1. The processing of health-related personal data is prohibited.
2. The following cases form exceptions on the prohibition of processing of medical data:
   • if the data subject has given his written consent to the processing of those data, on the understanding that the consent may be withdrawn by the data subject at any time; the King may lay down in a decree agreed upon in the Council of Ministers after advice of the Commission for the protection of the privacy, in which cases the prohibition of processing health-related data may not be lifted by the explicit consent of the data subject;
   • if the processing is necessary for the realisation of an objective laid down by or by virtue of the law in view of the application of social security;
   • if processing is necessary for the promotion and protection of public health, including examination of the population;
   • if processing is made obligatory by or by virtue of a law, decree or ordinance for reasons of an important public interest;
   • if processing is necessary to protect the vital interests of the data subject or another person, provided that the data subject is physically or legally incapable of giving his consent;
   • if processing is necessary for the purposes of preventive medicine or medical diagnosis, the provision of care or treatment to the data subject or to one of his relatives, or the management of health-care services operating in the interest of the data subject, and if those data are processed under the supervision of a health professional
3. Health-related personal data shall only be processed under the responsibility of a health professional, except for the written consent of the data subject or if the processing is necessary for the prevention of a concrete danger or for the suppression of a specific criminal offence.
   The health professional and his appointees or agents shall be obliged to secrecy with regard to the processing of personal data.
   Health-related personal data shall be collected from the data subject.
4. The data subject has the right to obtain from the controller:
   1. confirmation as to whether or not data relating to him are being processed and information at least as to the purposes of the processing, the categories of data concerned, and the categories of recipients to whom the data are disclosed;
   2. communication in an intelligible form of the data undergoing processing and of any available information as to their source;
   3. knowledge of the logic involved in any automatic processing of data concerning him in the case of automated decisions referred to in Article 12bis;
   4. knowledge of the possibility to lodge an appeal referred to in the Articles 12 and 14 and, possibly, to consult the public register referred to in Article 18.
5. For that purpose the data subject shall submit a signed and dated request to the controller or to any other person indicated by the King.
   The information shall be communicated immediately and no later than forty-five days after receipt of the request.
6. Nonwithstanding the right to access his medical file any person has the right to get knowledge of the personal data that are processed relating to his health, either directly or with the assistance of a health professional.
   Upon request of the controller or of the data subject, communication may be done through mediation of a health professional who has been chosen by the data subject.
   If there is apparently no risk of offending against the privacy of the data subject and if the data are not used for taking measures and decisions with regard to an individual data subject, communication may be postponed if the health-related data are processed for purposes of medical scientific research, yet only to the extent that communication would interfere seriously with the research and no later than the moment on which the research is terminated.
   In that case the data subject must have given in advance his explicit consent to the controller that the personal data relating to him may be processed for purposes of medical scientific research and that communication of the personal data relating to him may be postponed for that reason. No effect shall be given to a request but after expiration of a reasonable period of time, counting from the date of a prior request of the same person that has been answered or from the date on which the data have been disclosed to him on own initiative

Top