An analysis of the Icelandic Supreme Court judgement on the Health Sector Database Act

Abstract

Six years after the Icelandic Health Sector Database Act came into force, the Supreme Court of Iceland as court of appeal was asked to give a judgement on the constitutionality of the Act. The appellant had unsuccessfully applied to the Director General of Public Health to prevent the transfer of her deceased father’s medical records to the Health Sector Database. The court of first instance, the Reykjavik District Court, dismissed the case for lack of legal standing. The Icelandic Supreme Court decided that the appellant had legal standing due to the fact that from the data related to hereditary characteristics of her father information about the plaintiff herself could be inferred. The Icelandic Supreme Court further discussed privacy and data protection issues with regard to the Health Sector Database, coming to the conclusion that the one-way encryption system was a sufficiently safe mechanism for data protection, but that due to the richness of data to be entered into the Health Sector Database, individuals could be identifiable.