In recent months, the public has learned that the Estonian Internal Security Service (ISS) and the Police and Border Guard Board (PPA) have essentially unlimited access to databases containing health data.

Investigative bodies have admitted that this access has been used extremely actively. ISS alone made about 13,000 health‑data queries in 13 months. Of those, roughly 2,600 queries were made "for intelligence gathering and criminal proceedings," meaning without the individuals' consent or knowledge. Added to that are approximately 2,500 PPA queries per year, which the interior minister said were "related to police duties."¹

Based on explanations shared in the media, an ordinary citizen might get the impression that mass querying of health data in criminal proceedings without consent is perfectly lawful. Hopefully, unclear wording was not used to intentionally create such an impression, because that would be an unambiguous falsehood. No state agency could allow itself to mislead the public in that way.

Health data are not ordinary bits of information in yet another database from which investigative bodies or even courts may freely extract information during criminal proceedings. Health data are protected in criminal proceedings similarly to attorney‑client privilege, confessional secrecy and journalistic source protection.

Like state secrets, such data generally may not be collected in criminal proceedings. The ban is so strict that even a witness may not be questioned about them in court, let alone investigators "surfing" freely through downloadable data during pretrial proceedings. This is basic criminal‑procedure knowledge known to every prosecutor and investigator.

True, patient confidentiality is not absolute. The law provides a few narrow exceptions that allow disclosure of health data without a person's consent. For example, the Law of Obligations Act allows deviation from confidentiality to a reasonable extent if otherwise the patient could significantly harm themselves or others. This exception is aimed solely at preventing future danger and does not allow disclosure of data to investigate past acts.

Another common exception is found in the Psychiatric Care Act. The Supreme Court clarified the scope of this exception in a decision a few years ago, when data from a defendant's medical record — including conversations with a psychiatrist — were used in a forensic psychiatric evaluation in a criminal case.

The Supreme Court admonished both the investigative bodies that collected the data and the health‑care provider that released them, finding that "patient confidentiality covers all data learned during the provision of health‑care services," and that the mere existence of a criminal proceeding does not justify using an entire medical record.²

The Psychiatric Care Act allows investigators to request only the fact of receiving psychiatric treatment and the diagnosis, but not other health data, let alone an entire medical record.

In addition, there is a general exception in the Health Services Organization Act that allows collecting health data in criminal proceedings to establish the truth, but the scope and constitutionality of that provision are questionable. No legal act exists that would give, for example, the PPA the right to process health data "to perform police duties."

It is not credible that if investigative bodies make more than five thousand health‑data queries per year without consent, all those cases fall within narrowly worded legal exceptions. For comparison: Estonia resolves about 12,000 criminal cases per year.³

The problem is not limited to possible abuses by investigative bodies. Health‑care workers and officials managing databases may be personally liable — administratively or criminally — for violating patient confidentiality by transmitting health data based on an unlawful query.

Therefore, every case in which data were collected without consent deserves investigation, even if the official did not use the health data outside work duties. Inevitably, the question arises whether our entire system for collecting and managing health data even allows the state to store data in a way that does not violate its own rules on a daily basis.

Before fixing the system, officials must start by answering citizens' questions honestly. Instead of contradictory explanations, an independent audit should at minimum determine — and explain publicly — the legal basis for each query made without consent and how the legality of those queries was verified. That verification should, incidentally, be performed every time before health data are transmitted to investigative bodies. Continuing the blindfold game instead unfortunately erodes trust in both the digital state and the rule of law.

--

Follow ERR News on Facebook and X and never miss an update!