Court ruling may reshape access to deceased people’s health data

ERR reports that a Tallinn Administrative Court ruling may change the practice of releasing deceased people’s health data after it ordered access to dental records for the minor children of a man who died in Ukraine.

The court ruled on August 14 that the children should be allowed to obtain their father’s dental records, even though they did not have a certificate of inheritance. They wanted to use the information to help identify his possible remains and bring them to Estonia.

The Health and Welfare Information Systems Centre, or TEHIK, which manages Estonia’s health information system and is responsible for releasing the data it contains, had refused the request. It said there was no legal basis for access because the children were not heirs and did not have a certificate of inheritance.

Ave Liina Antonik, head of TEHIK’s legal team, said the centre follows the legislation governing the release of health information system data and the instructions of the system’s responsible controller. She said TEHIK had assessed the right to release the data in cooperation with the Ministry of Social Affairs.

“Indirectly deriving the right to make a data request is not compatible with the principles of processing personal data,” Antonik said.

According to Antonik, TEHIK is not aware of any other similar court dispute in which relatives of a deceased person had sued the centre to obtain the person’s health data from the health information system.

The Tallinn Administrative Court found that the man’s children had grounds to demand access to their father’s health data in order to arrange his funeral, which the court described as a constitutional right. Without access to his dental records, their right to bury their father would exist on paper but could not be exercised in practice.

Inheritance law usually grants access

Estonia follows the European Union’s General Data Protection Regulation, which regulates the protection of data belonging to living people. The regulation also allows member states to adopt additional laws governing the processing of deceased people’s data.

In Estonia, the processing of data belonging to deceased people is mainly regulated by Section 9 of the Personal Data Protection Act. Under the provision, access to a deceased close relative’s data is primarily available to heirs.

Ants Nõmper, a lecturer in medical law at the University of Tartu, said the law does not require a decision or consent when the information concerns only a person’s name, death and place of burial. However, consent from an heir is required to use health data, information about the cause of death or other sensitive personal data. The law designates the heir as the representative of the deceased person’s interests.

Nõmper said inheritance primarily concerns the settlement of financial relations, and people often renounce it because heirs may inherit debts in addition to assets. At the same time, a certificate of inheritance grants access to and the right to decide about a deceased close relative’s data.

“A situation can then arise in which no one could give consent to the processing of the deceased person’s personal data. That was certainly not the intention of the law,” Nõmper said.

Antonik said it was important for the legal framework to be clear in such situations and for the same principle to be applicable in future cases.