Processing of sensitive personal medical data in Czech Republic
By Thomas Vink, 4th July 2022
In October 2024, IuRe filed a lawsuit with the Municipal Court in Prague to challenge the processing and use of sensitive personal medical data by the Czech Institute of Health Information and Statistics through the National Health Information System. The processing practices take place pursuant to the Health Services Act, and focuses on the illegal collection of patient contact information, which started to take place without a legal basis during the COVID-19 pandemic.
Before taking litigation, IuRe carried out pre-litigation research to get a better understanding of how data is being processed and used by the system. They believe that the system is violating data protection and privacy rights, and that data is being used beyond the purposes for which it has been collected, because only anonymised or aggregated data is necessary for the system to achieve its objectives.
Processing of sensitive personal medical data in Czech Republic
Organisation Name
Iuridicum Remedium (IuRe)
Country/Jurisdiction
Czech Republic
Amount Granted
EUR 15,108
Current Status
Research complete
Grant type
Pre-litigation Research Support
Description
In October 2024, IuRe filed a lawsuit with the Municipal Court in Prague to challenge the processing and use of sensitive personal medical data by the Czech Institute of Health Information and Statistics through the National Health Information System. The processing practices take place pursuant to the Health Services Act, and focuses on the illegal collection of patient contact information, which started to take place without a legal basis during the COVID-19 pandemic.
Before taking litigation, IuRe carried out pre-litigation research to get a better understanding of how data is being processed and used by the system. They believe that the system is violating data protection and privacy rights, and that data is being used beyond the purposes for which it has been collected, because only anonymised or aggregated data is necessary for the system to achieve its objectives.
Alongside desk research, the pre-litigation stage involved members or volunteers of IuRe requesting information on the processing of their personal data in accordance with the GDPR (i.e. subject access requests). As well as helping to map out the functioning of the system, in individual cases where serious violations of fundamental rights or misuse of data are found, these individuals may go on to be claimants in the litigation to follow.
IuRe mapped in detail the functioning of the National Health Information System and its individual parts. Through this analysis they were able to identify more specific problems and open the way to more effective argumentation for the upcoming litigation. A second analysis outlined seven possible litigation paths.
"the system is violating data protection and privacy rights, and...data is being used beyond the purposes for which it has been collected"
Strategic Goal
To achieve systemic change in the functioning of the National Health Information System and improve the general culture of sensitive medical data processing in state administration.
Organisation Name
Women’s Link Worldwide
Image credit: National Cancer Institute on Unsplash