by Pierre Mallia MD MPhil PhD FRCGP
Director, Centre for Bioethics, Medical School

Perhaps the greatest local myth with our own Data Protection law is its overuse into areas where it should not be used. For example, if I form part of a college which elects its own council and to which I, say, pay a membership fee, I have a right to know the data of individual members. If I wanted to contest an election, it would be unfair that someone who handles data has an unfair advantage. Moreover all members must be kept updated on new members and their status with regard to rights should be made clear to everyone concerned. I have unfortunately witnessed this. The Registrar must make all data available to all members at any time; otherwise it would be an illegal abuse. Conversely only data that is relevant should be collected; and if data is necessary which does not pertain to others, it is the members of the group that should decide whether this is to be kept only by a trusted person and not the data commission. It is unfortunate that an act aimed at protecting the fundamental rights and freedoms can thus be used to the contrary.

You often call a government department and ask for information; they reply that because of data protection they cannot give you information, which by right is yours. In another scenario I know a family who were robbed. The robber left traces of his own blood on a broken glass. When the woman asked that the sample be taken, the inspector said that he would need the consent of the robber!!! Why not ask him for consent for taking fingerprints then?

Data protection is nothing more than what already existed within the framework of the law. Local laws protect my fundamental rights and freedoms to privacy. The EU directive extends transfer of information to within the EU. It also imposed strict protection on data which leaves the EU. This of course includes data concerning multi-centre trials and research. This does not of course mean that local data protection acts constrain research, for example, more than the Directive. The Directive is there to allow the EU to work as a single market; local laws follow the rights and freedoms laid down elsewhere once one joins the European Union.

We often frown at the notion that what is written in patients’ files is owned by the patient. This is stipulated in the Recitals of the directive, which therefore imposes the constrains of obtaining consent for research each and every time. Anonymization is usually a reason for exemption for this unless stated otherwise by a Research Ethics Committee which considers the research as sensitive enough for the patients still having a right to know about the use of their files or samples. It is within the EU law that what is written down in files is in fact owned by patients. Patients have been known to challenge what is put down in their files in courts of law. It is no longer acceptable to say that files should not be handled by patients. By this we do not imply that they may have a direct right to take their files at home, and neither perhaps that they may have a right to view it on a computer (in the hopefully not too far future); but certainly they have a right for someone to explain what is in it – as this is not confidential information (which is an exercise between two people, usually a professional and his or her client), but private information – private property. No one, therefore, has a right to look into my file without my prior permission. Presumed consent is only there when people attend hospital and their files have to be looked up in order for doctors to look into the history. It is this context which is exempted when the act says that exemptions are given for medical reasons.

When we scribble into a file, it is perhaps important to realise that we are making notes into the private life of a person; it is a legal note, and no excuse that the patient can misunderstand or misinterpret is allowed in a court of law. One should therefore give due consideration to accurate notes and not put anything which may offend or which is not transparent. Careless notes are therefore a precedent for malpractice suits – as we have seen there is a breach in ones’ duty which may cause harm. Whilst sometimes it is difficult to explain what one is going to write down, if one writes ‘paranoid personality’, one must be able to substantiate such a label.