Protection of personal medical data in the context of GDPR implementation

Aim: To analyse the challenges of protecting personal medical data in European Union (EU) Member States and other European countries during the implementation of Regulation 2016/679 (General Data Protection Regulation [GDPR]).

Materials and Methods: The study is based on an analysis of international and national legal frameworks governing personal medical data protection, focusing on the GDPR, the case law of the European Court of Human Rights (seven relevant judgments), and national data protection legislation. Statistical data from reports of national Data Protection Authorities were analyzed to identify dominant categories of infringements related to unlawful processing, storage, disclosure, and security breaches of medical data. The methodology included a comparative analysis of European Court of Human Rights judgments and an overview of enforcement activities of data protection authorities in 27 EU Member States. Dialectical, hermeneutic, comparative, analytical, and systemic analysis methods were applied.

Conclusions: To comply with the GDPR, healthcare institutions must ensure lawful and secure processing of personal medical data: organize internal procedures, appoint a Data Protection Officer, implement technical and organizational measures, obtain informed consent from patients, and guarantee their rights to access and protect such sensitive information. The protection of personal medical data is ensured through a multi-level system that combines the GDPR, the European Court of Human Rights case law, and national institutions. It is essential to develop and implement clear data protection policies that define responsibilities, data handling procedures and incident response. Many countries still have low awareness among medical personnel regarding personal data protection.