V & EDPS v. EUROPEAN PARLAMENT

Article 8 (Respect for Private Life) of the ECHR: Article 8 ECHR on private life relates to a fundamental right which covers the right to secrecy of one’s medical state. The transfer of that data to a third party, even another EU institution, is an interference with that right, whatever the final use. Such interference may be justified if it is “in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.” (¶¶ 113, 123)

However, it has been held that restrictions may be imposed on fundamental rights provided that they in fact correspond to objectives of general public interest and do not constitute, with regard to the objectives pursued, a disproportionate and intolerable interference which infringes upon the very substance of the right protected (Case C‑404/92 P X v Commission, paragraph 18). In that regard, Article 8(2) of the ECHR must be taken as a reference point. Under that provision, interference by a public authority with private life may be justified provided that (i) it is ‘in accordance with the law’, (ii) it pursues one or more of the – exhaustively listed – objectives and (iii) it is ‘necessary’ in order to achieve that (those) objective(s).

In this case, as has been stated previously, the protection of personal data plays a fundamental role in the exercise of the right to respect for private and family life, embodied in Article 8 of the ECHR. Respect for the confidentiality of health information constitutes one of the fundamental rights protected by the legal order of the European Union (see judgments of 8 April 1992 in Case C‑62/90 Commission v Germany, paragraph 23, and of 5 October 1994 in X v Commission, paragraph 17). That principle is crucial not only to respect the sense of privacy of a patient but also to preserve his or her confidence in the medical profession and in the health services in general (Eur. Court HR, Z v Finland judgment, § 95). In view of the extremely intimate and sensitive nature of medical data, the possibility of being able to transfer or communicate such information to a third party, even where that party is another European Union institution or body, without the consent of the person concerned, calls for particularly rigorous examination (see, by analogy, Eur. Court HR, Z v Finland judgment, § 95, and S. and Marper v United Kingdom judgment, § 103). Regulation No 45/2001 provides, in that regard, in Article 10(1), that the processing of medical data is prohibited, in principle, subject to derogations laid down in Article 10(2).