The strict rules of processing health related data

It has almost been 3 years since regulation (EU) 2016/679 of The European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR) first became applicable for natural persons, stating in article 9 (1) that processing of special categories of personal data – including data concerning health – shall be generally prohibited.

Naturally, the question can be asked, how can then healthcare providers process such personal data? The answer is provided by article 9 (2) of the GDPR stating the exceptions when data concerning health may be processed besides the generally stated purposes. It is important to highlight that if and when the exceptions apply so that health related data may be processed, appropriate technical and organizational measures must be implemented that can ensure the security of the special data processed. The regulations for the safety of processing are set out in article 32 of the GDPR.

These are the regulations the Budapest Capital Government Office Branch of District IX failed to observe in connection with the following incident.

On 14 April 2020, the Budapest Capital Government Office Branch of District IX. Office of Administration, Public Health Department (Department) has sent an e-mail to general practitioners’ operation in Districts XI, XII, and XXII of the capital, that came attached with an excel spreadsheet detailing the results of the Covid-19 tests administered by the National Ambulance Services, that included the personal data of 1153 patients along with their symptoms. Due to some reason however, the e-mail was not forwarded only to the GP-s as the incident was reported by private person.

Following an inquiry from the National Authority for Data Protection and Freedom of Information (NAIH) the Department has requested the advice of the data protection officer of the Budapest Capital Government Office. According to the data protection officer before sending the spreadsheet the data should have been filtered by District and sent separately to the general practitioners as they can only be informed about the data of the patients in their care. However, the data protection officer stated that they deemed that the rights of the data subjects were not endangered during the incident therefore in accordance with article 32 (1) of the GDPR the incident was not reported to the NAIH, nor were the subjects notified.

According to the NAIH the Department did not implement appropriate technical and organizational measures in accordance with article 32 (1)-(2) (such as pseudonymization and encryption) to ensure the protection of the health-related data during the data transfer. Furthermore, during the risk assessment of the incident, the Department did not consider paragraph (75) of the preamble to the GDPR that states that any data processing where health related data is processed at a large volume as well as processing g may give rise to identity theft or fraud is considered inherently high-risk. As stated by the NAIH the processing of data concerning health of 1153 data subjects constitutes as processing a large amount of data and carries a high risk according to the regulations of the GDPR. The data contained in the spreadsheet is especially extensive, that allows for patients to be individually identified and in some cases almost a concrete diagnosis can be reached using the data available. Transferring such data to third parties carries enormous risks to the personal lives of the subjects. The Department – contrary to the NAIH’s position – failed to correctly assess the severity of the incident and therefore did not comply with their obligation to report incidents to the NAIH in accordance with article 33 (1) of the GDPR and to notify the subjects about the breach in accordance with article 34 (1) of the GDPR.

As per the decision of the NAIH the Department was issued a data protection fine of HUF 10,000,000 for the handling of the incident.

Electronic signature in practice

Lately the subject of using electronic signatures comes into question more and more. Most businesses are usually somewhat familiar with the possibility of electronic signatures, however the practical aspects of signing documents electronically are less well known. Especially since contrary to the relevant pieces of legislations many institutions (such as financial institutions) still refuse to accept electronic signatures. Therefore, one can rightfully ask the question the question if we can pay electronically why can’t we sign?

The probative value of documents, that is the degree to which authorities will accept the authenticity of a document, is governed by the Code of Civil Procedure. According to this we can differentiate public documents, private document of full probative force and private documents.

Here we can mention that there are documents that do not constitute as written documents. This usually means documents that do not contain any signatures or other electronic markings that would connect them to the person mentioned in the document. Even though the Civil Code states that any statement shall be construed to have been made in writing if executed in a form with facilities for retrieving the information contained in the legal statement unaltered, and for identifying the person making the legal statement and the time when it was made, but when it comes to a simple e-mail any party can easily claim that the statement is not authentic and therefore such documents have no probative value.

Even though public documents can be made electronically as well in the scope of this summary the proper practice for government authorities is not very relevant.

According to the Code of Civil Procedure a private document is considered to have full probative force if among others:

  • the electronic document is executed by the issuer’s qualified electronic signature or advanced electronic signature based on a qualified certificate or qualified electronic seal or advanced electronic seal based on a qualified certificate;
  • the electronic document is authenticated using the authentication service reintroduced by government decree;
  • the document is executed within the framework of services provided for in an act or government decree, where the service provider clearly establishes the identity of the issuer of the document and assigns that identity to that person by providing assurance that the handwritten signature is that of the issuer; furthermore, the service provider shall make out a certificate of identity fixed in an inseparable addendum comprising an integral part of the electronic document, the addendum and the document both executed by at least an advanced electronic seal and by at least an advanced electronic time stamp.

Other public documents that do not conform to the requirements set out by the Code of Civil Procedure are not considered to have full probative force.

In summary by the regulations of the Code of Civil Procedure in order to a document to have full probative value it most conform to the following criteria:

  • the document is executed using qualified electronic signature, advanced electronic signature or seal;
  • the document is authenticated using the authentication service reintroduced by government decree (AVDH)
  • the document is executed within the framework of services provided for qualified electronic signature, advanced electronic signature, or seal.

In practice the three methods mentioned above are used as the following.

eID card (in Hungarian: eSzemélyi) electronic signature

Since 1 January 2016 everyone can request this a service as part of the new personal identity card and use it as qualified electronic signature. However, it is important to highlight that the certificate and private key issued with eID cards can only be used for signing documents intended for private use, any business, work related, or other professional use is prohibited according to governmental service provider.

Electronic signature services

As the demand for such services grows more and more companies enter the marked providing electronic signature services. The most well-known and commonly utilized domestic service providers are Microsec Zrt and its eSzigno program, Netlock Kft and its NETLOCK application, and a Hungarian startup’s application called Trustchain. When it comes to international providers the French DocuSign is the most well-known. When it comes to choosing between providers it is important to consider what do we need in an electronic signature service. Is it strictly for private or corporate use? Is there a mobile app on the right system? What other software suits are supported by the signature program? Does every party have to have the same program to sign a document?

From the services provided as an example NETLOCK has a free private use only service. ESzigno uses a service package-based subscription system that lets the user pick the appropriate bundle of features, but its focus is mostly on business use. DocuSign also does not have a free tier but allows for third parties to sign documents sent by subscribers using its service.

AVDH can be utilized by anyone who already has access to online administration website (in Hungarian: Ügyfélkapu). Apart from real-estate registry related statements or trusts and wills it can be used to sign any kind of legal statement. As a further advantage AVDH is also compatible with other forms of electronic signature. In summary this service is available for everyone who has an Ügyfélkapu access and can be used to execute documents in a manner to have full probative value.

It is important to also highlight the fact that according to the resolution of the Ministry of Justice AVDH authentication can be used to represent companies as well so managers can issue valid and applicable statements on behalf of the company using AVDH services.

In summary it is not only possible to utilize electronic signatures but more and more easy and practical as well. The AVDH service in our opinion is especially accessible and usable for either private or corporate use and can hopefully help to facilitate the acceptance of fully electronic administration in Hungary.

Certificate of completion as a pdf

Can I issue a certificate of completion online? In practice the question is often raised whether an electronic certificate of completion can be issued as a pdf document part of the invoicing process following a sale, or if are there rules that state that certificates of completion can only be issued on paper as part of an invoice.

There is no exact law or other regulation governing the issue of certificates of completion. When it comes to the sale of goods very often a delivery notice is what is used to certify the completion, as well as to issue the invoice.

Take for example a company that sells construction materials that need to be delivered to its clients’ worksites. The client pays the aggregate price for the goods delivered at the end of every month. In order to be more environmentally conscious, seller prepares the delivery notices as pdf documents generated by an application the parties mutually decided upon in their agreement. The application used ensures that the documents generated (in this case the delivery notice) cannot be later altered. The document is signed on a tablet using the client’s account thus certifying that the delivery was completed.

In summary the completion of the delivery in question is certified by a valid certificate (delivery notice) issued using a closed system, in a manner that records all the essential details of the transaction while also providing possible access to be reviewed by third parties when necessary. The closed nature of the system also ensures that the form and content of the delivery notice remains uncompromised.

Is this and adequate procedure when tax regulations are concerned? Is it sufficient to have a certificate of completion signed by the company authenticated via its account within the application?

Section (1) 166 of Act C of 2000 on Accounting (Act on Accounting) sets out the definition of accounting documents that includes certificates of completion and in our case delivery notices. According to paragraph (1) accounting documents mean all instruments drafted including electronic documents.

Section (5) 167 of Act on Accounting also states that electronic documents may be used as accounting documents, provided they satisfy the requirements set out in the Act on Accounting.

Section (3) 6:7 of Act V of 2013 on the Civil Code states that any statement shall be construed to have been made in writing if executed in a form with facilities for retrieving the information contained in the legal statement unaltered, and for identifying the person making the legal statement and the time when it was made. In the above example the notice electronically signed within the application satisfies the requirements of set out in the Civil Code.

The interpretation above is also supported by the Tax Authority of Hungary who in their resolution also advise that if no piece of legislation sets out requirements for the specific contents the certificate it’s advisable to follow due-process and include all the necessary data that could allow the certificate to serve as evidence of the completed transaction in a potential tax audit procedure.

Of course, for the sale or delivery of special goods (excise goods or dangerous goods) the interpretation above may not be applicable.