On Friday, March 6, Peruvians received the news that we feared the most: COVID-19 had arrived in our country.

Patient zero, as initially identified, was a 25-year-old man, a LATAM airlines pilot, who likely contracted the virus during his vacation in Europe (Spain, France and the Czech Republic). The following day, six additional cases were reported (five corresponding to people close to patient zero and one in the city of Arequipa, after the patient traveled to the United Kingdom). On March 8, the number grew to eight cases (another person close to the patient zero) and thus, by April 09, 2020, the numbers reached 5,256 infected people and 138 deaths.

With this news, demands from a sector of the population and some media to fully identify infected patients began, mostly invoking public health reasons, and with this, names, statements and fake news also began to leak. This demand increased when the Peruvian government officially decided to declare the country in a health emergency.

The question that then arose was: should patients with COVID-19 be fully identified? The answer is no.

The Personal Data Protection Law (Law No. 29733), modified by Legislative Decree No. 1353, and fully in force, states in Article 13, that the limitations to the exercise of the fundamental right to the protection of personal data, must be “established only by law, respecting its essential content and being justified by reason of respect for other fundamental rights or constitutionally protected assets.”

Ergo, according to what is stated in the same Article 13, and since there is no exception established by law, the treatment of personal data could only be carried out with the prior, express and unequivocal consent of the owner of the personal data and, even more, in the case of sensitive data, such as health-related data, consent must be given in writing.

But it is also important to point out what Article 14 establishes regarding limitations on consent for the processing of personal data. In Article 14(6),  states that the consent of the data subject will not be required for processing in the following cases (among others): "in case of reasons of public interest provided by Law; or if they must be processed for reasons of public health, both qualified as such by the Health Ministry; or to conduct epidemiological or similar studies, provided that adequate dissociation procedures are applied.”

The first premise for applying limitation is the qualification of the Ministry of Health as “reason of public interest” or “reason of public health.” The second premise, which is mandatory, is that “appropriate dissociation procedures” must be applied, that is, for example, the pseudonymization of names and surnames, the assignment of numerical or alphabetic codes, “hiding” the data by crossing them out (as the National Authority for the Protection of Personal Data does in practice when it publishes the reports and queries it issues), etc.

So far, the Ministry of Health has not issued any provision in this regard and therefore, the provisions regarding the privacy of personal data of patients with COVID-19 must be respected.

For its part, the General Health Law (Law No. 26842), also clearly establishes in Article 120 that although the health information public sector entities have in their possession is in the public domain, this does not include information that may affect personal and family privacy or self-image of the individual. Furthermore, according to what is established in the Regulation of Infractions and Sanctions of the National Superintendency of Health approved by Supreme Decree No. 031-2014-SA, it is considered a serious fault to "display or disseminate images of the insured or information related to his illness" with sanctions that can go up to 1,290,000 soles (approximately $379,412).

In this regard, the Peruvian government has been informing the population about the number of people infected and the number of deaths, by only providing general data on these people. Proof of this can be seen on the website, specially enabled to inform the population about the progress of COVID-19, and where statistics are shown by department, sex and stage of life; or the press releases that are issued daily to report the number of deceased where, for example, one of the deceased is identified as follows: “A 26-year-old man entered the Eduardo Rebagliati Martins Hospital in the city of Lima when presenting a process of respiratory failure, pneumonia and infection by COVID-19.  His evolution was unfavorable, with his death occurring on March 30, 2020.”

On the other hand, the National Authority for the Protection of Personal Data has released a statement warning that the disclosure of personal data of patients with COVID-19, without their consent, is a violation of the Personal Data Protection Law, which can be sanctioned with a fine between 21,500 and 215,000 soles (approximately $6,320 to $53,800).

It has also published a guide with the steps to follow to request the withdrawal of publications on the internet that show information on the diagnosis received from COVID-19 and has invited the population to read its pronouncements in advisory opinions regarding the treatment of sensitive data. With regard to health facilities, it has released an information booklet containing technical and organizational measures to guarantee the confidentiality of the personal data of patients with COVID-19.

Finally, we must not forget that the Political Constitution of Peru, states in Article 2 that everyone has the right to privacy, honor, free development and well-being, and that “informatic services, computerized or not, public or private, do not provide information that affects personal and family privacy.”

In this sense, it is clear that it is not possible to disclose the personal data of people infected with COVID-19, nor of those who have undergone discard tests or who have already recovered. In the case of educational centers, work centers, public service centers and the like, the recommendation to follow is to adequately report the case — especially to people who would have been in direct contact with the infected person — without disclosing their personal data.

As the National Authority has already pointed out, in the above statement, "COVID-19, in addition to being a public health problem, can also bring some moral and psychological harm by revealing personal information such as name, address, photography, medical history, through the media or social networks, without the patient's consent,” and it is in our hands to avoid it.

Photo by Eduardo Flores on Unsplash