Pursuant to Article 54, Paragraph 2 of the Law on Personal Data Protection, the Commissioner for Information of Public Importance and Personal Data Protection has instituted supervision proceedings over the implementation of the Law by the Ministry of Interior.
Proceedings have been instituted on occasion of the request of the health institution that has been requested by the police department of the town where the institution is located to submit personal data of citizens who are treated based on the diagnosis code "F". In the document of the police department under which the data are requested it is indicated that the data are necessary "in order to act in accordance with the Instructions on the Manner of Organization and Conduct of Internal Affairs in the Security Sector, and to adequately update the sector's dossier."
The Commissioner estimates the said processing of citizens' personal data as, to put it mildly, extremely problematic, both from the standpoint of purpose and scope, and especially from the standpoint of permissibility or lawfulness.
"F" diagnosis includes a large number, a few hundred of diseases or deviations of spirit and mind (e.g. Alzheimer's and Parkinson's disease, schizophrenia, depression, mania, phobias and hypochondriasis, reactions to stress, problems induced by alcohol and nicotine, eating disorders, bulimia and anorexia, nightmares and fears, sleepwalking, lack of sexual desire, transsexualism ...), i.e. the data the vast majority for which it is hard to assume the meaning, purpose, or the scope of processing by the police.
However, regardless of the purpose and meaning of processing, it is certain that the processing of personal data in general, in particular, of the particularly sensitive data, such as the health data, cannot be based on the secondary piece of legislation such as instructions. The valid grounds for personal data processing can only be found in a law and in this specific case the data processing is not based on a law and it is directly contrary to the provisions of several laws - the Law on Personal Data Protection, the Law on Patients' Rights, and the Law on Protection of Persons with Mental Disabilities.
In accordance with the aforementioned, the Commissioner requested the Ministry of Interior to submit to it the said Instructions on the Manner of Organization and Conduct of Internal Affairs in the Security Sector, as well as answers to the following questions, within 8 days:
- what are the grounds for said collection of citizens' personal data;
- what is the purpose for said collection of citizens' personal data;
- is the said collection of citizens' personal data carried out on the territory of other police departments, as well;
- do the dossiers of MoI's security sectors already contain the said citizens' personal data, since updating is required.
As usual, upon the completion of supervision, the Commissioner shall inform the public about the results of the supervision and measures to be taken.