The Portuguese government intends to present to the Parliament a government bill regarding the creation of an electronic National Cancer Registry, or RON, consisting of the collection and analysis of data from all cancer patients diagnosed and/or treated in national territory, in public and private health establishments and services, regardless of their legal nature.

The bill comes despite concerns of the Portuguese Data Protection Authority (CNPD), which has already expressed concerns in an opinion on a similar government bill on Aug. 16, 2016 (see, Opinion nº 28/2016).

Characteristics of data processing

The purpose of RON is to collect and analyze data from all cancer patients diagnosed and/or treated in Portugal (mainland and the autonomous regions of Azores and Madeira), to allow the monitoring of the activity performed by the institutions and the effectiveness of organized screening, the epidemiological surveillance, to monitor the therapeutic, research and to monitor the effectiveness of medicines and medical devices (Article 2), integrating into the RON the data currently available in the existing Regional Cancer Registries (Article 3(2)(3)).

The collected data includes gender, birth year, location, National Health Service user number, institution identification, clinical process number, profession, place of birth, but also information such as the date and results of the diagnosis and staging exams, the International Classification of Diseases code corresponding to the diagnosed neoplasia, the characterization of the neoplasm, the dates of diagnosis and of treatment beginning, the characterization of each treatment line, the annual registration of the general condition of the patient, the state and changes of the neoplasm, indicating the best response obtained at the end of each line of treatment, date of death and the cause of death.

The access to RON will be made through a platform available in the National Health Service Informatics Network and different access profiles will be established and subject to a strong authentication mechanism, with digital identity certification, and logs are foreseen for all operations carried out in the RON.

The project imposes anonymization within 15 years from the date of death of the patient, regulating also the rights of the data subject regarding access, rectification and elimination.

CNPD Opinion

CNPD considered that the creation of a central register with such characteristics represents a very high risk of exposure for patients’ privacy and, because of the nature of the information, of discrimination — namely in the employment context, in contractual contexts (particularly those involving banking and insurance companies), and also in the field of social relations. This last is greater as such information has special economic value and can affect not only the data subjects but also their families (in the case of cancers with genetic incidence). (Opinion available here in Portuguese.)

The government did not carry out an assessment regarding the impact this political option would have on the fundamental rights of the data subjects. A privacy impact assessment would have allowed clear conclusions on such impact and would have resulted in solutions, especially technological ones, which, without affecting the purpose of the register, could have safeguarded at least the identity of cancer patients.

Despite the absence of the data category "name," the collection of two other data categories are very sensitive, as they enable the identification of the data subject: the NHS user number and the clinical process number.

CNPD also calls attention to the heading of Article 6, which refers to the “data controller” entity, and the article itself, which refers to the "entity responsible for the database administration." These are two distinct concepts. “Data controller” must be effectively identified in the law, while the "entity responsible for the database administration" is a mere technical function. Therefore, the CNPD recommends rewriting Article 6.

Also, the possibility of different profiles of users (Article 7(2) of the bill creates seven types of profiles) being able to extract unidentified aggregated data reports does not eliminate the associated risk because several elements may identify the data subject, namely, the NHS user number and the clinical process number. Meaning, such reports need to be purged of that data.

Additionally, the CNPD has concerns about the coordination of the RON with other databases, in particular with other European cancer registries. Since the coordination would always involve the treatment of sensitive data, it would require CNPD prior authorization, which means that the wording of the text must be amended, replacing "favourable opinion" with "authorization."

Finally, on the contents of Article 14 on right of access and rectification, the CNPD understands that it is the data controller’s legal obligation not to treat personal data in a manner incompatible with the purpose of the RON, therefore keeping the personal data accurate and, where necessary, up-to-date; thus, it makes no sense to demand from the data subject a written request to the have their personal data rectified.

Conclusion

On the one hand, we have the CNPD recommending the government change the bill's wording, in particular, Articles 4 (data collection), 6 (entity responsible for the processing of personal data), 7 (access), 11 (data anonymization and retention), 14 (right of access and rectification) and 16 (interoperability with European cancer registries).

And on the other hand, the government considers that "CNPD's opinion is obviously important, but the Assembly of the Republic is sovereign in the legislative process," meaning that the government bill will follow its way to Parliament.

The coordinator of the National Cancer Program considered the the CNPD's request as raising "excessive and disproportugueseionate obstacles" since "it is not a registry open and accessible to the general public," adding, "the registry is extremely necessary to understand the portugueseuguese oncological reality," and stressing that this proposal "is similar to what is already in force in many other countries"and follows "the recommendations of the World Health Organization."

For now the bill is in the Parliament's Health Commission. We will see how things progress when the Parliament discusses the bill, which is expected before the end of the current legislative session.

photo credit: Debarshi Ray Lisbon via photopin (license)