Case Summary and Outcome

On December 1, 2021, the Constitutional Court of Ecuador determined that disclosing the personal information of people vaccinated against COVID-19 did not infringe the rights of confidentiality, privacy, and intimacy. Thus by failing to deliver such information, the right to public information of the people of Ecuador was violated. The case arose after the Ministry of Public Health rejected two access to information requests filed by the Defensoría del Pueblo regarding the implementation of COVID-19 vaccination protocols because the information was confidential and its dissemination would intrude on the right to personal information of the patients. 

In its decision, the Constitutional Court held that the information on the number of vaccines purchased did not fall within the scope of confidential or classified information since it did not affect national security. Furthermore, the Court found that there were significant reasons linked to public health and legitimate general interest to disclose the personal data of vaccinated individuals, including effectively monitoring the effects and the impact on the inoculated population as well as assessing whether the distribution had been carried out in accordance to the parameters defined in the vaccination protocol. Consequently, the Court ordered the Ministry of Public Health to comply with the Defensoría del Pueblo request.

---

Facts

The Constitutional Court reviewed two requests for access to public information filed by the Defensoría del Pueblo whose facts will be detailed separately. 

Case 29-21-JI

On January 25, 2021, the Defensoría del Pueblo (Ombudsman’s Office) requested the Ministry of Public Health (MPH) and the Ecuadorian Institute of Social Security (IESS) the following information and documentation: i) a report on the arrival of vaccines in Ecuador and how many were being destined for the Province of Chimborazo, ii). a list of the persons who had received the vaccine, indicating names and surnames, citizenship card number, age and whether they belonged to a priority group, and iii). the vaccination protocol, particularly noting how it was being applied and the progress made. Two days later, the IESS indicated that the submission of the requested information was within the responsibility scope of the MPH.

On February 18, 2021, after unsuccessfully insisting on the request to the Ministry of Health, the Defensoría del Pueblo filed a lawsuit to access public information, before the Riobamba Criminal Judicial Unit, against the zonal coordinator 3 of the MPH.

On February 26, 2021, the Riobamba Judicial Unit partially granted the Defensoría del Pueblo‘s plea and instructed the MPH to comply with the submission of information regarding requests i) and iii) within eight days. Dissatisfied with the determination, the Defensoría del Pueblo appealed.

On March 17, 2021, the Specialized Criminal Court of the Provincial Court of Chimborazo granted the appeal and ordered the MPH to provide, within eight days, the Defensoría del Pueblo an answer for all three issues raised in the request. 

On March 31, 2021, the Riobamba Judicial Unit referred the case to the Constitutional Court. 

On April 5, 2021, given that the MPH had failed to deliver the requested information, the Defensoría del Pueblo pleaded with the Riobamba Judicial Unit to use any means necessary so that the MPH complies with the ruling issued by the Provincial Court of Chimborazo. Three days later, the Riobamba Judicial Unit ordered the MPH to deliver the information in accordance with the judgment of March 17, 2021.

Case 34-21-JI  

On February 4, 2021, the Defensoría del Pueblo, through an access to information request, asked the Zonal Coordinator 3 of the Ministry of Public Health for the following information and documentation: i) The number of vaccines that had arrived in the region and if the process of vaccinating the population had been initiated, ii) A list of the people who had received the vaccine, indicating names and surnames, citizenship card number, age, and whether they were health personnel or senior citizens, and iii) the Vaccination Protocol employed in the District, how it would be carried out, and the progress made.

After unsuccessfully insisting on its request, the Defensoría del Pueblo filed a lawsuit, to access public information, before the Ambato Civil Judicial Unit against the Zonal Coordinator 3 of the MPH.

On February 26, 2021, the Judicial Unit of Ambato granted the Defensoría del Pueblo’s claim and ordered the MPH to supply all the requested information within eight days. On March 2, 2021, the Judicial Unit denied the appeal presented by the MPH. 

On March 9, 2021, the Judicial Unit referred the file to the Appellate Court after the Defensoría del Pueblo had pointed out that the MPH had failed to submit the information.

On April 14, 2021, the Specialized Civil, Commercial, and Labor Court of the Provincial Court of Justice of Tungurahua admitted an appeal filed by the MPH and revoked the Judicial Unit of Ambato’s decision of February 26, 2021. Consequently, the Defensoría del Pueblo filed an extraordinary protection recourse. 

On July 1, 2021, the Admission Chamber of the Constitutional Court admitted the recourse. 

---

Decision Overview

The main issue for the Court to analyze in this case was whether the requested information by the Defensoría del Pueblo constituted public or confidential information.  

The Court highlighted that the Defensoría del Pueblo had requested information regarding i) the report on the arrival of vaccines and the number of COVID vaccines, ii) the vaccination protocol, and iii) a list of people who received vaccines indicating their names and surnames, citizenship card numbers, age, and whether they were health personnel or elderly persons.

In turn, the Court noted that the MPH had repeatedly argued that it was impossible to provide the requested information because of its confidential nature and the need to protect the right to personal information of the patients. 

The Court recalled that the initial phase of the vaccination process (phase 0) sought to administer the first batch of vaccines in Ecuador to the frontline workers, elderly people in public nursing homes, and their caregivers. The Court pointed out that in the context of the pandemic, access to information was essential for citizens to have a say in the implementation of public health policies.

The Court stated that Article 18 of the Constitution defines the right to access information as one that allows citizens to seek and receive truthful, verified, timely, contextualized, and uncensored information of general interest. It also emphasized that according to this constitutional precept, the confidentiality facet of information is only applicable in cases expressly provided by law. Furthermore, the Court pointed out that the Transparency and Access to Public Information  Organic Law states that the principle of publicity governs the right to access information, which means that all information emanating from or held by public or private institutions, that are concessionaires of the State or in those in which the State partakes, is shared, except for the exceptions established by the law.

The Court noted that through its case law, it had defined public information as that which is in custody, administered, produced, or possessed by the State, as well as the information possessed by private parties that provide or administer public services or funds —only concerning such services or funds— and that the State is obliged to manage in compliance with its functions. Furthermore, the Court pointed out that classified and confidential information are exceptions to the disclosure of public information. The Court explained that the first is based on national security, whereas the second is founded on the State’s obligation to protect individuals’ right to privacy and intimacy. 

Considering the criteria and normative standards previously mentioned, the Court examined each piece of the information requested by the Defensoría del Pueblo.

i) Information regarding the number of COVID vaccines that arrived in Ecuador and the amount of COVID vaccines purchased

The Court stressed that the information requested by the Defensoría del Pueblo did not fall within the definition of confidential or classified information since it did not concern national security. Likewise, the Court emphasized that since the vaccines were obtained through a procurement process, according to the National Public Procurement System, the information related to their acquisition was subject to auditing and control processes by the control authorities and the public, making it information of public interest. Consequently, the Court determined that the number of vaccines that arrived in Ecuador and were acquired by the government was public information and should be provided to the Defensoría del Pueblo. In addition, the Court pointed out that the principle of publicity and transparency meant that the authorities had to make the information available and easily accessible and delivered when requested by individuals. 

ii) The vaccination protocol

The Court noted that the pandemic’s context was of public and national interest and emphasized that the criteria and technical procedures regarding the vaccinations of priority groups did not fall within the confidentiality exception since the information did not pose a risk to the privacy or intimacy of anyone. Consequently, it ordered the MPH to deliver the vaccination protocol. 

iii) A list of individuals vaccinated, indicating their names and surnames, citizenship card number, age, and if they were health personnel or elderly people

The Court held that an individual’s status as a patient was irrelevant concerning the publicity of the information. Instead, the Court noted that the individuals’ medical records should be taken into account. In this regard, the Court remarked that medical records constitute sensitive data that involve intimate aspects of an individual’s health information and are protected by the principle of confidentiality. Nevertheless, the Court stressed that since vaccines are applied to healthy people they can’t be considered prima facie patients. Accordingly, the Court determined that the MPH’s argument was insufficient to consider that the data of the vaccinated persons were confidential based on their status as patients. 

Subsequently, The Court highlighted that the names, surnames, and ID numbers are data that allow identifying a person, and are information that is not necessarily confidential since it is already accessible in public records. For the Court, this was a clear example of how personal data can be public or confidential depending on the specific case and its use. Therefore, to determine whether the measure taken by the MPH —of not delivering the personal information— was proportional, the Court proceeded to weigh the rights in tension: privacy and confidentiality against the right to access information in the context of the pandemic. 

First, the Court noted that the measure had a constitutionally recognized purpose since restricting public servants’ release of confidential information aims to protect people’s rights to privacy and intimacy.  Second, the Court noted that by non-disclosing the information, the MPH sought to protect the people’s right to identity, which was an appropriate measure conducive to preventing the public knowledge of personal data.

Regarding the necessity of the measure, the Court pointed out that if its purpose was to protect the right to identity, the MPH could have provided the requested data without supplying names and surnames, which would have allowed the Defensoría del Pueblo to audit the execution of vaccination in phase 0. In this sense, the Court considered that since there was a less burdensome measure, denying the delivery of the totality of the information was unnecessary.  

Regarding the proportionality of the measure, the Court considered whether personal data protection justified the restriction of access to information.  The Court pointed out that, as a general rule, the protection of personal data prevents access to data that pertains only to individuals but noted that the law allows disclosing this information in certain circumstances and under specific parameters. 

Remarkably, the Court noted that according to Article 9 of the Personal Data Protection Organic Law, information and personal data might be delivered when there is a legitimate interest. defined as that which is based on the fulfillment of the public interest or the exercise of public powers expressly derived from a law subject and in observation with international human rights standards applicable to the matter. Furthermore, the Court indicated that Article 8 of the Law specifies that, as a general rule, the concerned individuals’ consent is required to disseminate their personal data. Nevertheless, it argued that in situations such as when the information concerns medical patients, the requirement of consent could be dispensable when scientific research is being carried out since the information has a significant social value.

Regarding access to information on the personal data of the vaccinated individuals, the Court stated that the government, for scientific or epidemiological reasons, determined the parameters under which the vaccination plan would be executed, including the distribution of the vaccines among the population. To successfully carry out the latter, in light of the scarce supply of vaccines, the vaccination had to previously determine who were the individuals who met the established criteria. Therefore, the Court noted that the names of the beneficiaries were necessary to decide whether they were properly targeted according to their mortality risk and the degree of exposure to the virus in their professional activities. 

Additionally, in terms of scientific information and epidemiological analysis, the Court underscored that it was essential to monitor the effects and the impact on the inoculated population and to guarantee that they received full doses. Notably, the Court pointed out that there had been public complaints of an arbitrary application of vaccines to people who did not meet the prioritization criteria. Therefore, it emphasized that only through the dissemination of the information regarding who had effectively received the shots would it be possible to assess whether there had been fraudulent or undesirable omissions in the distribution of the vaccines. 

Consequently, the Court found that there were significant reasons linked to public health —and a legitimate general interest— to disclose the personal data of vaccinated individuals to satisfy the right to access information. It especially noted that the degree to which the right to confidentiality was limited was minimal while not disclosing the aforementioned information would breach the right to public information of the Ecuadorian people to a higher extent.

As a result, the Court ordered the MPH to deliver to the Defensoría del pueblo within one month of the decision, the following information regarding the provinces of Chimborazo and Tungurahua: i) The number of vaccines that arrived to Ecuador in phase 0 and their distribution by region, ii) A list of the individuals who received the vaccine in phase 0, indicating their names and surnames, ages, if they are health personnel and/or older adults, without having to provide the citizenship card number of the vaccinated persons, and iii) the vaccination protocol used in phase 0. 

---