Processing of sensitive personal medical data in Czech Republic

In October 2024, IuRe filed a lawsuit with the Municipal Court in Prague to challenge the processing and use of sensitive personal medical data by the Czech Institute of Health Information and Statistics through the National Health Information System. The processing practices take place pursuant to the Health Services Act, and focuses on the illegal collection of patient contact information, which started to take place without a legal basis during the COVID-19 pandemic.

Before taking litigation, IuRe carried out pre-litigation research to get a better understanding of how data is being processed and used by the system. They believe that the system is violating data protection and privacy rights, and that data is being used beyond the purposes for which it has been collected, because only anonymised or aggregated data is necessary for the system to achieve its objectives.

Alongside desk research, the pre-litigation stage involved members or volunteers of IuRe requesting information on the processing of their personal data in accordance with the GDPR (i.e. subject access requests). As well as helping to map out the functioning of the system, in individual cases where serious violations of fundamental rights or misuse of data are found, these individuals may go on to be claimants in the litigation to follow.

IuRe mapped in detail the functioning of the National Health Information System and its individual parts. Through this analysis they were able to identify more specific problems and open the way to more effective argumentation for the upcoming litigation. A second analysis outlined seven possible litigation paths.