Protection of personal data in the light of the RODO in the activity of the Polish Ombudsman of Patients’ Rights

The aim of the article is to familiarise readers with the protection of personal data in the activities of the statutory body appointed to protect patients’ rights in Poland, in particular in the context of the EU provisions that entered into force in this area in 2018.

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation hereinafter: RODO), acts as a coherent tool for use in all member states due to its direct applicability, without the need for implementation. The act has been in force since 25 May 2018 and introduced a number of changes to the current standard of personal data protection, which in the case of Member States requires the analysis of applicable legal documents in terms of their compliance with the RODO and necessary changes made therein. The Patient’s Rights Ombudsman, as the central organ of government administration competent in matters of patient rights protection, set up by the Act of 6 November 2008 on Patient Rights and the Patient Rights Ombudsman (hereinafter: Act), must also undertake – just like all other state institutions in Poland – an analysis of the area of ​​its activity in the light of the RODO.

After analysing the currently applicable national regulations and publicly available information on the activities of the Patients’ Rights Ombudsman, it should be noted that implementation by the Ombudsman of Patients’ Rights of statutory competences and duties, specified in art. 47 par. 1 of the Act, is inextricably linked to the processing of patients’ personal data. Any activity related to the processing of personal data, should comply with the principles of the generally applicable laws, including RODO. Thus, the Ombudsman for Patients’ Rights, as the administrator of personal data, bears the burden of exercising special diligence in order to protect the interests of the data subjects – and so far the obligation has been fulfilled perfectly.

Also there is no doubt that for the effective implementation of its statutory tasks, the Patient’s Rights Ombudsman must be guaranteed wide access to patients’ personal data – and this right, in the context of new EU Regulation, should be clearly articulated in the provisions of the statutory law in Poland.