Mobile app Collects Children&#39;s Data We are working on a medical app for children. (Of course parents will access the application.) Is it lawful to store children's health records on a webserver? My client says it's illegal; that we should always store the data on a remote local server to protect the minor's protected information. Is this the case?
In the United States, the main statute governing the use of health care information is HIPAA, the Health Insurance Portability and Accountability Act. HIPAA and its related statutes and regulations detail what you can and can't do with medical information. You can't always collect it; if you do, you can't always share it, and you can't always delete it. This is a complex field of law and it's easy to screw up in a way that would cause big, serious, company-destroying, job-ending problems for everyone involved. To put this another way: this is absolutely, positively, not something you want to get advice on from strangers on the internet. You don't just need a lawyer; you need a HIPAA specialist--or the equivalent in whatever other countries you plan to operate in--before you push anything out to real-life patients, especially children.
How does GDPR work with insurers in relation to refusing information about pre-existing medical conditions? Due to it being special category data. As in, which of the "conditions for processing special category data" would apply? As far as I see, Article 9 (a) ("explicit consent") would apply. So the insurer would have to ask the customer for consent. My first thought was it would be consent-based (condition a), but under consent, it is noted that you should avoid making consent a precondition of service. Yes, that is often noted, but that is only partially true. The GDPR actually says (Article 7, emphasis mine): When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. So making consent a precondition of service can be ok, provided that the data is "necessary for the performance of that contract". Whether knowing about preexisting conditions is "necessary" for an insurance provider is something a court would have to decide, but on the face it does not seem unreasonable. Source: General Data Protection Regulation
Your kid is not in trouble; he's a minor. You're in trouble. A criminal case for the charges a prosecutor would bring, i.e. destruction of property (the data) or for a relevant cyber or computer crime (malware, etc.), and/or a civil case for damages due to the destruction of the data would both hinge on one point: the concept of intent. See intent - Wex Legal Information Institute and Civil Law vs. Criminal Law: The Differences | Rasmussen College. Did you knowingly intend to cause damage or data loss with the structure of the name? It's pretty clear you did. The structure of a name that can invoke an SQL command is not in any sense a standard name in spelling or format or punctuation. So how would you convince the jury or judge that you had no intent when you named your kid? The possible poor design of a data system that didn't sanitize inputs is no defense. Saying the door was unlocked so I assume the homeowners didn't care if I trashed their house will get you laughed into jail or on the hook for a stiff civil judgement.
Yes in general Generally, almost all western jurisdictions (be they civil law or common law) have some way to get medical records into evidence, be that via subpoenaing, or by discovery requests or court orders. In most cases, the party that brings the suit is also the patient or their legal representative, and they give (or imply) consent to the use of the records. And in cases where the defendant's medical records are required, usually, the defense wants those in too to prove some condition. And then there are cases where the state or their representatives brings the charge. They usually can bring a warrant or court order to obtain the documents. Then there are Medical records that had been made specifically on the behest of the state. Here, the warrant is usually filed to obtain the samples or access to the body to be investigated, the record itself forms the basis for the investigators to proceed - and is not under client-doctor confidentially in the first place. It had been made specifically for the state and it is a state-owned medical record, be they made on request of the executive power (police) with a warrant signed by a judge or on behalf of the judicative after a court order to evaluate capacity (see below). However, medical records can generally only be obtained if the records are relevant to the case at hand and only to the degree necessary: You can't request the medical records about a person's fertility status in a case that discusses damages for his broken arm. As a result, the medical record available in court might be only an extract from the original, with irrelevant passages sealed or redacted. Unlike many people think, it's quite common to get some medical records into court in some way or another: As the basis of injury cases If you have a case of physical injury, the injuries themselves need to be proven in court. This is done generally by getting the medical records - thus they can be subpoenaed by a party, usually the injured party here. Then a medical expert can discuss them, be they a court-appointed one or paid by either of the parties. In this category also fall mandatory reports of certain types of wounds or situations. As such, the treating doctor has to provide a medical report with enumerated types of injuries, like bullet wounds or where child abuse might be the reason. Very necessarily in malpractice cases Malpractice is pretty much injury on steroids: the injuring party made the records and would never want to give them up to the one suing them - if they could. Alice shall remove Appendix. It goes haywire and the day after Charly needs to cut Bob open again. Now Bob sues Alice for malpractice. Bob needs medical records from both Alice, the doctor who botched it, and Charly, who was fixing Alice's error. Generally, both records are subpoena-able to the degree relevant and necessary, and indeed the opposing medical opinions on the operation and records form the very basis of the case for either side. Without the ability to subpoena the - in this case unmodified - records from the injuring doctor, proving - or defending - a case of malpractice would be impossible: the very truth of the allegation should be in the medical records. It's routine in cases around death What is the very last medical record a person can ever get? An autopsy record! That's a very sensitive medical record, but they routinely are used in homicide cases. Oftentimes, the investigators also subpoena the medical records of the victim from their doctors to corroborate the autopsy record, while the defense might subpoena them to try and disprove it. Even in civil cases, like the OJ-Simpson civil damages case, autopsy and medical records from an accompanying criminal case can and will be &quot;pulled&quot; (copied over) from the other trial's docket. Regularly in child protection cases Whenever child protection is on the line, be them protective orders or who a child will live with after the child protection service (whatever its name is) is in on a case, then medical records are often required to bolster one side. Those records could be medical records from quite many doctors, be they physicals or psychological evaluations... Sometimes the medical records required here are only created due to court-ordered medical or psychological evaluation by a doctor. Whenever incompetence defense is called When the lawyer claims temporary incompetence or insanity, courts generally order a psychological evaluation. These medical records are evidence, but usually don't need to be subpoenaed: they have a waiver form to be disclosed to the court almost built-in. Are they available to the public? Medical records are part of truth-finding, but they are also quite sensitive. As a result, most medical records can not be gotten from the court and enter the dockets under seal. Another option is, that they enter the docket partially or even mostly redacted, with passages blackened.
I understand that storing any hash or IP that can identify &quot;user uniquely&quot; is against GDPR. That is not correct. However any data which is identifiably associated with a an individual human, including any data which could be used to identify that human, is generally &quot;Personal data&quot;, and may not be processed (which includes storing it) without a lawful basis, if the GDPR applies. Any of the six lawful bases allowed by the GDPR may be used, including consent, and the legitimate interest of the data controller. The GDPR does not generally specify that particular technological solutions are permitted or forbidden. If this usage pattern could reasonably be used to identify a particular person, or to single out a person from among a group of people, it is probably personal data, and a lawful basis would be required. Otherwise, not. As for whether such a person is &quot;identifiable&quot; if use of this technique permits the Data Controller to identify two visits at separate times as having been made by the same person, when the later visit is still in progress or is recent, the IP for that visit will still be available, and thus could be associated with the first visit as well. And even if that is not done, such a technique could permit building a profile of such a person, including the actions taken on different visits. I think that would be enough to make this &quot;personal data&quot;.
You are missing something. The fact that you have a tick box and its state is saved in the database is enough. The burden of proof is only "on a balance of probabilities", so someone arguing that they didn't consent would have to demonstrate that you falsified the database entry somehow. In terms of GDPR requirements in general you don't need a greater level of proof than this, the key thing is that you have a robust system in place to obtain proof (such as not allowing data into the database without a tick in the box).
What Big Tech is doing is spending a lot of money on lawyers and appeals – doesn't matter if it costs millions if you can make money in the meanwhile. Facebook stores a lot of user data in the US. Initially, this was allowed because the US was recognized as offering an adequate level of data protection under the Safe Harbor and later the Privacy Shield Framework. Then Schrems I and Schrems II happened and the adequacy recognition was ruled to be invalid. Does Facebook pull back their user data? No. The GDPR offers alternative reasons why you might process data in foreign countries, such as “standard contractual clauses” (SCCs) or “binding corporate rules” (BCRs). Now, Facebook claims that they are using SCCs. Is this valid? Almost certainly not due to the issues of US law analyzed in the Schrems II case, but it can take years for the next round of court cases to work its way through the system. And when Facebook's use of SCCs is ruled invalid they will probably try BCRs next, and once that is over a decade will have passed and the US might actually have achieved an adequate privacy level by then. You do not have Facebook-style money to spend on lawyers and endless rounds of appeals, so you should avoid legally risky things such as outsourcing data processing activities to companies in the US (this doesn't mean you can't be compliant if you are a US entity). I mentioned adequacy decision previously. There is a list of countries that the EU considers to be sufficiently safe. Currently, the more notable countries involve Canada, Israel, Japan, New Zealand, Republic of Korea, Switzerland, and the United Kingdom, in addition to EU/EEA countries of course. If you want to process data in a location that is OK for both the UK and the US, then looking at companies in one of these countries is a good idea. For example, if most of your users are in the US but you would like your servers to be in a country with an EU adequacy decision, then looking at Canada could make sense. Even outside of this list, you can process data if you implement additional safeguards via SCCs. However, this requires a case by case analysis of the legal environment in that country. One problem with the US is that it has national security laws that impose requirements on companies in a manner that is incompatible with SCCs. A company bound by these US laws cannot enter into such a contract where it guarantees the privacy of your user's data. Countries other than the EU have much more tedious data residency laws. The GDPR does not impose any data residency requirements in the sense that data must not leave a particular country – you just have to ensure that the data is properly protected. In contrast, Russia and China have real data residency requirements that are fundamentally incompatible with the GDPR.
My remarks pertain only to US Law. Laws vary in other countries. Subject matter eligible for copyright protection in the US must be expressive and creative. To the extent data are merely measurements of observable fact in the world, they are not copyrightable. It may be that the presentation or interpretation of data is eligible for copyright protection (for example, artwork used in charts, graphs, graphics, etc., that is expressive and creative), subject to various equitable use provisions (in particular Fair Use, which is still a legal grey area). The methods by which data are gathered can be considered IP, but is the domain of patents. Methods are not copyrightable (17 USC 102(b)).