81 of 2019 on Protection of
Personal Data:
“That which refers to the intimate sphere of its owner, or
whose misuse may give rise to discrimination or entail a serious
risk to it. By way of example, data related to health (...) are
considered sensitive data (...)"
In Panama, through Law 68 of 2003, which regulates the rights
and obligations of patients, in terms of information and free and
informed decision, Patient’s Right to Privacy was
established, as follows:
"Everyone has the right to respect the confidentiality of
data that refers to their health. Likewise, the patient has the
right that no one can access their data relative to health without
their authorization, except as provided by current
legislation."
It should be noted that failure to comply with the foregoing
legal excess can bring legal consequences in both criminal and
civil law.
Despite the fact, that Law 81 of 2019 has yet to be enforced, it
is important to take into account this legislation, as well as the
international regulations on data protection, in this case in
particular, because of the possibility of having nationals or
residents of the European Union in our country, diagnosed with
Covid-19 or another disease.
As for the data protection regulations in Panama, the law
establishes the power that health professionals have, at public and
private levels, to collect and process the patient’s health
data, consequently becoming responsible for the treatment.
Nevertheless, they must keep professional secrecy and the
dispositions ruled on special regulations, as is the case of Law 68
of 2003.
Likewise, the Law recognizes that sensitive data may only be
disclosed or published in specific cases, we highlight two
important assumptions in this case:
- When the owner has given his explicit authorization
- When there are statistical or scientific purposes.
In the second case, it is necessary that measures be taken to
dissociate the owner of the data, this means that the owner of the
data can be separate from the data in such way that would be
impossible to recognize the identity of the owner, as the Ministry
of Health of Panama has been doing so far.
Meanwhile, the General Data Protection Regulation of the
European Union considers all information related to the health,
past, present or future of the owner, including information
obtained from tests or examinations of a body substance.
Likewise, as Panamanian legislation, European legislation,
contemplates that health data cannot be transferred unless one of
the assumptions established in article 9 is met, in which case it
is important to point out the exception contemplated in subsection
i):
“Treatment is necessary for reasons of public interest in
the context of public health, such as protection against serious
cross-border threats to health (...) on the basis of Union or
Member State law establishing appropriate measures and specifically
to protect the rights and freedoms of the interested party,
particularly professional secrecy.”
This means that even if we are currently facing a public health
situation at the international level, such as a pandemic, the right
to privacy of patient's sensitive data must be assured and
respected. Therefore, even though we are victims of fear, we cannot
forget that those who are under treatment for Covid-19 are human
beings with rights, which must be assured at all times.
Inclusively, it is of vital importance to avoid violations of
rights by all the States that have a patient diagnosed with
Covid-19 who is a resident or citizen of the European Union, the
compliance of the guidelines of the European standard on data
protection, to avoid violation of Rights that may later end in a
legal repercussion for the State.
It is important that both public and private levels practice the
dissociation of health data. Transparency and access to information
in times of pandemic is vital for the tranquility of the
population, but for such transparency to exist, it is not necessary
to ventilate the identity of the patient.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
