From Cayman Islands Human Rights Commission

REF: HRC-RES-CANCER REGISTRY

To: Jennifer Ahearn
Chief Officer
Ministry of Health and Culture
P.O. Box 110
Grand Cayman KY1-9000

6 March 2014

Via E-mail: h&[email protected]; [email protected]

Dear Ms. Ahearn,

As you will be are aware, the primary responsibility of the Human Rights Commission (“the Commission”) is to promote understanding and observance of human rights in the Cayman Islands. In order to fulfill this constitutional remit the Commission tries to review draft legislation whenever possible. The Commission has completed a review of The Cancer Registry Bill, 2015 (“the Draft Bill”) and we set out below our concerns and observations regarding the Draft Bill.

Over the years courts1 have reiterated that the protection of personal data is of fundamental importance to a person’s enjoyment of the right to respect for his or her private life. Self- evidently, this is particularly so in the case of medical data. Article 8 of the European Convention on Human Rights (which is extended to Cayman) reads:

“(1) Everyone has the right to respect for his private and family life, his home and his correspondence.
(2) There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.”

1 L.H. v. LATVIA
http://hudoc.echr.coe.int/sites/eng/pages/search.aspx#{%22appno%22:%5B%2252019/07%22%5D,%22itemid%2
2:%5B%22001-142673%22%5D}

The right to respect for private life contains both positive and negative obligations. The state should not only refrain from interfering with an individual’s rights, but also is also obliged actively to provide protection for an individual’s private life. Respecting the confidentiality of personal medical data is a clear principle in the jurisprudence of the Convention and at common law.

Similarly, the right to private life is also contained in s.9 of the Cayman Islands Constitution Order 2009 (“the Constitution”) which reads:

“9.—(1) Government shall respect every person’s private and family life, his or her home and his or her correspondence.
(2) Except with his or her own consent or as permitted under subsection (3), no person shall be subjected to the search of his or her person or his or her property or the entry of persons on his or her premises.
(3) Nothing in any law or done under its authority shall be held to contravene this section
to the extent that it is reasonably justifiable in a democratic society—
(a) in the interests of defence, public safety, public order, public morality, public health, town and country planning, or the development or utilisation of any other property in such a manner as to promote the public benefit;
…”

When the Cayman Islands Government is considering an interference with the Bill of Rights, or any international Convention extended to the Cayman Islands, it must assess whether:

1. the interference is in accordance with the law, and
2. “reasonably justifiable” in a democratic society (in the Convention the test is whether it is “necessary” in a democratic society).

S.19 of the Constitution (lawful administrative action) speaks to these needs in more detail indicating that:

“(1) All decisions and acts of public officials must be lawful, rational, proportionate and procedurally fair.
(2) Every person whose interests have been adversely affected by such a decision or act has the right to request and be given written reasons for that decision or act.”

The first test, “in accordance with the law”, requires that there be legal provisions authorising the interference, whilst ensuring individuals have access to the law and understand how it may be applied in practical terms. The second test, “reasonably justifiable” or “necessary” in a democratic society, requires that the interference must be based on a pressing social need and proportionate to the objective being pursued2. It is important to note that necessary does not carry the same meaning as merely useful, reasonable or desirable3.

Evidently, the objective pursued by the Draft Bill will be founded in law, and apparently the Draft Bill seeks to pursue a legitimate objective, however, it is unclear:

1. How the objective will be achieved; and,
2. Whether the objective is being pursued in a proportionate fashion.

Lack of Proportionality
Of most concern to the Commission is the apparent lack of proportionality in the data which is required to be submitted:

“Schedule 2
(1) Every report shall contain the following data –
(a) the full name and business address of the person or persons who carried out the test to which this report relates;
(b) the full name and business address of the medical doctor, dentist or examiner
who requested the test;
(c) in relation to the person on whom the test was carried out –
(i) name, alias or any other names that he is known by or may have been known by;
(ii) date of birth;
(iii) gender; (iv) ethnicity;
(v) full address, including the mailing address;
(vi) occupation;
(vii) nationality; and
(viii) length of residence in the Islands;”

The right to private and family life, indicates that “nothing in any law or done under its authority shall be held to contravene this section to the extent that it is reasonably justifiable in a democratic society – (a) in the interests of…public health…”. The Commission is unclear how much the information required in Schedule 2 is necessary “in the interests of public health”.

2 Wadham & Mountfield (2001)
3 Dudgeon v. UK (1981)

The Commission requests the Cayman Islands Government provide the public with the justification for every report to contain information such as the name, alias or any other names of the person to whom the report speaks, their date of birth (at the most the year of birth or age of the patient would seem sufficient), and their full address, including mailing address.

Whatever the goal or reasoning behind seeking the information (and assuming for a moment that the Draft Bill satisfies the other tests referred to) the Commission questions whether is it not possible to anonymise patients, perhaps by the reporting doctor assigning a unique ID number, and still achieve the objectives sought?

There must be a credible link between the purposes of collection and the information that is required for the interference with individuals’ medical privacy, without their consent, to be justified: the Government cannot just mandate the collection of this data for no good reason. The Draft Bill currently identifies no such link and, as far as we are aware, no statements have been made by Government dealing with this issue.

To summarise, can you please therefore clarify:

1. Why each piece of information sought is needed; and,
2. How the provision of each piece of information will advance the interests of public health?

Protection of Confidentiality
S.10(2) requires:

“Data provided or received by the Cancer Registry shall, where authorised, be disclosed only to persons or authorities concerned with the purposes specified in section 3, and used by such persons or authorities only for those purposes.”

S.3 indicates that:

“there shall be a registry known as the Cancer Registry for the purposes of (a) compiling a statistical record of the incidence of cancer and brain tumours; (b) providing data that will facilitate research into cancer and brain tumours and the prevention of their occurrence; and (c) providing data on the incidence of cancer and brain tumours and any consequent mortality in the Islands.”

S.15(c) allows for Cabinet to make regulations prescribing all matters that are required by the Law including “providing for persons or authorities with whom data collected in the Cancer Registry may be shared and the conditions on which the data is shared”.

These regulations are of critical importance in protecting the confidentiality of the data obtained. The Commission would encourage Legislators to ensure that the regulations are not only drafted very carefully and tightly but also created expeditiously. Given the sensitivity of the information being collected we would request that they be provided in advance to the Commission and the public for review and feedback.

The Commission notes that the requirement to put systems in place to protect confidentiality is delegated to a Registrar. No guidance is given to that individual to determine how best to do this. A number of important issues will have to be considered including:

What arrangements are proposed for ensuring the confidentiality of Reports required from medics? Reports can be made by written document – this is unnecessary and requires unsecure medical information to be transferred physically to the Registry – an obvious security risk. How will such records be stored and/or destroyed? Similarly, what arrangements are proposed for ensuring the security of medics’ computers and that of the Registry? How will Reports made by CD or storage device be transferred to the Registry? How will they be encrypted? How will these be stored and/or destroyed? It is envisaged that Reports can be sent remotely. What arrangements are proposed for the security of these communications?

All of these issues are likely to be expensive to resolve if the Registry is, genuinely, to be secure and confidentiality maintained. In this regard the Commission notes that funding of the Registry is to be by “such funds as may from time to time be appropriated for the purpose…by the legislative assembly”4. This is, with respect, wholly inadequate – funds must be guaranteed from a ring-fenced source. To do otherwise puts the security of individuals’ confidential medical data, obtained without their permission, at the whim of the LA and leaves the LA in a position where it can simply decide not to fund the continuing expenses of maintaining confidentiality.

S.10(3) creates a criminal offence:

“Any person who discloses data in the Cancer Registry without authority commits an offence and is liable on summary conviction to a fine of ten thousand dollars”.

4 S.3

If an individual discloses personal medical information collected for the Registry but which has not yet been submitted it appears that there may be no offence committed. The government should provide broader protection for individuals by closing this potential loophole.

Data Protection
Finally, the Draft Bill raises many of the issues surrounding privacy and data protection that the Commission has commented on before. The Commission notes that in the UK (which has similar legislation (although it allows individuals to opt out of providing information to be reported)) specific reference is made to data protection legislation and its applicability to reporting. The Commission again encourages the Government to ensure appropriate and comprehensive data protection legislation is enacted as a matter of priority – ideally in conjunction with or prior to the enactment of the Draft Bill.

We look forward to receiving your responses to the concerns raised above and to continuing to engage with Government on the drafting of this and other important legislation.

Yours sincerely,

James Austin-Smith
Chairman
Human Rights Commission
………………………………………………………………………..…………………………………………………
1st Floor Hospital Road, Cayman Corporate Centre, George Town, Grand Cayman
P.O. Box 391 │ Grand Cayman KY1-1106 │ CAYMAN ISLANDS
Telephone: 1.345.244.3685 Facsimile: 1.345.945.8649
Website: www.humanrightscommission.ky
END
IMAGE: blog.nohatespeechmovement.org