[Medical records and third party personal data processed in the patient's interest]

The authors examine some critical aspects relating to the management of sensitive personal data of individuals (third parties) other than the patients. The issue raised is that of how consent can be obtained for treatment of third party personal data when the subject is not available to give consent, and what should be done if consent is not given. In some cases it can be difficult to decide whose interests should prevail. The authors recommend using caution when processing third party personal data and to collect third party information only if strictly indispensable. They also discuss what should be done when a third party requests information regarding whether personal data, of which that individual is the data subject, is being processed by the health institution. The authors conclude that more time will be required before the full protection of personal information is achieved.