A patient is clothed with many rights under the Nigerian jurisprudence. Some of these rights are statutory while others are enshrined in international treaties and codes of practice.
This article will discuss the patient’s right to privacy as well as available remedies for a breach thereof.
The various statutory provisions which safeguard these rights and spell out consequences for breach will be considered. The various actions and inactions that constitute a breach of the patient’s rights to privacy will be discussed, especially given various ways in which these rights may be breached. While of course, the rights of a patient are numerous (and will be subsequently discussed in other articles), the focus of the present article will be on the patient’s right to privacy.
The best attempt to define privacy has been summarized as the right to be left alone. In other words, privacy as defined by Black’s Law Dictionary is the right that determines the nonintervention of secret surveillance and the protection of an individual’s information.
The essence of the above definition indicates that privacy has to do with how information is shared about a subject and how that subject would want his or her information to be shared, and with that, the corresponding usage of that information. It is unarguable that information in the modern digital age moves faster and is now processed in technological ways previously uncontemplated and at incredible speed, previously unimagined. This mix produces situations where individual privacy rights now stand threatened not by actions of the government, but from factors and actors from the private zones.
Hence, while Constitutional provisions and other Acts of the legislative arm envisaged the protection of private data and sensitive data from conventional breaches and the government, this article will contend that further measures are imperative. The legislature in synergy with the executive ought to step up action in their various roles to ensure a society where the subject’s privacy, especially patients’ privacy is stiffly safeguarded. The judiciary would also be encouraged to speed up the conclusion of cases bordering on infringement of privacy and mete out, where appropriate, discouraging punitive awards. Oftentimes, breaches of privacy cannot be adequately compensated solely in monetary terms. The patient, often being vulnerable and at the mercy of the medical practitioners or health care providers is often the worst for these breaches.
Relevant Legislation and International Treaties
The relevant legislation and international treaties that provide for patients’ right to privacy which will be considered include:
1. The Constitution of the Federal Republic of Nigeria, 1999 (as amended).
2. The National Health Act, 2014
3. The Nigerian Data Protection Act, 2023
4 International Treatise -the International Covenant on Civil and Political Rights, The African Charter on Human and Peoples’ Rights, The African Charter on Rights and welfare of the Child and African Union Convention on Cyber Security and Personal Data Protection
5. The HIV/AIDS Anti-Discrimination Act 2014
THE CONSTITUTION OF THE FEDERAL REPUBLIC OF NIGERIA, 1999 (AS AMENDED)
The Constitution of the Federal Republic of Nigeria in section 37 makes the right to privacy fundamental. That section provides thus, “The privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications is hereby guaranteed and protected.”
This precise protection is apt and encompassing. The privacy of citizens extends to patients, encompassing their personal information and their health data. The Nigerian Data Protection Act, 2023 underscoring the importance of a patient’s data as it relates to health, demarcated personal data from sensitive personal data and safely designated matters pertaining to health as sensitive personal data. We shall critically analyze this Act shortly. The Constitution by enshrining the right to privacy in section 37 extended this protection to patient’s privacy and made the breach of a patient’s right to privacy a constitutional matter.
NATIONAL HEALTH ACT, 2014
Another relevant statute that critically expanded and protected the patient’s right to privacy is the National Health Act.
Section 26(1) of the National Health Act makes it mandatory for health care workers to maintain a patient’s privacy.
This is important as most breaches to patients’ privacy is often committed in the first instance by health care workers.
That section provides thus:
(1) All information concerning a user, including information relating to his or her health status, treatment or stay in a health establishment is confidential.
(2) Subject to section 27, no person may disclose any information contemplated in subsection (1) unless-
(a) the user consents to that disclosure in writing;
(b) a court order or any law requires that disclosure; or
(i) in the case of a minor with the request of a parent or guardian; and
(ii) in the case of a person who is otherwise unable to grant consent upon the request of a guardian or representative.
(c) non-disclosure of the information represents a serious threat to public health.
Section 27 allows for exceptions in cases where the patient’s private data may be disclosed outside the scope allowed in Section 26. It provides for disclosure where same is in the principal interest of the patient.
Section 29 comprehensively provides for the protection of the patient’s records. It places the onus on the person in charge of the health institution to have a leak-proof and protected storage system to store the data of the patient. The penalty for failure to adhere by the above provision is a fine of N 250,000 or imprisonment for a term of 2 years or both. Apart from the above duty to provide a leak-proof storage system for patients’ data, the Act also provides other duties which the person in charge of the health institution must comply with:
These other duties include:
(a) duty not to falsify or allow to be falsified any record by adding to or deleting or changing any information contained in the record;
(c) duty not to create, change, or destroy a record without authority to do so;
(d) duty to create or change a record when properly required to do so;
(e) duty not to provide false information with the intent that it be included in a record;
(f) duty not to copy without authority, any part of a record;
(g) duty not to, without authority, connect the personal identification elements of a patient’s record with any element of that record that concerns the patient’s condition, treatment or history;
(h) duty to avoid unauthorized access to a record or record-keeping system, including intercepting information being transmitted from one person, or one part of a record-keeping system, to another;
(i) duty not to, without authority, connect any part of a computer or other electronic system on which records are kept to any other computer or other electronic system; or any terminal or other installation connected to or forming part of any other computer or other electronic system; or
(j) without authority, modifies or impairs the operation of any part of the operating system of a computer or other electronic system on which a patient’s records are kept; or any part of the programme used to record, store, retrieve or display information on a computer or other electronic system on which a patient’s records are kept:
Where the health care provider breaches any of the above duties, the penalty of N250,000 with or without 2 (years) imprisonment applies.
THE NIGERIA DATA PROTECTION ACT
After decades of a non-existent statute on data protection in Nigeria, the National Assembly finally passed, and President Bola Ahmed Tinubu signed into law, the Nigeria Data Protection Act on 12th June, 2023. Before the enactment of the Act, matters of data privacy were regulated by the Nigerian Data Protection Regulations (NDPR) 2019 and the NDPR Implementation Framework 2019. The need arose for a comprehensive document on privacy matters in Nigeria and the enactment of the Act filled that vacuum. The Act with 22 Parts and 66 sections is an elaborate piece of legislation with updated provisions on privacy. As earlier mentioned, the Act separated the definition of personal data from sensitive personal data. The Act in section 65 (the interpretation section) defined sensitive personal data as
“sensitive personal data” means personal data relating to an individual’s —
(a) genetic and biometric data, for the purpose of uniquely identifying a natural person,
(b) race or ethnic origin,
(c) religious or similar beliefs, such as those reflecting conscience or philosophy,
(d) health status,
(e) sex life,
(f ) political opinions or affiliations,
(g) trade union memberships.
As can be seen in d above, the health status of a person is deemed sensitive personal data. The question that arises is, why is health status and indeed the other data included in the list categorized as sensitive personal data?
The rationale is evident considering that such data is laden with vital information about a person which have the propensity of being used to hurt or harm a subject. The drafters of the Act, recognizing this fact rendered stiffer penalties for breach of any of the sensitive personal data enumerated in the Act, health status inclusive. While it is arguable that health status does not of course affect only patients, the fact remains that patients become primary subjects of health status protection within the contemplation of the Act. The argument remains that the word ‘patient’ is difficult to defined in any sense of finality. This is because, a patient could be anyone who has suffered some form of illness, who seeks medical attention, who has sought medical attention and is undergoing treatment. The essence of the above is that patients are persons who have interacted with a medical system and have therefore of essence exposed their sensitive personal data to the health care providers. The Nigeria Data Protection Act, made special provisions for the processing of sensitive personal data and the persons who are exposed to sensitive personal data of data subjects. Section 30 provides thus:
30.—(1) Without prejudice to the principles set out in this Act, a data controller or data processor shall not process, or permit a data processor to process on its behalf, sensitive personal data, unless the —
(a) data subject has given and not withdrawn consent to the processing for the specific purpose or purposes for which it will be processed ;
(b) processing is necessary for the purposes of performing the obligations of the data controller or exercising rights of the data subject under employment or social security laws or any other similar laws ;
(c) processing is necessary to protect the vital interests of the data subject or of another person, where the data subject is physically or legally incapable of giving consent ;
(d) processing is carried out in the course of its legitimate activities, with appropriate safeguards, by a foundation, association, or such other non-profit organisation with charitable, educational, literary, artistic, philosophical, religious, or trade union purposes, and the —
(i) processing relates solely to the members or former members of the entity, or to persons, who have regular contact with it in connection with its purposes, and
(ii) sensitive personal data is not disclosed outside of the entity without the explicit consent of the data subject ;
(e) processing is necessary for the establishment, exercise, or defense of a legal claim, obtaining legal advice, or conduct of a legal proceeding ;
(f ) processing is necessary for reasons of substantial public interest, on the basis of a law, which shall be proportionate to the aim pursued, and provides for suitable and specific measures to safeguard the fundamental rights, freedoms and interests of the data subject ;
(g) processing is carried out for purposes of medical care or community welfare, and undertaken by or under the responsibility of a professional or similar service provider owing a duty of confidentiality;
(h) processing is necessary for reasons of public health and provides for suitable and specific measures to safeguard the fundamental rights, freedoms and interests of the data subject ; or
(i) processing is necessary for archiving purposes in the public interest, or historical, statistical, or scientific research, in each case on the basis of a law, which shall be proportionate to the aim pursued, and provides for suitable and specific measures to safeguard the fundamental rights and freedoms and the interests of the data subject.
From the above, it is clear that the Nigeria Data Protection Act takes seriously the processing of sensitive personal data. The Act established stringent conditions under which sensitive personal data can be processed in line with the enlisted lawful basis. The guardrails enlisted are principally to protect the integrity of the data subject’s sensitive personal data.
Where a data subject, including a patient, has suffered from the wrongful use of his or her sensitive personal data, section 46 of the Nigeria Data Protection Act empowers the patient to approach the Nigeria Data Protection Commission. While this will of course result in a series of investigations and consequential orders, most times, the patients whose data have been breached may be interested in monetary compensation. Consequently, the Act provides in Section 51 that an aggrieved data subject, who suffers injury, loss, or harm as a result of violation of this Act by a data controller or data processor, may recover damages from such data controller or data processor in civil proceedings.
In the case of a patient, the data controller will be the medical facility wherein such a breach occurred. Recently in July, 2022, there was a massive data breach at the Plateau State Contributory Health Care Management Agency (PLASCHEMA) and thousands of sensitive personal data of citizens were exposed. Where the negligence can be established, the Act authorizes patients or data subjects generally to proceed to recover compensation in civil actions.
Hence, where a patient’s privacy is breached either by the processing of his data outside the grounds listed in section 30 of the Nigeria Data Protection Act, or where due to negligence by the data controller (which could be any individual, private entity, public Commission, agency or any other body who, alone or jointly with others, determines the purposes and means of processing of personal data), the patient is saddled with the right to pursue such entity and obtain compensation in a Court of law.
INTERNATIONAL TREATIES
THE INTERNATIONAL COVENANT ON CIVIL AND POLITICAL RIGHTS, THE AFRICAN CHARTER ON HUMAN AND PEOPLES’ RIGHTS, THE AFRICAN CHARTER ON RIGHTS AND WELFARE OF THE CHILD, AND THE AFRICAN UNION CONVENTION ON CYBER SECURITY AND PERSONAL DATA PROTECTION
These peculiar treaties serve as powerful mechanisms for the protection of patients’ privacy and other associated rights. The African Charter while not specific on privacy rights or as it concerns patients, however, have related provisions which safeguard the patients’ right to privacy nevertheless. Some of these will be considered briefly.
The International Covenant on Civil and Political Rights on the other hand is elaborate on privacy rights. It provides thus in Article 17.
1. No one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to unlawful attacks on his honour and reputation.
2. Everyone has the right to the protection of the law against such interference or attacks.
The African Charter in Article 16 provides for the right of every individual to have right to enjoy the best attainable state of physical and mental health, article 28 mandates that every individual shall be treated with respect, encompassing the protection of their private data which includes patients. Finally, Articles 4 and 5 provide for the integrity and respect to everyone. The interpretation of the aforementioned articles can be invoked to protect the patient’s right to privacy and can be relied upon in the event of a breach of this right.
The African Charter on the Rights and Welfare of the Child is another significant treaty that addresses privacy concerns. It provides that no child shall be subject to arbitrary or unlawful interference with his privacy, family home or correspondence, or to the attacks upon his honour or reputation, provided that parents or legal guardians shall have the right to exercise reasonable supervision over the conduct of their children. This provision underscores the importance of safeguarding the privacy and dignity of children, including their health and medical information, within the legal framework outlined by the African Charter on the Rights and Welfare of the Child.
However, the most profound convention on the protection of data privacy in Africa is the African Union Convention on Cyber Security and Personal Data Protection which clearly and unequivocally provides that Africa as a continent must ensure the privacy of its citizens in their daily or professional lives, while guaranteeing the free flow of information. The Convention, also known as the Malabo Convention was adopted by the African Union on 27th June, 2014. However, it is noteworthy that only 15 of 55 African states have ratified this convention and Nigeria is among those yet to ratify it. While the Nigeria Data Protection Act of 2023 aligns, with the spirit and intentions of the convention, we suggest that Nigeria should expedite the ratification of the African Union Convention. at the earliest possible time. This will expand the available options and protective legislation for the patients as it affects their privacy.
HIV AND AIDS (ANTI-DISCRIMINATORY ACT), 2024
This article will be incomplete if this critical legislation is not considered. Despite its brevity at only 18 pages with 31 sections and 4 parts, this legislation is a significant relief for patients and individuals living with HIV/AIDS.
While the Act’s main objectives as encapsulated in section 1 is to eliminate any form of discrimination against HIV patients, foster a supportive environment for HIV patients, establish a safe and enabling working and learning environment for HIV patients, the Act’s focus is to eradicate all forms of stigmatization and to ensure the protection of the HIV Patient’s status and rights.
In the above regard, Section 2 of the Act stipulates the scope of the Act’s applicability. This includes all employers of labour and employees in the public and private sectors including the Armed Forces, Nigeria Police, etc. While section 3 outrightly prohibits the stigmatization of HIV Patients section 8 prohibits the compulsory request to disclose status before accessing any public or privately delivered services, employment and any other opportunity. In essence, any request to disclose status is declared an outright breach of privacy and is declared illegal. The exemption is 8 (2) which provides that in a relationship whether marital or co-habitual, a partner has the right to be informed of the other partner’s status.
Section 9 further prohibits compulsory HIV test for employment or educational purposes. However, this may be waived with respect to an employment if 2 competent medical practitioners working independently certify to a Court that failure to take such test constitutes a clear danger of HIV transmission to others. The Act further makes it clear that such testing shall be carried out with the informed consent of subject and be guided by national guidelines on confidentiality and counselling. However, subsection 5 in a rather different twist insists that it shall not be unlawful for an employer to demand medical test for fitness for work and any other responsibility as provided in any existing law. The intendment, on a whole, may be to allow employers a free hand to be able to conduct their own medical test to ascertain the suitability of a person medically for their job role, especially in physically tasking employment. Notwithstanding the foregoing, the Act can be invoked where this testing is strictly to determine the HIV status of a person without a resort to the requirements of section 9 (1) above on the double certification to the Court.
Also instructive are sections 11 and 13 respectively which provide that no person shall disclose a patient’s HIV status to a 3rd party except with the consent of the patient or where same is required by law, and that all persons living with HIV or affected by AIDS shall have the right to the protection of their health and medical records. Section 13 (2) prescribes the penalty for the breach of the confidentiality of a patient’s privacy in this regard. It stipulates a fine of N. 500,000 for an individual and N 1million for an institution or for a term of imprisonment not exceeding 2 years or both fine and imprisonment.
Section 23 provides for a general penalty of N 500,000 in the case of an individual or N2,000,000 in the case of an institution for the breach of any provision of the Act, or imprisonment to a term not less than one year or to both fine and imprisonment. For an organization, the head or representatives of the board of the organization are to be held liable.
Ultimately, depending on the transgression, and the quantum of compensation sought, the patient will be at liberty to determine which of the two penal provisions to rely upon.
Finally, the Act in section 28 provides that nothing in the Act shall prevent a patient from seeking redress against anyone for a breach of his or her right, including the right to privacy. Section 29 grants a patient the right to proceed against the individual and the organization jointly and severally for any grievance such a patient may have.
KEY TAKE AWAY
Having reviewed the relevant pieces of legislation and treaties that impact a patient’s right to privacy, we will briefly consider what amounts to a patient’s data breach.
As earlier mentioned, a patient’s data breach will occur when a patient’s data is processed, exposed, or utilized in a manner inconsistent with the patient’s wish, or inconsistent with the legal basis for processing data. A patient’s right to privacy could be breached intentionally or unintentionally, an unintentional common breach is careless exposure of patient files at health facilities. These could also occur where health assessments are conducted in places that do not guarantee privacy e.g. hall-like consultation rooms within ear shots of other patients.
Thus whether a patient’s data is exposed on social media without his or her consent, or a patient’s data is exposed to unauthorized persons or processed on an unlawful basis, a breach would still be deemed a breach. The type of personal data breached will be taken into consideration by the Nigeria Data Protection Commission as provided for in Section 48 (6) (g) of the Nigeria Data Protection Act. Where an aggrieved party goes to Court, the Court will also be minded to take into consideration the motive or otherwise behind such breach and the nature of the data breached in reaching the award of compensation.
Therefore, notwithstanding the nature or type of breach, where a patient suffers any form of damage as a result of such data breach, the institution and individual shall be liable as every patient is saddled with an inherent right to privacy and protection of personal data, especially sensitive personal data by virtue of the Nigeria Data Protection Act.
Before we conclude with pertinent suggestions and the way forward, the fundamental question remains whether a deceased patient has the continuing right to privacy. Ordinarily at Common law, a deceased was divested of all rights and had no such entitlements. However, presently in the United Kingdom and under the European Convention of Human Rights, medical confidentiality survives the death of the patient. In Nigeria, like in the United States, the family of a deceased will be entitled to damages arising from an unwarranted use of a deceased private data. A literal interpretation of the obtainable data protection laws in Nigeria reveals that the right to privacy and protection of personal data in Nigeria does not survive the death of the data subject.
The interpretation section of the Nigeria Data Protection Act defines a data subject as an individual to whom personal data relates. The use of the word individual presupposes only living persons. Also, there is no national policy on the protection, retention, and disposal of health patients, including deceased patients in Nigeria. But this is not to imply that the family of a deceased patient cannot claim for where there has been a negative data usage or breach of the deceased’s records. What is fundamental will be that the family’s argument in such an action will be that the damaging breach will have negative effects on themselves but not with regards to the privacy of the deceased, because as explained above, the deceased’s right to privacy dies with him or her.
WAY FORWARD AND CONCLUSION
The relevant recommendations that can foster the protection of the privacy rights of patients will be highlighted below.
1. Civil actions should trail private data breaches. This can be brought by the patients themselves or on their behalf by concerned persons sequel to the Fundamental Rights (Enforcement Procedure) Rules.
2. The Courts should ensure a speedy hearing and disposal of cases that border on breach of patients’ privacy rights, to encourage other aggrieved patients.
3. The patient can report the breach to the Nigerian Data Protection Commission, as well as to the relevant professional bodies e.g. the Medical and Dental Council of Nigeria, Pharmacy Council of Nigeria, Nursing and Midwifery Council of Nigeria; and Medical Laboratory Science Council of Nigeria, depending on the individual responsible for the breach for disciplinary actions. After the prescribed penalties would have been meted out, such would serve as a deterrence to the culprit and other professionals in the sector.
4. Rapid ratification of the Maputo Protocol and enactment of a special Patients’ Right to Data Privacy Act which will comprehensively spell out obligations of handlers of patients’ data in the sector and those who may be exposed to such data. In essence, this Act will improve on the already existing legislation in this regard and erase identified lacunas. This Act should also be definitive on matters about deceased patients’ data, especially their sensitive personal data, given the potential effects of such disclosure on the deceased’s living relations.
5. The government at all levels through the relevant agencies either by themselves alone or in partnership with relevant stakeholders in the sector should embark on campaigns to educate patients on their privacy rights.
6. Finally, the Nigerian Bar Association and the Professional bodies in the sector should embark on a 2-way sensitization drive. The professionals and the handlers of the patients’ data should be sensitized on their special obligation in processing patients’ data. Also, the patients should be sensitized on their rights and available remedies for where there are breaches.
We are confident that when these measures are implemented, patients’ data in Nigeria will receive maximum protection and with it the confidence by the patients that their personal data is protected.