The 1988 Archive: Charter Scope, Old Records and the Privacy Confusion
Meridian Health Trust is a publicly funded hospital in an EU member state. It maintains a research registry of patient records dating back to 1988, covering roughly 600,000 individuals. The Trust now plans to link the registry to the national mortality database and to give three university research teams access to the linked dataset. Its legal adviser offers three defences: first, the EU Charter of Fundamental Rights does not bind the Trust, because the Trust is not an EU institution; second, records created before 1995 fall outside data protection law altogether, so only post-2018 entries need a lawful basis; third, data protection is simply one aspect of the right to privacy, and since the registry discloses nothing to the public, no data protection rights are engaged. The board wants a written assessment before it approves the link.
1. Is the adviser correct that the EU Charter does not bind Meridian Health Trust?
Read the worked answer
The adviser is wrong.
Article 51(1) of the Charter binds Member States 'only when they are implementing Union law'. The GDPR is a regulation directly applicable in the national legal order, and Meridian processes patient data within a framework of national provisions adopted under it - for example the Article 89(1) research derogations and any Article 9(2)(j) authorisation. That is squarely implementation of Union law, so the Charter applies to the Trust alongside the GDPR itself.
Article 1(2) GDPR and recital 4 make the link explicit: the Regulation protects fundamental rights, in particular the rights to privacy (Article 7 of the Charter) and to data protection (Article 8). Article 52(3) additionally means the Charter cannot fall below the protection offered by Article 8 ECHR.
A public hospital cannot therefore treat itself as outside fundamental rights review. National constitutional and administrative law may impose further constraints on top.
2. Assess the claim that records created before 1995 fall outside data protection law and need no lawful basis.
Read the worked answer
There is no temporal cut-off of that kind.
- The GDPR regulates processing operations carried out from 25 May 2018 (Article 99(2)); it does not exempt records because they were created earlier. Holding, linking, disclosing and deleting 1988 records are all processing happening today.
- Data protection law applied to most of the archive in any event: Directive 95/46/EC applied from 1995 and had to be transposed by 1998, and several Member States had earlier national laws.
- The age of the data changes how the rules apply, not whether they do. Article 5(1)(d) creates a continuing accuracy duty, so undated or superseded diagnoses must be flagged; Article 5(1)(e) requires a defensible retention period linked to the research purpose; Article 14 transparency becomes harder and may need a prominent public notice plus targeted outreach where contact details exist.
The sound conclusion is that the archive needs a lawful basis, a documented retention schedule and an Article 6(4) compatibility analysis for the linkage - not that it is out of scope.
3. Evaluate the argument that data protection is merely an aspect of privacy and is not engaged because nothing is disclosed to the public.
Read the worked answer
Data protection is a free-standing right, not a sub-species of privacy.
Charter Article 8 gives every person a right to the protection of personal data concerning them, with its own defined content: fair processing, processing for specified purposes and on a legitimate basis (consent or another basis laid down by law), a right of access, and a right to rectification. It also requires compliance to be subject to an independent supervisory authority. None of these elements depends on disclosure to the public or on the individual proving distress or harm.
The 'no publicity, no rights' argument therefore collapses. What actually matters here is:
- whether the health data rest on an Article 9(2) condition and the required Member State law (Article 9(2)(j) or (i));
- whether linking to mortality data is compatible with the purpose of collection (Article 6(4));
- and the level of risk, because risk drives obligations.
A 600,000-person health registry linked to mortality data is likely to be large-scale processing of Article 9 data, making a DPIA mandatory under Article 35(3)(b); residual high risk would require prior consultation under Article 36.