I v Finland

I was a nurse who worked at a Finnish public hospital and regularly attended the same hospital’s infectious diseases clinic, having previously been diagnosed with HIV. I began to suspect that news of her disease had spread to fellow employees in the ophthalmic department and asked to be informed of those who had accessed her medical records and when. The health authorities kept a note of only the last five instances of patient records being accessed. Moreover the hospital’s access controls did not prevent her colleagues in the eye clinic accessing her record. I sued the District Health Authority for failing to keep her medical records confidential. At first instance the domestic court found that there was insufficient evidence that her medical records had been accessed unlawfully. An appeal and permission to appeal to the Finnish Supreme Court were rejected.

Whether the measures taken by the domestic authorities to safeguard I’s right to respect for her private life had been sufficient.

I did not have to show a wilful publishing of data. A failure to keep it secure was enough to breach her Article 8 right. “It is plain that had the hospital provided a greater control over access to health records … the applicant would have been placed in a less disadvantaged position before the domestic courts,” the Court ruled.
It went on to find that the Finnish courts’ requirement to prove that her record had been misused was “to overlook the acknowledged deficiencies in the hospital’s record keeping at the material time.”
The Court awarded I €13,771 in damages and €20,000 in costs.

In this judgment the Court noted that the existence of the right to sue for the unlawful disclosure of information is not sufficient protection of the privacy right, ruling: “What is required in this connection is practical and effective protection to exclude any possibility of unauthorised access occurring in the first place. Such protection was not given here.”