Chapter III - Understanding the Subject of Protection

Summary

Introduction – The two previous chapters shed light on the legal context of the patient's right to data protection and the delineation of that right. This analysis needs to be supplemented with a final element before turning to the assessment of the tools offered to protect the patient's right to data protection, namely the material scope of the patient's right to data protection. This chapter analyses the concepts ‘personal data’ and ‘health-related data’. The first section provides a brief introduction to the concept ‘personal data’ as adopted by European law. The second section provides a more thorough discussion that zooms in on the European understanding of ‘health data’.

SECTION 1. PERSONAL DATA

Introduction – In Europe, the following well-known definition delineates the concept ‘personal data’: “Personal data is any information relating to an identified or identifiable natural person ‘data subject’”. This definition has not changed since its adoption by the 1981 Convention 108. Three elements in the definition are crucial: ‘any information’, ‘natural person’ and ‘identified or identifiable’.

ANY INFORMATION

Wide – In nature, content and format, the concept of personal data is given a broad interpretation. The European Commission, Council and Parliament agree on the importance of a broad interpretation. They intend to “cover all information which may be linked to an individual”. In its Opinion 4/2007 on the concept of personal data, the Article 29 Working Party confirmed that personal data include:

“information touching the individual's private and family life “stricto sensu”, but also information regarding whatever types of activity is undertaken by the individual, like that concerning working relations or the economic or social behaviour of the individual. It includes therefore information on individuals, regardless of the position or capacity of those persons (as a consumer, patient, employee, etc.)”.

Technology-neutral – The broad scope is reflected in the technology-neutral approach of European data protection law. The European legal framework protects information independently of its form. It may concern written words, images, bits and bytes, but also radio signals and alike.