Is it permissible to create a register of persons with a specific disease and what could be the legal basis for maintaining such a register?
Medical data are classified as particularly sensitive data and as such are subject to more stringent processing requirements than data that are not considered sensitive, as provided for by Articles 16, 17 and 18 of the Law on Personal Data Protection (Official Gazette of RS, Nos. 97/2008, 104/2009 – other Law and 68/2012-Decision of the Constitutional Court and 107/2012).
A register of persons with any disease would constitute a file of particularly sensitive data. A question which arises here even before the issue of the proper legal basis for processing medical data is: who is allowed to process medical data, i.e. who can be a data controller in such cases? Neither the Law on Health Care (Official Gazette of RS, Nos. 107/2005, 72/2009 – other Law, 88/2010, 99/201, 57/2011 and 119/2012) nor any other law which governs the field of health care makes any explicit reference as to who can keep a register of patients with certain diseases, on what legal basis, to which purpose, under what conditions, what measures should be undertaken in such cases etc.
Article 92а of the Law on Health Care explicitly regulates only the keeping of registers of patients with rare diseases. In addition, this Law provides that Health care activity shall be provided on the primary, secondary and tertiary levels (Article 79). According to Article 91, paragraph 1 of the Law on Health Care, the health care activity on the tertiary level includes providing of the most complex forms of health care and specialist and consulting and hospital health care activity, as well as research and development and educational activities, in compliance with the law governing the research and development activity and educational activity. The provision of Article 115, paragraph 2 of the Law on Health Care provides that clinics are also engaged in educational and research and development activities, in accordance with the law; Article 116, paragraph 2 provides that institutes are engaged in educational and research and development activities, in accordance with the law; while Article 118, paragraph 1 stipulates a clinical centre is a health care facility that unifies the activities of three or several clinics, in such a way that it makes a functional unity, organized and capable to successfully administer the affairs and carry out tasks related to: 1) engaging in a highly specialized specialist and consulting and inpatient health care activity; 2) educational and teaching activities; 3) research and development activity.
Further, the provisions of the Law on Research and Development Activity (Official Gazette of RS, Nos. 110/2005, 50/2006 – corrigendum and 18/2010) sets out who can implement programmes of general interest for the research and development activity: 1) Serbian Academy of Sciences and Arts; 2) Matica srpska (cultural and scientific institution of Serbia); 3) accredited research and development organisations (institutes, university schools, integrated universities and centres of exceptional values); 4) researchers and doctoral students and fellows; 5) other organisations, in accordance with this Law. Programmes of general interest for the Republic of Serbia can be implemented by higher education institutions and research and development organisations which are founded and carry out their activities in accordance with the regulations in the field of the defence system and the Serbian Armed Forces, if they comply with the requirements set out by this Law, i.e. if they are accredited and registered with the Register of Research and Development Organisations.
From the provisions quoted above it follows that research and development activity can be carried out only by accredited entities, which comply with certain conditions and are registered in accordance with the law. In the field of health care, it is explicitly stipulated that research and development activity can be carried out only by tertiary level health care facilities, including: clinics, institutes and clinical centres. Thus, the data controller of a register of a disease can only be a tertiary level health care facility (e.g. the Clinical Centre of Serbia).
Furthermore, it should be taken into account that the legal basis for maintaining such register (due to the lack of applicable regulations) can only be provided by the patient's consent given in accordance with Articles 16 and 17 of the Law on Personal Data Protection in writing and that patient's informed consent means that a patient is informed in detail of all the elements in Article 15, paragraph 1 of the Law on Personal Data Protection.
