5.  The applicant was born in 1960. 6.  Between 1989 and 1994 the applicant worked on fixed-term contracts as a nurse in the polyclinic for eye diseases in a public hospital. From 1987 she paid regular visits to the polyclinic for infectious diseases of the same hospital, having been diagnosed as HIV-positive. 7.  Early in 1992 the applicant began to suspect that her colleagues were aware of her illness. At that time hospital staff had free access to the patient register which contained information on patients’ diagnoses and treating doctors. Having confided her suspicions to her doctor in summer 1992, the hospital’s register was amended so that henceforth only the treating clinic’s personnel had access to its patients’ records. The applicant was registered in the patient register under a false name. Apparently later her identity was changed once again and she was given a new social security number. 8.  In 1995 the applicant changed her job as her temporary contract was not renewed. 9.  On 25 November 1996, the applicant complained to the County Administrative Board (lääninhallitus, länsstyrelsen), requesting it to examine who had accessed her confidential patient record. Upon request, the director in charge of the hospital’s archives filed a statement with the County Administrative Board, according to which it was not possible to find out who, if anyone, had accessed the applicant’s patient record as the data system revealed only the five most recent consultations (by working unit and not by person) and even this information was deleted once the file was returned to the archives. 10.  In its decision of 20 October 1997 the County Administrative Board held that:
“Section 12 of the Patient’s Status and Rights Act (laki potilaan asemasta ja oikeuksista, lag om patientens ställning och rättigheter) provides that the health authorities and staff have to comply with the regulations issued by the Ministry for Social Affairs and Health (sosiaali- ja terveysministeriö, social- och hälsovårdsministeriet, “the Ministry”) when preparing and processing patient records. Pursuant to this section the Ministry has issued, on 25 February 1993, Regulation no. 16/02/93.
In the said Regulation it is noted that patients records must be prepared having due regard to the secrecy regulations and the protection obligation and the duty to take care pursuant to the Personal Files Act (henkilörekisterilaki, personregisterlagen; Act no. 471/1987). According to the duty to take care, precaution and good registering practices must be observed when gathering, depositing, using and delivering data and these must be done in a manner so as not to infringe unnecessarily the right to privacy of the registered person or his or her benefits and rights. The protection obligation means that data in patient records must be duly protected against unauthorised processing, use, destruction, amendment and theft (sections 3 and 26 of the Personal Files Act).
In the said Regulation it is also noted that the patient records must form an entity to ensure that outsiders cannot gain unauthorised access to them and that, in addition to the said obligations, in accordance with the Personal Files Act, the purpose of use of the said data can be taken into account. This way it can be made sure that requisite patient data are only given to the personnel participating in the treatment of the patient.
[The applicant] has in her representations alleged that [X], who is working for [the hospital] has ordered up the case history of [the applicant’s ex-husband] and that someone else has ordered up her file or visited the archives and read her file and/or that of [her son] and that the data have been transmitted to [Y] and other staff mentioned in [the applicant’s] representations.
[X] has contested having proceeded erroneously. The other persons mentioned in [the applicant’s] representations have contested having had knowledge of the data mentioned therein concerning [the applicant] and her family.
According to the director in charge of [the hospital’s] archives it is not possible to retroactively clarify the use of patient records. The data system reveals only the five most recent consultations (by working unit and not by person) but this information is deleted once the file has been returned to the archives.
Therefore, the County Administrative Board cannot further rule on whether information contained in the patient records has been used by or given to an outsider.
Having regard to the foregoing, the County Administrative Board however finds that the system should record any consultation of patient files as a safeguard of privacy in order to ensure that the responsibility for a possible leak of information can be individualised. For the future, the County Administrative Board draws the hospital’s attention to the protection obligation and the duty to take care provided by the Personal Files Act, and further, to the need to ensure that privacy protection is not put at risk when processing medical data within the hospital. ...” 11.  Subsequently, in March 1998, the hospital’s register was amended in that it became possible retrospectively to identify any person who had accessed a patient record. 12.  On 15 May 2000, the applicant instituted civil proceedings against the District Health Authority (sairaanhoitopiirin kuntayhtymä, samkommunen för sjukvårdsdistriktet), which was responsible for the hospital’s patient register, claiming non-pecuniary and pecuniary damage for the alleged failure to keep her patient record confidential. 13.  On 10 April 2001, the District Court (käräjäoikeus, tingsrätten), having held an oral hearing, rejected the action. Having assessed the evidence before it, including five witness statements, the decision of the County Administrative Board and a statement of the Data Protection Ombudsman (tietosuojavaltuutettu, dataombudsmannen), the court did not find firm evidence that the applicant’s patient record had been unlawfully consulted. 14.  The applicant appealed to the Court of Appeal (hovioikeus, hovrätten), maintaining her claim that the hospital had not complied with the domestic law, in breach of her right to respect for her private life. 15.  On 7 March 2002, the Court of Appeal, having held an oral hearing, considered that the applicant’s testimony about the events, such as her colleagues’ hints and remarks about her HIV infection, was reliable and credible. Like the District Court it did not, however, find firm evidence that her patient record had been unlawfully consulted. It ordered the applicant to reimburse the respondent’s legal expenses before the District Court and the Court of Appeal, amounting to 2,000 euros (EUR) and EUR 3,271.80 plus interest, respectively. 16.  In her application for leave to appeal to the Supreme Court (korkein oikeus), the applicant claimed inter alia that there had been a violation of her right to respect for her private life. 17.  On 23 December 2002 the Supreme Court refused leave to appeal.