Your medical information may only be disclosed to other persons and authorities without your consent if specifically allowed by the law. The law should also provide you with adequate and effective guarantees to prevent communication or disclosure of your medical data and the opportunity to challenge the particular actions taken. You can find this basis in the General Data Protection Regulation or in other laws, which specifically relate to medical data processing.

example According to the Law on the Rights of Patients, your data may be communicated to the National Health Service in order to analyze the quality and quantity of health care services in your country. The police or a court may access and use individual’s medical data for the purposes of the prevention of crime, investigation, the adjudication of a particular case, etc.

If the disclosure of your medical data was not allowed by law the activity was not lawful and your right to private life may be violated. There is no need then to examine the other criteria for lawfulness.

The disclosure or communication of your medical data has to be aimed at the protection of legitimate interests. These legitimate interests can, for example, be:

• the protection of your own health

• the protection of public health, namely, the health of other persons

• the allocation of public funds, such as for disability pensions and other financial support in the context of the economic well-being of the country

• medical science

• the prevention, investigation and prosecution of crime

If the disclosure or communication does not serve a legitimate aim, the particular activity is not legal and your right to private life may be violated. There is no need to examine the proportionality of the data disclosure.

The disclosure of your medical information should be necessary and proportional for the achievement of the other legitimate interests. The disclosure (communication) of your medical information has to be important and relevant.

The following questions should be asked to evaluate the necessity:

• Is the disclosed information important and relevant to secure the legitimate interests?

• Are there any other alternative and less restrictive methods available to achieve the legitimate aim?

example Your medical data was communicated to the court within particular court proceedings, but was not decisive in the adjudication of the case. The court could have still reached the same conclusion without using your medical information. In this case, you can conclude that your medical data was not important and relevant for the achievement of the legitimate aim – the adjudication of the particular case.

The disclosure of your medical information shall be proportional for the achievement of the other legitimate interests. Those legitimate interests are not more important than yours, and therefore a fair balance must be found between these competing interests. The authorities have to give sufficient arguments why the interests of others outweighed your rights and the other way around in the particular case.

The following questions should be assessed within the balancing process:

• Even if not required by law, was your consent to the disclosure required in the particular situation, and, if so, have you given it?

• Was your medical data effectively protected against unauthorized access?

• Was it possible to clarify to whom your data was disclosed?

• Was your medical data made publicly accessible? For example, published in the press thereby causing you public humiliation?

• Were there sufficient protections/safeguards against a possible abuse of the obtained information?

If the authorities failed to balance your right to private life with the interests of the state and other persons, there may be a violation of your right to private life. Read more about how to complain and protect yourself in such situations.