IP - 07120-1/2020/358

IP - 07120-1/2020/358
Authority:	IP (Slovenia)
Jurisdiction:	Slovenia
Relevant Law:	Article 5(1)(b) GDPR Article 6(4) GDPR Article 9(2)(c) GDPR Article 9(2)(h) GDPR Article 9(2)(j) GDPR
Type:	Advisory Opinion
Outcome:	n/a
Started:
Decided:	18.05.2020
Published:
Fine:	None
Parties:	n/a
National Case Number/Name:	07120-1/2020/358
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Slovenian
Original Source:	Informacijski Pooblaščenec (in SL)
Initial Contributor:	n/a

In a non-binding opinion, the Slovenian DPA (IP), stated that its National Institute of Public Health (NIJZ) could use data from its infectious database to invite COVID-19 survivors to participate in another body's treatment and research trials which involved the collection of their data.

English Summary

Facts

The NIJZ, using its Infectious Diseases Register, contacted 48 individuals who had survived COIVD-19. The NIJZ contacted these individuals to invite them to visit the Institute of Transfusion Medicine (ZTM), who were investigating the treatment of critically ill COVID-19 patients and needed the blood of individuals who had survived the disease in order to conduct its research.

Dispute

Under GDPR rules, can the NIJZ use the data in its Infectious Diseases Register to invite data subjects to participate in another body’s treatments and give that body their health data?

Holding

The IP said that the NIJZ was allowed to use the data it had to invite patients to participate in the ZTM's research and data collection.

To illustrate how the GDPR could be applied to allow the NIJZ data to be used in this way, the IP cited examples from Article 9(2) GDPR, which lists the exceptions to the prohibition of processing special categories of data. The examples used were the following: • Article 9(2)(c), where the patient is physically incapable of giving consent because they are seriously ill, and processing is necessary prevent further deterioration of health; • Article 9(2)(h), where research involving persons who have survived COVID-19 patients is necessary for providing healthcare; • Article 9(2)(j), which permits processing for scientific research purposes related to treatments.

For the secondary processing of the patients’ contact details, the IP suggested that under Article 6(4) GDPR, the NIJZ would be permitted to do so because of the link between the purpose of the initial collecting of the data (the keeping of infectious disease records) and the purposes of the intended further processing (the monitoring of infectious diseases and their characteristics).

The IP also noted that further processing for scientific research purposes is permitted under Article 5(1)(b) GDPR, and recalled that Recital 159 GDPR provides that “the processing of personal data for scientific research purposes should be interpreted in a broad manner”.

Comment

The IP has issued similar opinions on: • the use of data to obtain consent (0712-18 / 2012/2) • sending consent invitations for another entity (0712-571 / 2010/2)

However, it distinguished its opinion here with its opinion in 0712-1 / 2018/1780, where the IP stated that invitations for revaccination would not be permitted under the GDPR.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Slovenian original. Please refer to the Slovenian original for more details.

Date: 18.05.2020
Title: Use of data from the legal database for the purpose of inviting patients to participate in treatment or research
Number: 07120-1 / 2020/358
Subject matter: Legal basis, Statistics and research, Medical personal data
Legal act: Opinion

On 13 May 2020, we received your question from the Information Commissioner (IP) on whether the NIJZ, on the basis of data from the REGISTER OF INFECTIOUS DISEASES no. According to the Health Care Databases Act (ZZPPZ), NIJZ 48 contacts persons who have survived COVID-19 with the intention of going to the selected personal physician and later to the Institute of Transfusion Medicine (ZTM) for blood collection for testing and treatment of critically ill patients with COVID-19. ZTM is investigating the treatment of severely ill patients with COVID-19 on the basis of plasma obtained from the blood of patients who have survived the disease, but has no data on these patients.

On the basis of the information you have provided to us, in accordance with Article 58 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data Directive 95/46 / EC (hereinafter: the General Regulation on Data Protection), point 7 of the first paragraph of Article 49 of the Personal Data Protection Act (Official Gazette of the Republic of Slovenia, No. 94/07-UPB1, hereinafter ZVOP-1) and Article 2 of the Information Commissioner Act (Official Gazette of the Republic of Slovenia, No. 113/05, hereinafter ZInfP) provides our non-binding opinion on your issue.
 
 
According to the IP, it is permissible for the NIJZ, on the basis of data in its own databases (eg Records of Infectious Diseases), to send to persons who have survived COVID-19 an invitation from the Institute of Transfusion Medicine to participate in research and treatment of seriously ill persons with COVID-19. 19.

Explanations:
 
In this case, it is a combination of internal processing of health data (in search of the target group) and contact data (in the invitation itself) of patients, which would be carried out for research purposes and the purpose of treating other persons and in such a way that ZTM knew which patients were involved, and patients would have complete freedom to be included in the research or treatment and the related processing of personal data.
 
In the part of the processing relating to health data, the legal basis in a specific case may be (one or more):
(c) point (2) of Article 9 of the General Data Protection Regulation, as it is indirectly about protecting the vital interests of seriously ill patients (ie preventing serious deterioration of health), and sick patients cannot physically give consent at this stage they have not yet been established;
(h) point 2 of the second paragraph of Article 9 of the General Data Protection Regulation, because the search for surviving patients is indirectly (or in this, the first phase) necessary to provide medical care or treatment that would take place in accordance with national health regulations;
(j) point (2) of the second paragraph of Article 9 of the General Data Protection Regulation, as processing is also necessary for scientific research purposes related to treatment.
In the part of the processing relating to contact details, the legal basis in this case may be that it is a purpose compatible (see the fourth paragraph of Article 6 of the General Data Protection Regulation) with the basic purpose of keeping infectious disease records. the purpose is to monitor the occurrence of infectious diseases, their characteristics and the evaluation of measures). This applies both for research purposes and for the purpose of treating other persons. With regard to research, the General Data Protection Regulation itself provides in point (b) of the first paragraph of Article 5 that “further processing for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes in accordance with Article 89 (1) shall not apply. incompatible with the original purposes ”. The first paragraph of Article 17 of ZVOP-1 stipulates similarly, namely that, regardless of the original purpose of collection, personal data may be further processed for historical, statistical and scientific-research purposes. According to the 159th introductory recital of the General Data Protection Regulation, the processing of personal data for scientific research purposes should be interpreted broadly for the purposes of this Regulation (eg professional testing of a new treatment method may also be considered as research). In addition, obtaining consent or establishing contact for obtaining consent is already considered to be the first or at least the previous phase of the research process. And if this treatment can be performed by the controller in his own interest, there are no obstacles to him doing the same in the interest of another research organization, provided that the data on the invited patients are not disclosed to it.
 
Although this is not exactly the same factual situation, we also refer to the already issued opinion IP no. 0712-18 / 2012/2 (use of data to obtain consents) and 0712-571 / 2010/2 (execution of sending consent invitations for another entity). At the same time, we clarify that this is not the same situation as in the negative opinion of IP no. 0712-1 / 2018/1780, which referred to invitations for revaccination.
 
Best regards,
 
Prepared:
mag. Urban Brulc, Univ. dipl. right.
independent IP consultant
 
Mojca Prelesnik, B.Sc. dipl. right.
Information Commissioner