The belief exists that ethnic data of patients should not be recorded under privacy legislation. However, that is not necessarily correct. It is allowed, but under certain conditions. It may also be important, in order to be able to offer everyone the best possible care.
A patient’s origin can be important in the research and treatment of a medical condition. In May 2020, NOS News reported that more people are dying from the coronavirus among ethnic minorities. And in October, the head of the IC department at VU University Medical Center (VUmc) reported for radio programme Argos that the majority of coronavirus patients in ICs appear to have a migration background.
Ethnicity also plays a role in diseases other than corona. For example, diabetes is more common among people of Hindustani origin and Moroccans are more likely to suffer from thalassemia.
However, in the research and treatment of COVID-19, the National Institute for Public Health and the Environment, hospitals and local Public Health Services do not register on ethnicity. In the media it has even been stated that registration of ethnicity by hospitals is not permitted, among others by the head of IC of Leiden University Medical Center (LUMC).
Where is this misunderstanding coming from? And what is the rule?
Ethnic data extra protected
The General Data Protection Regulation (GDPR) distinguishes between ‘ordinary’ personal data and ‘special’ personal data.
Special personal data are data which, by their nature, are particularly sensitive, for example personal data revealing racial or ethnic origin, genetic data or data concerning health. Such data is subject to a stricter regime than ordinary personal data (such as name or address). The principle of the GDPR is that the processing of special personal data is prohibited. However, exceptions to this prohibition are possible.
Exceptions to the prohibition
The GDPR contains a number of derogations from the general prohibition on processing special personal data. For example, special personal data may be processed if the data subject (the patient) gives his or her explicit consent. The European GDPR also contains a number of specific exceptions that EU Member States can implement in their national legislation. In the Netherlands, the GDPR provisions on processing for the purpose of healthcare are included in the Dutch GDPR Implementation Act (UAVG).
Racial or ethnic origin
There is a specific exception for personal data revealing racial or ethnic origin. First of all, these personal data may be processed to identify someone. This is done, for example, by means of a passport photo in an identity document. Secondly, these personal data may be processed in order to give persons from a particular minority group a privileged position. An example of this is the processing by schools in order to receive subsidies to catch up with educational disadvantages of ethnic minority students. These exceptions for ethnic data are not relevant to healthcare providers.
Health data
There are five specific derogations from the prohibition on the processing of health data. Healthcare providers are allowed to process health data if this is necessary for the adequate treatment or care of the patient.
This exception only applies to health data. However, under this exception there is also a possibility to process other special personal data, such as ethnicity. The prohibition on processing other special personal data does not apply if the processing is necessary in addition to the processing of health data. The processing must take place for the purpose of ensuring good treatment or care of the data subject.
Additional special personal data may, in some cases, be essential in the identification of medical conditions. They may also sometimes have a direct impact on a treatment plan.
Data such as religion or belief may be of particular relevance in certain psychiatric disorders. In some cases, data on sexual life may also be medically relevant. The data on race may also be an important factor in making a diagnosis. In these cases, in addition to the health data, healthcare providers may also register other special personal data, despite the prohibition.
Ethnic data necessary?
The question is therefore whether ethnic registration is necessary for the treatment of the patient. In other words, can the data “race” have a direct impact on the treatment plan? If the registration of ethnicity is not of a medical nature, the exception does not apply.
Even if ethnicity is necessary for treatment in special cases, there are also points for attention. For example, the exception does not apply to the use of the registered data for purposes other than the direct treatment of patients. For example, for scientific or statistical research.
Scientific research
The GDPR has another exception for scientific or statistical research. Patients must give their prior consent. Consent is not necessary if this is impossible or if it requires a disproportionate effort. These conditions are not easily met. In addition, the research must serve a public interest and there must be sufficient safeguards to protect the privacy of the data subject.
In addition, if the doctor providing the treatment wishes to share a patient’s data with third parties for research purposes, he or she must have a reason to breach his or her professional confidentiality. This rule also applies to research carried out in a hospital by persons other than the doctor providing the treatment.
Ethnic data from corona patients
In the case of corona, it is not (yet) known whether the treatment depends on ethnic origin. This means that the first exception does not apply in the case of corona patients. In order to be able to carry out the research needed to find out whether ethnicity does indeed play a role, the patients’ consent will therefore have to be obtained.
