Registration for medical examinations must take into account data protection principles

Simplifying and accelerating registration for health care services and facilitating access to information on available appointments’ dates– these are the main assumptions of the draft amendment to the Act on Publicly Funded Healthcare Benefits and other acts, which provides for the creation of a central registration for medical examinations and doctor appointments. This system will use new technologies, which is why, according to Mirosław Wróblewski, President of the Personal Data Protection Office, solutions in this area must take into account personal data protection as provided for in the GDPR provisions.

The new regulations proposed by the Ministry of Health assume the use of new technologies to process health information, as well as to process the voice of callers for registration. The adoption of such solutions should be subject to a data protection impact assessment.

Comments on these solutions were submitted by the President of Personal Data Protection Office to the Minister of Health.

The draft envisions conducting a central electronic registration, for purposes of which the following will be introduced by means of an IT system:

• personal data of natural persons,
• including potentially biometric data, i.e. resulting from special technical processing since a voice assistant is to be employed

The drafter envisions the automation of telephone calls concerning registration using the so-called voicebots. The President of the Personal Data Protection Office therefore raised doubts as to whether biometric data, i.e. the caller's voice, would also be processed. In his comments on the draft amendment, the President of the Personal Data Protection Office pointed out that automated processing of data, including biometric data, is an invasive form of personal data processing. In such cases, the risk of violation of the rights and freedoms of recorded persons is very high. Analysis of the unique biometric feature, which is the human voice, allows not only to identify it, but can help determine, among others, its emotional state, diseases, age and sex. It should be borne in mind that automatic data processing using so-called voicebots is in fact a tool supported by artificial intelligence. As a part of voice assistant system, therefore, there may be special processing of the voice of natural persons being the system’s users.

The President of the Personal Data Protection Office also reminded that health data and biometric data - in accordance with Article 9(1) GDPR – belong to special categories of data, so it should be noted that their processing requires a special regime both when regulating and when applied in practice. Such data may only be processed where it is necessary for specific purposes for the benefit of individuals and the general public and provided that the safeguards required by Article 9 (2) and (3) GDPR are in place.

However, the drafter has not specified which specific categories of data, including health data, will be processed. In the opinion of the President of the Personal Data Protection Office, it creates a risk of processing redundant personal data in the envisioned system.

Due to the fact that data relating to the new medical registration system are to be processed using artificial intelligence tools, the President of the Personal Data Protection Office pointed out that the proposed solution should also be assessed from the point of view of the Artificial Intelligence Act, including the need to conduct a fundamental rights impact assessment referred to in Article 27 AI Act.

The details concerning the comments of the President of the Personal Data Protection Office addressed to the Minister of Health, can be found in the attached document below.

DPNT.401.101.2025