This should not be considered blanket license to collect and process any and all sensitive information. But there is no implied right to use the information for any other purpose without the informed consent of the patient. This requirement may seem easy to meet if there is no patient identifier, but care may be required to ensure that a patient could not be identified through descriptive material together with the healthcare practitioner or facility identifier. As a result, there may be an implication that computer systems will have to be modified to record patients giving and refusing permission for the processing of nonessential information and to be able to show when information has been passed to other parties. There does not seem to be a requirement to catalog where individual items of information may have been sent, but there is a need to identify third parties who have received information for processing, particularly if an error has to be corrected.
Patients also have a number of rights.
Such requests must be answered in a reasonable time frame. Another right is the correction of wrong information and the deletion of information that is improperly obtained. Finally, if a patient is not treated reasonably, or their legitimate complaints are not handled, or if they suffer harm as a result of infringing activities, they will be entitled to ask the courts for relief and damages. Processing Sensitive Information Article 8 of the Directive identifies special categories of information as sensitive. Normally these must not be processed unless there is a need created under employment law, rights, and duties for antidiscrimination or health and safety.