FIFTH SECTION
CASE OF J.M. AND A.T. v. NORTH MACEDONIA
(Application no. 79783/13)
JUDGMENT
STRASBOURG
22 October 2020
This judgment is final but it may be subject to editorial revision.
In the case of J.M. and A.T. v. North Macedonia,
The European Court of Human Rights (Fifth Section), sitting as a Committee composed of:
Pere Pastor Vilanova, President,
Jovan Ilievski,
Raffaele Sabato, judges,
and Renata Degener, Deputy Section Registrar,
Having regard to:
the application against the Republic of North Macedonia lodged with the Court under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”) by two Macedonians/citizens of the Republic of North Macedonia, J.M. and A.T. (“the applicants”), on 13 December 2013;
the decision to give notice to the Government of North Macedonia (“the Government”) of the complaint under Article 8 of the Convention and declare the remainder of the application inadmissible;
the decision of the President of the Section of 14 January 2014 not to have the applicants’ names disclosed;
the parties’ observations;
Having deliberated in private on 29 September 2020,
Delivers the following judgment, which was adopted on that date:
INTRODUCTION
1. The case concerns the alleged unlawful disclosure of the applicants’ medical data by a public hospital to the police in violation of their right to private life under Article 8 of the Convention.
THE FACTS
2. The applicants, J.M. and A.T., were born in 1979 and 1974, respectively and live in S. They were represented by Ms N. Boshkova, a lawyer practising in Skopje.
3. The Government were represented by their Agent, Ms D. Djonova.
4. The facts of the case, as submitted by the parties, may be summarised as follows.background to the case
5. On 22 December 2009 the public health centre in S., which includes a centre for drug addiction (“the hospital”), reported to the police that an unspecified quantity of methadone, which was used to treat patients experiencing drug-withdrawal symptoms, was missing.
6. On 1 April 2010 two police inspectors visited the hospital and seized the original copies of the lists for patients’ daily methadone dispensing for 15 and 16 February 2010 (“the lists”). The lists contained the names and surnames of all the patients that had received methadone on those days, including the applicants, and the quantity of methadone received. The applicants, who were present at the hospital on that day, witnessed the police intervention. A.T. claimed that he had entered the room where the police officers had been inspecting documents and had seen them looking at hospital records concerning methadone (метадонски книги). He further claimed that he had seen the police removing documents from the hospital to make copies. The police had issued a certificate for the seizure of the two lists.
7. Following a request by the applicants, on 8 June 2010 the Data Protection Authority (Дирекција за заштита на лични податоци‑hereinafter “the DPA”) conducted an onsite inspection of the hospital. In its report the DPA found that on 1 April 2010 the police had seized the two original lists, which had contained the applicants’ names, surnames and the methadone they had received in treatment. The police had also been allowed to examine a “methadone-reporting book” (тетратка за рапорт) and individual patient files in order to verify the quantities of methadone that they had been prescribed. The DPA concluded that the police had acted lawfully, specifically in accordance with section 144 of the Criminal Procedure Act. The report was not served on the applicants, who were notified by letter that the inspection had not found any problems with regard to the treatment of their data by the hospital.
8. On 15 July 2010, following a request by the police, the hospital sent them copies of the same lists for daily dispensing of methadone again, this time with the names and surnames of the patients redacted.
9. The police continued their investigation and on 17 August 2010 submitted a report to the first-instance prosecutor’s office in S., stating that there had been no elements of a crime with regard to the missing methadone. Having taken а statement from а doctor at the hospital they concluded that certain discrepancies in the hospital’s records were the result of a clerical error. There is no evidence that the prosecution took further actions with regard to the above events.
10. On 2 September 2010 the police returned the seized lists to the hospital.PROCEEDINGS INITIATED BY THE APPLICANTSAdministrative proceedings
11. On 13 August 2010 the applicants, together with four other patients of the hospital, submitted a request for the protection of personal data with the DPA against the hospital and the police. They stated that on 1 April 2010 the hospital had disclosed sensitive medical data to the police without a court order.
12. In its reply the hospital argued, inter alia, that it could only give information to the police on the basis of an order issued by a judge or public prosecutor.
13. On 1 October 2010 the DPA dismissed their requests. It found that in addition to seizing the two lists the police had also had access to patient files, which had been necessary to establish the quantities of methadone administered to each patient. The DPA held that the data delivered to the police on 1 April 2010 had been anonymised, and therefore, relying on sections 14 and 68 of the Police Act and section 144 of the Criminal Procedure Act, it held that the hospital and the police had processed the applicants’ personal data in accordance with the law.
14. The applicants appealed, arguing, inter alia, that the DPA had confused the two events of 1 April and 15 July 2010 during which the police had been given access to the applicants’ data (see paragraphs 6 and 8 above). On 3 May and 10 December 2012, the Administrative Court (Управен суд) and the Higher Administrative Court (Виш управен суд), respectively, dismissed appeals by the applicants complaining about the actions of the police and the hospital on 1 April 2010, and upheld the DPA’s findings in full.Civil proceedings
15. Meanwhile, on 10 September 2010 the applicants, together with four other patients at the hospital (see paragraph 11 above) lodged a civil claim through a lawyer against the Ministry of Internal Affairs and the hospital for violation of their right to privacy. They argued that the hospital had unlawfully given access to their medical data to the police on 1 April 2010. They further stated that after that day they had had several encounters with police officers who had teased them using private information about their health and methadone treatment, which they could have learned only from their medical data kept by the hospital. They sought non-pecuniary damage in the amount of 90,000 Macedonian denars each.
16. On 24 January 2013 Court of First Instance in S. dismissed their claim. The court held that on 1 April 2010 the police had inspected the lists concerning 15 and 16 February 2010 and the patient files, but their names on all the documents had been redacted. The court further held that under domestic law a hospital ought to have had a court order in order to disclose patients’ medical data. However, the fact that the applicants’ names had been redacted had rendered that requirement moot in the instant case. Relying on section 5 of the Police Act (see paragraph 17 below), the court held that the police had also acted lawfully when they had processed private and medical data. This judgment was confirmed on appeal by the Court of Appeal with a judgment of 19 April 2013 served on the applicants’ representative on 17 June 2013. Neither court referred to the police inspection carried out on 1 April 2010 (paragraph 6 above) notwithstanding the applicants’ explicitly complaining about it before both courts.
RELEVANT LEGAL FRAMEWORKPOLICE ACT
17. Section 5 § 1 (3) of the Act defines the term “activities of the police” (полициски работи) as activities whose purpose is to prevent crimes and misdemeanours and lead to discovery and capture of perpetrators.
18. Section 14 of the Police Act provides that a police officer can take of his or her own motion or by order of the public prosecutor, court or other body measures for the detection of a crime and prosecution of a person who is suspected of planning or committing a crime.
19. Under section 68 the police are authorised to collect personal and other information from the individuals to whom the information refers, third parties or from already existing databases operated by State institutions and other legal entities.CRIMINAL PROCEDURE ACT
20. Section 144(2)(6) of the Act (consolidated version, Official Gazette no. 15/2005), which was part of the Chapter concerning pre-investigation (предистражна постапка) allowed the police, if there existed a reasonable suspicion that a crime subject to automatic prosecution has been committed, and in the presence of an official, to conduct a search of certain premises, and to consult and inspect certain documentation (определена документација) belonging to State institutions.PROTECTION OF PATIENS’ RIGHTS ACT
21. Section 4 of this Act defines a “patient” as any person, healthy or ill, who requests a medical procedure or on whom one is performed in order to preserve and promote his or her health, to prevent an illness, or who receives treatment, healthcare or rehabilitation treatment. “Medical data” are any data relating to patients’ medical histories, diagnoses, prognoses and treatment, as well as other data closely connected with patients’ health.
22. Section 25 of the Act regulates the confidentiality of medical data. It stipulates that medical data must be processed in accordance with the regulations on protection for personal data. Medical data, exceptionally, can be disclosed to third parties if the patient gives express permission, if the processing of such data is necessary for treatment of the patient, if such data are used anonymously for scientific and educational purposes or in accordance with another law for the aim of protection of the lives, health and safety of others.Personal Data PROTECTION ACT
23. Section 15 provides that certain rights under the Act can be restricted under conditions prescribed by law, inasmuch as strictly necessary, inter alia, for the purpose of detecting and prosecuting crimes.
THE LAWALLEGED VIOLATION OF ARTICLE 8 OF THE CONVENTION
24. The applicants complained that on 1 April 2010 the hospital had unlawfully disclosed their medical data to the police, thereby violating their right to respect for private life as protected under Article 8 of the Convention, which reads as follows:
“1. Everyone has the right to respect for his private and family life, his home and his correspondence.
2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.”AdmissibilityThe parties’ submissions
(a) The Government
25. The Government submitted that the application had been lodged outside the six-month time-limit which according to them had started to run after the judgment of the Higher Administrative Court (see paragraph 14 above) had been served on the applicants.
26. The Government further submitted that the application was incompatible ratione materiae because there had been no interference with the personal lives of the applicants, given that the data that had been disclosed to the police had not been personal data. They submitted that although the lists of daily dispensing of methadone had contained the applicants’ names, surnames and quantities of methadone received, this had not been sufficient to identify them as the lists had not contained the applicants’ addresses or ID numbers.
(b) The applicants
27. The applicants submitted that it had not been possible to secure full protection of their rights in the administrative proceedings since they had not been able to obtain compensation in those proceedings. Therefore, the starting point for the calculation of the six-month period should be 17 June 2013, the date on which their representative had been served with the final judgment in the civil proceedings.
28. They further submitted that the lists for daily dispensing of methadone had constituted medical and, accordingly, personal data, as they had contained the names and surnames of the applicants and the methadone treatment that they had received on the material days. The disclosure of those lists to the police had therefore constituted an interference with their private life. In this connection they referred to section 4 of the Protection of Patients’ Rights Act and to the Court’s findings as to the definition of medical data and the obligation of the State to protect the confidentiality of such data in the cases of Z. v. Finland (no. 22009/93, 25 February 1997), and Y.Y. v. Russia (no. 40378/06, 23 February 2016).The Court’s assessment
(a) Compatibility with the six-months rule
29. The general principles with regard to the six-month rule were recently summarised in the case of Lopes de Sousa Fernandes v. Portugal ([GC] no. 56080/13, §§ 129-32, 19 December 2017).
30. The Court notes that the civil proceedings were initiated on 10 September 2010, less than a month after their requests were lodged with the DPA (see paragraphs 11 and 15 above). In their judgments, the civil courts decided the applicants’ claim on the merits without making any reference to the findings of the administrative courts. The compensation proceedings were conducted and the civil courts reached conclusions completely independently from the findings of the administrative courts. The Government have neither alleged nor have they provided any example of domestic practice that, in view of the outcome of the proceedings before the DPA and the administrative courts, the applicants’ compensation claim before the civil courts lacked any prospect of success. In such circumstances, it cannot be held against the applicants that they waited for the outcome of the civil proceedings before submitting their application with the Court. This objection should therefore be rejected.
(b) Compatibility ratione materiae
31. The Court reiterates that personal information relating to a patient belongs to his or her private life (see, for example, I. v. Finland, no. 20511/03, § 35, 17 July 2008, and L.L. v. France, no. 7508/02, § 32, ECHR 2006‑XI). The storing and disclosure of information relating to an individual’s private life falls within the scope of Article 8 § 1 (see, for example, Rotaru v. Romania [GC], no. 28341/95, § 43, ECHR 2000‑V, and Leander v. Sweden judgment of 26 March 1987, Series A no. 116, p. 22, § 48). Furthermore, the protection of personal data, not least medical data, is of fundamental importance to a person’s enjoyment of his or her right to respect for private and family life as guaranteed by Article 8 of the Convention (see, for example, Mockute v. Lithuania, no. 66490/09, § 93, 27 February 2018).
32. In the present case the Court notes that it was not disputed between the parties that the applicants were registered as patients at the hospital and that they received regular treatment there with regard to their addiction. Furthermore, the data contained in the lists, as well as their patient files contained information regarding their treatment and received medication. Referring to the domestic-law definitions of the terms “patient” and “medical data” (see paragraph 21 above), as well as to its case-law, the Court finds that the data in question were to be regarded as medical data within the meaning of the Court’s case-law (see, among other authorities, Y.Y., cited above, § 38). Lastly, the DPA, the administrative and civil courts accepted that the lists contained medical data and, accordingly, personal data within the meaning of the Personal Data Protection Act (see paragraphs 13, 14 and 16 above). The fact that the lists did not contain the applicants’ addresses or ID numbers cannot lead to a different conclusion. The Government’s objection should therefore be rejected.
(c) Conclusion
33. The Court further notes that the application is neither manifestly ill‑founded nor inadmissible on any other grounds listed in Article 35 of the Convention. It must therefore be declared admissible.MeritsThe parties’ submissions
(a) The applicants
34. The applicants argued that on 1 April the police had seized without a court order two lists for daily dispensing of methadone which had contained their names, surnames and the quantities of methadone received on those days. The police were also allowed to examine their patient files, which contained the history of their diagnoses, treatment and data about relapses. After these events they had been stopped on the street and teased by police officers who had used information about their treatment which they could only had known from the lists and medical files.
35. Furthermore, section 25 of the Protection of Patients’ Rights Act contained an exhaustive list of exceptions where patients’ medical data could be disclosed without the patient’s consent; “suspicion of a criminal offence” was not one of the exceptions. The existence of mere suspicion of a crime did not constitute a legitimate aim for the disclosure of their medical data.
36. Lastly, the disclosure of their data to the police had not been necessary in a democratic society. The police had had other means to investigate the matter, such as interviewing hospital staff. They could have sought the consent of the patients or obtained a court order prior to embarking on an indiscriminate seizure of personal data, the sole aim of which had been to collect data on (former) drug users and to use it against them.
(b) The Government
37. The Government admitted that on 1 April 2010 the police had been given access by the hospital to unedited copies of the two daily lists of methadone dispensing where the names, surnames and quantity of administered methadone were visible. They maintained that no other documents, including patient files or medical histories had been disclosed to the police.
38. There had been no need for police to obtain a court order to consult the above documents because such an obligation did not emanate from domestic law. That was so because the impugned measure had been taken in accordance with section 5 of the Police Act and section 144 of the Criminal Procedure Act.
39. The aim of that measure had been prevention and detection of criminal offences, which had been legitimate and in the interest of the public.
40. Lastly, the Government submitted that the inspection of the daily lists of dispensing had been necessary in the present case, as there had been no other means to reach the above aim, given that an investigation into missing methadone had had to include the distribution of methadone by the hospital. Failure to consult the lists would have rendered the investigation incomplete. The two lists were never forwarded to other institutions or used for purposes other than that of the investigation.The Court’s assessment
41. The general principles applicable to the instant case are summarised in the case of S. and Marper v. the United Kingdom ([GC], nos. 30562/04 and 30566/04, §§ 67-77, ECHR 2008), and more recently reiterated in the case of Avilkina and Others v. Russia (no. 1585/09, §§ 43‑46, 6 June 2013).
42. The Court observes that the hospital in question was a public hospital for whose acts the State was directly responsible. There is therefore no doubt, in the Court’s view, that the disclosure by a State hospital of the applicants’ medical data to the police constituted an interference with the applicants’ right to respect for their private life as secured by Article 8 § 1 of the Convention (see Radu v. the Republic of Moldova, 50073/07, § 27, 15 April 2014). It will examine whether that interference was justified in terms of Article 8 § 2 of the Convention, that is, whether it was in accordance with the law, pursued a legitimate aim and was “necessary in a democratic society”.
43. It is undisputed between the parties that on 1 April 2010 the hospital disclosed two lists of daily methadone dispensing to the police which included the applicants’ names, surnames and methadone treatment (see paragraphs 7 and 37 above), unlike the findings in the administrative and civil proceedings (see paragraphs 13 and 16 above). These lists were seized by the police and later returned to the hospital (see paragraph 10 above). That the police were also given access to patient files finds support in the findings of the DPA and the civil courts (see paragraphs 7, 13 and 16 above). The Court therefore finds it established that the hospital had also disclosed the applicants’ patient files to the police.
44. The Court needs to decide whether the disclosure on 1 April 2010 by the hospital of medical data regarding the applicants had a basis in domestic law.
45. In this regard, the Court firstly notes that the police’s power to inspect and seize documents kept by State institutions without a court order is regulated in the Police Act and section 144 of the Criminal Procedure Act (see paragraphs 18-20 above). Further to this, section 25 of the Protection of Patients’ Rights Act contains an exhaustive list of exceptions to the general rule of non‑disclosure of confidential medical information without a patient’s consent, which includes an exception allowing a hospital to disclose medical data if that is regulated in other legislation and is being done with the aim of protection of the lives, health and safety of others (see paragraph 22 above). The disclosure at issue, therefore, can be regarded to have had a basis in domestic law.
46. The Court agrees with the Government that the disclosure of the applicants’ medical information pursued the legitimate purpose of the detection and, therefore, prevention of crime (see Trajkovski and Chipovski v. North Macedonia, nos. 53205/13 and 63320/13, § 49, 13 February 2020). It therefore remains for the Court to determine whether the disclosure of the applicants’ data was “necessary in a democratic society”.
47. On the available material, it notes that the police took no investigative measures on the basis of the medical data obtained on 1 April 2010. Its report of 17 August 2010 stating that there had been no elements of a crime with regard to the missing methadone followed after the police had obtained the anonymised lists in respect of the dispensing of methadone (see paragraphs 8 and 9 above). Accordingly, the Court cannot discern, and the Government have failed to provide a convincing explanation in this respect, why it had been necessary, in the circumstances of the case, that the police obtained full access to the medical data regarding the applicants.
48. The Court further notes that the police had other options to follow up on the complaint with regard to the missing methadone, namely it could have interviewed the hospital staff before examining the applicants’ medical data. In this connection the Court notes that it was an interview with one of the doctors at the hospital which was relied on by the police to terminate the investigation into the alleged offence (see paragraph 9 above).
49. Lastly, the Court takes note of the fact that the domestic courts failed to balance the protection of patients’ rights (see paragraphs 21-23 above) against the right of police to access sensitive medical data without a court order.
50. The above considerations are sufficient for the Court to conclude that the collection by the police of the applicants’ confidential medical data was not accompanied by sufficient safeguards to prevent disclosure inconsistent with the respect for the applicants’ private life guaranteed under Article 8 of the Convention.
51. There has therefore been a violation of Article 8 of the Convention.APPLICATION OF ARTICLE 41 OF THE CONVENTION
52. Article 41 of the Convention provides:
“If the Court finds that there has been a violation of the Convention or the Protocols thereto, and if the internal law of the High Contracting Party concerned allows only partial reparation to be made, the Court shall, if necessary, afford just satisfaction to the injured party.”Damage
53. The applicants claimed 3,000 euros (EUR) each in respect of non‑pecuniary damage.
54. The Government contested the claim as unsubstantiated. They further submitted that there was no causal link between the damage claimed and the alleged violation. Lastly, they argued that the finding of a violation of the Convention would be sufficient just satisfaction.
55. The Court considers that the finding of a violation may be regarded as constituting sufficient just satisfaction in this respect. The Court accordingly rejects the applicants’ claim for non-pecuniary damage (see Trajkovski and Chipovski, cited above, § 59).Costs and expenses
56. The applicants also claimed EUR 2,370 for the costs and expenses incurred before the domestic courts.
57. The Government contested the claim as excessive because the expenses were incurred in proceedings involving six plaintiffs (see paragraph 15 above), which contributed to a significant increase in costs and expenses.
58. According to the Court’s case-law, an applicant is entitled to the reimbursement of costs and expenses only in so far as it has been shown that these have been actually and necessarily incurred and are reasonable as to quantum (see Editions Plon v. France, no. 58148/00, § 64, ECHR 2004‑IV). Regard being had to the documents in its possession and to its case-law, the Court considers it reasonable to award the sum of EUR 900 for costs and expenses in the domestic proceedings, plus any tax that may be chargeable to the applicants.Default interest
59. The Court considers it appropriate that the default interest rate should be based on the marginal lending rate of the European Central Bank, to which should be added three percentage points.
FOR THESE REASONS, THE COURT, UNANIMOUSLY,Declares the application admissible;Holds that there has been a violation of Article 8 of the Convention;Holds that the finding of a violation constitutes in itself sufficient just satisfaction for the non-pecuniary damage sustained by the applicants;Holds
(a) that the respondent State is to pay the applicants, within three months, EUR 900 (nine hundred euros), plus any tax that may be chargeable to the applicants, in respect of costs and expenses;
(b) that from the expiry of the above-mentioned three months until settlement simple interest shall be payable on the above amount at a rate equal to the marginal lending rate of the European Central Bank during the default period plus three percentage points.
Done in English, and notified in writing on 22 October 2020, pursuant to Rule 77 §§ 2 and 3 of the Rules of Court.
Renata Degener Pere Pastor Vilanova
Deputy RegistrarPresident
Full & Egal Universal Law Academy