What can happen to those who disclose sensitive data?

Before publicly revealing that she was raped and became pregnant after the crime, actress Klara Castanho, 21, had details about her situation leaked to the press and the artistic world.

On Saturday (25), the actress published on her social networks a text telling that she was a victim of sexual violence, that she became pregnant as a result of the rape and that, despite having the right to a legal abortion, she decided to carry the pregnancy to term and later deliver the child for adoption.

Klara said she decided to do the “most difficult account” of her life because there were several people commenting on her case publicly and attacking her on social media – although her name was not revealed, other information and details of the case made her identification possible.

The young woman also said that shortly after giving birth, while still under the effects of anesthesia, she was approached by a nurse who would have speculated aloud about a possible publication of the information.

Both the Brazilian Constitution and medical confidentiality rules protect patients’ health data, and a violation of privacy and secrecy such as that suffered by the young woman is illegal in many spheres.

“In a leak of health data, we have not only the issue of professional secrecy – the health professions have their own rules on secrecy – but also a moral damage is an illicit on the part of the hospital regarding the LGPD (General Protection Law of Data)”, says the lawyer and doctor in law José Luiz Toro, specialist in health law.

The consequences of the leak

Medical records and general health data are considered sensitive personal data under the LGPD, says Toro.

He explains that the leak of this information – both in the case of a famous person and in the case of someone less known – can have consequences in several spheres.

One is the professional field – doctors, nurses and other healthcare professionals have an ethical duty to keep patient information confidential.

The entities responsible for investigating situations of ethical violation by nursing professionals are Coren (Regional Nursing Council of São Paulo) and Cofen (Federal Nursing Council).

Both Coren and Cofen say they are investigating whether it was a nurse who released details about Klara’s case to the press.

Cofen released a note expressing “deep solidarity” with the actress and saying that it will take all steps to identify those responsible for the leak.

“After being a victim of sexual violence, (Klara) had her right to privacy violated, during the process of voluntary delivery for adoption, as guaranteed by the Statute of Children and Adolescents (ECA)”, says the entity.

According to the nursing code of ethics, ethical infractions can be punished with warning, fine, temporary suspension of professional practice and – in more serious cases – cancellation of registration, that is, the end of the right to exercise the profession.

The possible penalty applied in the specific case of Klara will depend on the investigations and decisions of Coren and Cofen.

Moral damages

According to José Luiz Toro, a case of leakage of health data by a professional can also give the right to compensation in the sphere of Civil Justice.

“For this to happen, the person who feels wronged would have to file a lawsuit against the professional who made the leak”, he says. “These are issues related to personality rights, to private life.”

The value of indemnities for moral damage, however, is not usually very high in Brazilian Justice – rarely exceeding R$ 100 thousand. “The jurisprudence has been modest about these values”, explains Toro.

The hospital

A hospital where health data was leaked could also face legal consequences, according to Toro.

If the victim decides to sue the hospital, the court may determine that the entity also pays compensation for moral damages.

In addition, the institution is also subject to penalties related to the LGPD. Health information is considered sensitive personal data, so it is entitled to extra protection under the General Data Protection Act, explains Toro.

If the data protection authorities understand that the institution responsible for a leak has committed a violation of the LGPD, explains the lawyer, the hospital may have to pay a fine – up to R$50 million. The money, in this case, would not go to the injured party, but to a data protection fund.

The hospital where the actress was hospitalized, in the metropolitan region of São Paulo, said in a statement that an internal investigation was opened to investigate the case reported by the young woman.

About Abhishek Pratap

Food maven. Unapologetic travel fanatic. MCU's fan. Infuriatingly humble creator. Award-winning pop culture ninja.

Check Also

At least 2 die after plane crash in California

Two planes collided in northern California while trying to land at a local airport on …