New draft law on the "right to be forgotten" for those who have overcome serious illness
The right to be forgotten is now more important than ever in protecting the privacy and personal data of individuals. With the rapid and instantaneous propagation inherent to the Internet and the ease of access available from online search engines, the content published online becomes permanently available and accessible forever and for anyone, instantaneously worldwide, through a simple click. As the saying goes, "once on the internet, forever on the internet".
The right to be forgotten is legally established in the GDPR and in the Portuguese Charter of Human Rights in the Digital Age (CHRDG), in identical contours. In the data protection regime, the right to be forgotten is enshrined as the right of the data subject to obtain the erasure of personal data in specific situations better listed in Article 17 of the GDPR, related to data processing. The Portuguese CHRDG provides for the right of the data subject to obtain State support in exercising the right to erasure.
However, the right to be forgotten cannot only be seen as a right to the erasure of data from the perspective of data processing. Most of the time, behind the intention of erasing the data, there are reasons of discrimination, prejudice, situations from the past that the person has the right not to be associated anymore. At issue is a fundamental right of personality supported by the principle of human dignity.
It was essentially based on situations of serious and unfair discrimination for various groups of the population that the need arose to propose a draft law that would protect people with an aggravated health risk and those who have overcome a situation of illness and for that reason, instead of being protected, find themselves marked by contractual practices of a discriminatory nature, mainly in the access to credit and in insurance contracts.
Therefore, following the steps taken in France and in other European countries, last October the Portuguese Parliament approved a draft law that foresees the end of discriminatory practices in the access to insurance and bank loans by people who have overcome or mitigated situations of aggravated risk of health or disability and where the imperative and general rule of the right to be forgotten is established.
This law will apply to people with aggravated health risks, i.e., people suffering from any pathology that determines a long-term, evolving, potentially incapacitating, organic or functional alteration that affects the quality of life on a physical, mental, emotional, social and economic level and is a potential cause of early disability or a significant reduction in life expectancy. This may include cancerous diseases, HIV, diabetes, among others. Within the scope of application of the Draft Law are also people who have overcome a disability situation and people who have mitigated situations of aggravated risk of health or disability, i.e. people who are currently undergoing treatment.
The Portuguese Insurers Association highlighted that the question at stake was not in fact a right to be forgotten since one only forgets what one already knows. What was in question was a limitation to the collection of health data in the celebration of insurance contracts to a person who has already overcome the aggravated health risk. The National Institute for Rehabilitation also noted that the right to be forgotten is associated with the right to privacy, in the sense of protecting a past that, in the present, may be harmful. After listening to these and other entities, the diploma ended up defining in article 3 the right to be forgotten at issue here. Therefore, the right to be forgotten of the above mentioned persons was established in two practical aspects:
- Right to be forgotten when contracting housing and consumer credit and when contracting insurance associated with the referred credits, to the extent that the persons concerned cannot be subject to an increase in insurance premium and/or exclusion from insurance contract guarantees (thus ensuring non-discrimination);
- The right that no health information regarding the medical condition that originated the aggravated health risk or disability may be collected or processed by credit institutions or insurers in a pre-contractual context, provided that 2, 5 or 10 years have elapsed according to the applicable situation described in Article 3 (implementing here the right to be forgotten within the meaning of data protection).
It should be noted that health data is considered sensitive data within the meaning of Article 9 of the GDPR. In this regard, the National Supervisory Authority (CNPD) highlighted the fact that the collection of information on the medical situation of people seeking credit institutions and insurers is still without the proper legal framework. Both the Portuguese data protection law, as well as other legislation on insurance contracts and insurance activity, remain silent as to the regulation of the processing of personal data relating to health. The CNPD therefore proposed that the draft law should fill this gap and regulate in detail the conditions of such data processing, which was not adopted.
This law will come into force on 1 January 2022 and once in force, the practice of these prohibited discriminatory acts will be punishable as a misdemeanour with a fine ranging from 5 to 30 times the minimum monthly salary, depending on whether an individual or a company, without prejudice to possible civil liability.
This diploma assumes a high importance in the concretization and assumption of the right to be forgotten in Portugal, especially in such a delicate area as health. Hopefully, the implementation of this draft law will bring positive consequences for patients with cured cancers or chronic diseases, who until now have been discriminated against in accessing life insurance and credit contracts
Article provided by INPLP member: Ricardo Henriques (Abreu Advogados, Portugal)
Co-authoreded with: Jose Maria Alves Pereira and Matilde Ortins de Bettencourt
Discover more about INPLP, the INPLP-Members and the GDPR-FINE database
Dr. Tobias Höllwarth (Managing Director INPLP)