| Abstract: | Pagrindinis šio darbo tikslas yra išsiaiškinti, ar vartotojams (pacientams) užtikrintos teisės į žalos atlyginimą, kai nutekinami asmens duomenys sveikatos įstaigose. Darbo objektas – teisinė atsakomybė už sukeltą žalą, nutekinus asmens duomenis sveikatos įstaigose. Šiuo darbu siekiama išanalizuoti mokslinę problemą ir atsakyti į klausimą, ar užtikrinama pacientų teisė į žalos atlyginimą, kai nutekinami sveikatos įstaigos kaupiami asmens duomenys? Tam, kad būtų pasiektas pagrindinis šio darbo tikslas, būtina įgyvendinti šiuos išsikeltus uždavinius: 1) Atlikti ypatingų asmens duomenų analizę bendrajame duomenų apsaugos reglamente (ES) 2016/679, bei genetinių ir biometrinių duomenų kylančius pavojus; 2) Išsiaiškinti duomenų subjektų 2018 m. gegužės 25 d. įsigaliosiančias teises, pagal reglamentą (ES) 2016/679; 3) atskleisti kibernetinio saugumo užtikrinimą, civilinės atsakomybės atvejus Lietuvos sveikatos įstaigose; 4) nustatyti JAV ir Jungtinės Karalystės teisinės atsakomybės reglamentavimą už sukeltą neturtinę žalą, nutekinus asmens duomenis sveikatos įstaigose.
Darbe pasirinkta keturių pagrindinių dalių struktūra: pirmojoje dalyje pristatoma ypatingų asmens duomenų analizė, pagal bendrąjį duomenų apsaugos reglamentą (ES) 2016/679 , analizuojami genetinių ir biometrinių duomenų kylantys pavojai. Antrojoje dalyje įvardijamos naujai įsigaliosiančios duomenų subjektų teisės ir jų pritaikymo galimybės. Trečioji dalis skirta atskleisti kibernetinio saugumo užtikrinimui Lietuvos sveikatos įstaigose, nustatyti civilinės atsakomybės atvejus. Ketvirtojoje dalyje bus siekiama išanalizuoti JAV ir Jungtinės Karalystės teisinės atsakomybės reglamentavimą už sukeltą žalą, nutekinus asmens duomenis sveikatos įstaigose.
Išvados: Sveikatos įstaiga UAB “Grožio chirurgija” archyvavo intymius asmens duomenis be pacientų sutikimo. VDAI atliktas tyrimas atvėrė pacientams kelią į neturtinės žalos kompensaciją, kurią numato Reglamentas (ES) 2016/679. Tačiau, išnagrinėjus teismų suformuotą praktiką dėl civilinės atsakomybės atvejus, galime teigti, jog priteisiami žalos dydžiai neatitinka patirtų išgyvenimų. Teismo sprendimu neturtinės žalos atlyginimas priteisiamas, tik jeigu nustatoma, kad teisės pažeidimo pripažinimas nėra pakankamas atlygis už patirtą moralinę žalą.
Išanalizavus Jungtinių Valstijų bei Jungtinės Karalystės teismų praktiką, įstatymus reglamentuojančius asmens duomenų saugumą, galime teigti, jog pacientams teisė į žalos atlyginimą užtikrinama dalinai. Išnagrinėjus JAV ir Jungtinės Karalystės įstatymus, pacientams teisė į neturtinės žalos atlyginimą nėra užtikrinta, tačiau įvertinus teismų praktiką, teismai linkę suteikti galimybę apginti orumą ir garbę, priteisdami moralinę žalą.
In 2015 the number of the violation of the secrecy of personal information has increased significantly, leaving 81% of the respondents partly, or completely lost of the control of it. (Two of the individuals express strong concerns about the uncontrollable situation.) From the 25th of May of 2018, European Union starts applying General Data Protection Regulations- GDPR, which regulates the data controllers’ and data processors’ responsibility of providing more rights to the data holder.
The main objective of this work is to ascertain whether the consumers (patients) are eligible for the damage compensation in the case of the health institution leaking the stored personal data. The work object – the legal amenability for the personal damage in the case of personal data being leaked in the health institutions. The purpose of this work is to analyse the scientific problem and answer the question if the patients are eligible for the damage compensation in the case of the health institution leaking the stored personal data. In order to pursue the answer to the question that is being raised, it is necessary to accomplish the following tasks: 1) To perform the special individuals’ data analysis in the general data protection regulations (ES) 2016/679, as well as the genetic and biometric data risks; 2) To ascertain the rights of the data subjects, valid from 25th of May 2018, according to the regulations (ES) 2016/679; 3) To ensure cybernetic safety and the cases of civil responsibility in Lithuanian health institutions; 4) To identify the civil responsibility regulations for the moral damage in the case of leaking the personal data in health institutions in the USA and the United Kingdom.
In order to determine whether the patients, who have experienced moral damage in the case of the personal data leakage in the health institutions, are granted the right in the damage compensation, it is vital to analyse the legal documents of both, Lithuania and foreign countries, as well as the foreign court practices. A few methods are being applied in the process of this work creation: descriptive-theoretical, document analysis, lawful comparative and systematic methods. This particular methodology is used to acquire the best results and to assure the efficient execution of the tasks.
The work consists of the four main parts: the first part presents the data analysis of the special individuals, according to the basic data security regulations (ES) 2016/679, also it being analysed the dangers that face the genetic and biometric data. In the second part, there is listed the new rights of the data subjects and their application options. The third part is unfolding the importance of ensuring the cybernetic safety in the health institutions in Lithuania, as well as establishes the cases of the civil responsibility. The last part of the work is for determining the lawful responsibility regulations for the damage caused in the case of leaking personal data in the health institutions in the USA and the United Kingdom.
The conclusions:
After the careful research on the State data security in the company UAB “Grožio chirurgija” it has been discovered that the personal data have been archived not only without the patients’ consent but also without any security measures being taken. It has been revealed that more than a half health institutions are not registered as legal data controllers. The conclusion can be drawn that the services that the health institutions offer are not tested by the State data inspection, hence the security of the personal data is not ensured.
Whilst analysing the cases of civil damage in Lithuania, it is certain that there are cases when the court decisions do not include the moral damage compensation. It is common that the court decisions are confined to the acceptance of law violation. The moral damage compensation is adjudged only when the violation acceptance is not enough to defend the violated law.
In contrast with European Union, the USA doesn’t have comprehensive (national) law, regulating the collection and use of personal data and rules of privacy. HIPAA is the only law, created with the purpose to protect the medical information privacy. The HIPAA law doesn’t anticipate the private lawsuit rights, even if the law is clearly broken by the data controller (health institution) and the damage has been done, as a direct result. However, the growing number of the cybernetic attacks in the USA has influenced the perversion in the practices of the court. The decision in the case Byrne v. Avery CTR. For Obstetrics & Gynecology P.C., 314 Conn. 433, 102 A.3d 32 (Conn. 2014) allowed the prosecutor to use the HIPAA law, in order to determine the standards in accordance with the laws of the state, negligence and privacy violation including.
After analysing the law of the personal data security in the United Kingdom has become clear, that the data subjects’ right to the damage compensation is not granted. According to the United Kingdom Data Protection Act 1998, section 13, in order to successfully receive the compensation, it is necessary to prove the factual financial damage. However, in 2016, in the case “Vidal-Hall” the Highest Court has raised a perversion against “Google” decision by first time being vocal about the requirement, related to the private data, can be declared solely in the case of emotional damage. It is important to accentuate that until the verdict of the case “Vidal-Hall” against, according to the United Kingdom Data Protection Act 1998, section 13, the indirect damage as the result of the accident has been held only additional when the prosecutor proved the experienced financial damage. In the case “TLT et al” and “Secretary of state for the home department of June 2016”, the prosecutors have been assigned the compensations adding up from £2500 to £12500, compensating for the emotional damage, arising from the personal data security violation. |
