Category: Czech Republic

IuRe is planning litigation to challenge the processing and use of sensitive personal medical data by the Czech Institute of Health Information and Statistics through the National Health Information System. The processing practices take place pursuant to the Health Services Act.

Before taking litigation, IuRe is carried out pre-litigation research to get a better understanding of how data is being processed and used by the system. They believe that the system is violating data protection and privacy rights, and that data is being used beyond the purposes for which it has been collected, because only anonymised or aggregated data is necessary for the system to achieve its objectives.

Alongside desk research, the pre-litigation stage involved members or volunteers of IuRe requesting information on the processing of their personal data in accordance with the GDPR (i.e. subject access requests). As well as helping to map out the functioning of the system, in individual cases where serious violations of fundamental rights or misuse of data are found, these individuals may go on to be claimants in the litigation to follow.

IuRe mapped in detail the functioning of the National Health Information System and its individual parts. Through this analysis they were able to identify more specific problems and open the way to more effective argumentation for the upcoming litigation. A second analysis outlined seven possible litigation paths. As of 2024, IuRe are preparing to start litigation that will focus on the illegal collection of patient contact information, which started to take place without a legal basis during the COVID-19 pandemic.