[New regimen for protection of health data]

The new Personal Data Protection Act of 1999 (Ley Orgánica 15/1999, de 13 de diciembre) introduces changes in legal protection of health data. This regulation fulfills the Directive 95/46/CE. There are four relevant changes: 1) extension of public control over any processing of data, automatic or manual, except in personal or domestic activities; 2) general prohibition against processing data, unless the subject gives his or her explicit consent, waived when processing personal data is required for medical needs or the management of health care services by any health professional subject to professional secrecy; 3) regardless of the purpose for which the data was been collected, further processing for scientific purposes is considered compatible; 4) any regulations contained in the General Health Act, or any other Act, relating to data concerning health continue in force. In short, the new Act waives previous and explicit consent for processing health data when medical, public heath and research goals are involved.