Health data: can the police request it without consent?

Police requests for health data highlighted a problem raised by NAMM attorney-at-law Sander Potisepp. The question was not only whether the police may request health data in criminal proceedings. The main question was whether this is done with the person’s consent, under court supervision or on another clearly understandable legal basis.

Postimees wrote that the police had left the public with the impression that people’s health data was requested only with their permission. Sander noticed a contradiction in this and pointed out that the practice may be broader. After his intervention, the police had to admit that health data had also been requested without the person’s consent.

Health data is not ordinary procedural information. It can reveal a person’s illnesses, treatment, addictions, mental health condition and other highly personal matters. Its use must therefore be exceptional, justified and capable of later review.

The question raised by Sander is important for everyone, not only for people who are suspects or witnesses in a criminal case. If a state authority can request sensitive data simply by making a query, people must have certainty that this power is not used too broadly.

A practical problem is also that a person may not know who viewed their health data and why. This issue shows why data protection is not only a technical matter. It is a matter of fundamental rights. When the state uses a person’s health data, control must be stronger than in the case of an ordinary document or registry entry.

Read more from Postimees.