Medical data as personal data – rules of their processing Review article

Abstract

This article presents main rules of the General Data Protection Regulation (GDPR) and explains its application to the healthcare sector. It starts with description of legal nature of the aforementioned regulation as the act of the European Union law and then indicates which entities in the medical sector should be considered the controller of personal data. Then, the notion of personal data processing is discussed in more detail, taking into account the specific features of medical data. Subsequently, the general principles of protection of personal data and their application in healthcare sector are outlined. These include: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation as well as integrity and confidentiality.