Individual Application

The Facts

The applicant was treated by a psychiatrist, Dr. H.C, in 2010. In 2016, H.C. provided the applicant’s mother with a report containing information about the applicant’s treatment process. Thereupon, the applicant filed a criminal complaint with the chief public prosecutor’s office, stating that there had been a conflict of interest between him and his mother, that H.C. had breached patient confidentiality by disclosing his medical records to his mother, and that his family had used the relevant documents to initiate two sets of guardianship proceedings against him. He further maintained that he had been deprived of his constitutional rights for nearly two years, and thus suffered pecuniary and non-pecuniary damages.

In his defence, H.C. submitted that the applicant had consulted him three times and suffered from several psychological disorders. He further claimed that in 2016, the applicant’s mother visited the clinic stating that her son had gone missing and that they were concerned for his life, and that she requested medical documents in order to obtain a protective order from the court once he was found. H.C. maintained that, he had delivered the requested document, without violating patient confidentiality, with the sole purpose of preventing the applicant from harming himself or his family.

Subsequently, the chief public prosecutor’s office indicted H.C. for unlawfully obtaining or disseminating personal data. The incumbent criminal court acquitted H.C. of the charges. The applicant’s subsequent appeal was dismissed on the merits by the regional court of appeal, with no right of further appeal.

The Applicant’s Allegations

The applicant claimed that his right to protection of personal data, within the scope of the right to respect for private life, had been violated, arguing that the criminal proceedings into the unlawful disclosure of his health data had not been conducted effectively.

The Court’s Assessment

In the present case, the trial court considered that the disclosure of the applicant’s health data without his knowledge or consent was intended to protect him and that criminal intent on the part of the accused could not be established.

In spite of the fact that family members may be informed, the scope of such disclosure may vary depending on the circumstances of the case, particularly in certain exceptional situations involving risk. However, in the present case, the said disclosure went beyond informing, given that a report containing sensitive data relating to the treatment process of the applicant, an adult, was handed over to his mother who was a third party regardless of her parental status, without the applicant’s consent. Moreover, the applicant claimed that there was a conflict of interest and hostility between him and his mother. In addition, although the applicant underwent treatment in 2010, the said document was delivered to his mother in 2016.

Given these facts, the trial court reached a conclusion without considering issues, such as; whether it was necessary to go beyond providing information and to give a document; whether there was any compelling reason to provide the report, rather than simply providing information; whether there was a conflict of interest between the applicant and his mother to whom the report containing sensitive health data was delivered; whether there was an urgent situation requiring the release of the said document, despite the elapse of six years since the treatment; and despite the existence of an urgent and exceptional situation requiring the release of the document, whether there was an alternative way, instead of delivering the document to a third party, even if it was the applicant’s mother.

In the present case, the first instance court failed to provide relevant and sufficient reasoning, in compliance with the requirements of Article 20 of the Constitution, with respect to the right to protection of personal data. This deficiency could not be remedied even in the course of the appeal proceedings. The Court has therefore concluded that, in the particular circumstances of the case, the State failed to fulfil its positive obligations regarding the protection of personal data.

Consequently, the Court has found a violation of the right to protection of personal data within the scope of the right to respect for private life.