Polish health ministry fined for disclosing doctor’s personal health data under previous government

Poland’s data protection agency has fined the health ministry 100,000 zloty – the maximum possible penalty – after its head publicly disclosed the private health information of a doctor who had criticised new regulations introduced by the minister.

The minister in question, Adam Niedzielski, was widely criticised in August for revealing that the doctor had prescribed himself psychotropic drugs. Niedzielski resigned soon after and the Law and Justice (PiS) government he was part of left office last month.

For more on the controversy that led to the health minister’s resignation, see our report from yesterday https://t.co/l8aFTjv3SV

— Notes from Poland 🇵🇱 (@notesfrompoland) August 8, 2023

“The health minister, being the administrator of the data processed in the electronic system, extracted data from it and published it on a social media site,” wrote the Personal Data Protection Office (UODO) when announcing its decision on Friday.

“The entry contained information about a doctor who had given himself a prescription for a psychotropic drug. Thus, the health ministry unlawfully disclosed data about this person’s state of health,” added the statement.

In its decision, UODO noted that personal information protection was breached not only because it was publically disclosed but also because it was additionally distributed via Whatsapp in a breach of security protocols.

Prezes Urzędu Ochrony Danych Osobowych nałożył 100 tys. zł kary na Ministra Zdrowia za ujawnienie danych o stanie zdrowia jednej z osób. pic.twitter.com/ktDCtRB8Gr

— Urząd Ochrony Danych Osobowych (@UODOgov_pl) December 22, 2023

“The owner of this communicator has already been sanctioned by the Irish supervisory authority for, among other things, lack of transparency in the processing of personal data,” read the UODO’s statement.

UODO noted that its findings indicate the “intentional nature of the breach” and that the administrator did not take “appropriate action” after the incident, “such as apologising to the doctor, expressing regret, or publicly acknowledging the mistake” other than removing the post from social media.

The deputy president of UODO, Jakub Groszkowski, noted that 100,000 zloty (€23,000) is the highest possible penalty for a public entity. “If it were not for the statutory limit, it would have been significantly higher,” he said.

Izabela Leszczyna, the health minister in Poland’s new government, which took office earlier this month, has decided that the ministry will take legal action to ensure that the fine is paid by Niedzielski himself rather than the ministry, reports the Polish Press Agency (PAP).

“The health ministry paying the fine would mean that taxpayers would pay for Adam Niedzielski’s actions,” the ministry told PAP.

Wpis Adama Niedzielskiego. 100 tysięcy zł kary. Jest reakcja Ministerstwa Zdrowia#PAPinformacje https://t.co/eDz2QvMoBJ@MZ_GOV_PL

— PAP (@PAPinformacje) December 22, 2023

Main image credit: Swedish Presidency of the Council of the EU / flickr.com (under CC BY-ND 2.0 DEED)

Alicja Ptak is senior editor at Notes from Poland and a multimedia journalist. She previously worked for Reuters.