The current State of Exception in Ecuador, requires the processing of personal data such as those related to health, with or without consent of the data subject.
The right to the protection of personal data is recognized in Article 66, number 19 of the Constitution of the Republic of Ecuador,1 as part of the freedom of individuals.
The data referring to health constitutes personal data which require the authorization of the data subject for its collection, processing and dissemination. However, the Constitution itself recognizes that exceptionally, due to the need for medical attention or the mandate of the law, people’s health data may be required and processed without their consent.2
In this context, is important to bear in mind the extraterritorial scope of the General Data Protection Regulation of the European Union (GDPR). Through which organizations (regardless of their location) offering products or services to citizens and residents of the Union, are obliged to comply with the Regulation.3 Data concerning health is a special category of personal data.
GDPR expressly prohibits processing sensitive data, such as those related to health. This prohibition does not apply in case processing is necessary for reasons of public interest.4
In consideration of the health emergency declared by Ministerial Agreement No. 126-2020, of March 12, 2020, it was ordered that the public and private network of health services maintain and update the notification of patients who present symptoms or conditions related to COVID-19.5
The declaration of sanitary emergency obliges any entity that offers health services, be it public or private, to collect, process and disseminate sensitive data such as that related to people’s health, in order to mitigate the spread of the virus in Ecuador.
Both the Constitution and the GDPR contain exceptions allowing the collection and processing of personal data under the state of emergency currently in force in Ecuador. Where a situation of public interest in the field of public health, overcomes the principle of express authorization for the use of sensitive data.
However, even in the current state of emergency, data processing must comply with the principles of purpose and proportionality. Therefore, its current treatment does not allow infringement of the rights and freedoms of individuals, such as the disclosure of information unnecessary for the fulfillment of the public health purpose.
1 ‘Article 66. The following rights of persons are recognized and guaranteed: 19. The right to protection of personal information, including access to and decision about information and data of this nature, as well as its corresponding protection. The gathering, filing, processing, distribution or dissemination of these data or information shall require authorization from the holder or a court order.’ Constitution of the Republic of Ecuador.
2 ‘11. The right to confidentiality about one’s convictions. No one can be obliged to make statements about these convictions. In no case shall it be possible to require or use, without the authorization of the holder or his/her legitimate representatives, personal or third-party information about one’s religious beliefs, political affiliation or thinking, or data about one’s health or sexual life, unless required for medical care.’, ibid, Art. 66 (11).
3 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), art. 3.2.
4 Ibid, Art. 9.2 (i) and Recital 54.
5 Ministry of Public Health, Ministerial Agreement No 126-2020, Art. 4.
Disclaimer: This document is informative and does not, and is not intended to, constitute legal advice.