On 1 July 2005, the Pharmaceutical Register Act (2005:258) came into force in Sweden. The purpose behind the adoption of the Act is to entitle Apoteket AB, a governmental pharmacy company operating with monopoly on the market of selling pharmaceuticals to consumers, to register patient prescriptions for the establishment of a nationwide pharmaceutical register. Under the Act, registration of patient prescriptions can be made without the patient’s consent and the patient cannot require the exclusion of information from the pharmaceutical register. On the other hand, the registered information about patient prescriptions may only be accessed following the patient’s explicit consent and the information shall be deleted from the pharmaceutical register following a period of fifteen months. If for some reason consent cannot be provided by the patient, the information in the register may, as an exception to the main rule, be accessed by a prescriber in order to ensure accurate treatment.
The collection of prescriptions in the pharmaceutical register constitutes “processing of personal data” under the Personal Data Act. Under the Act, the main pre-condition for processing personal data is consent by the person that the processing concerns. There are, however, several exceptions to this rule under which personal data may be processed without consent. For example sensitive personal data may be processed without consent under the Personal Data Act for healthcare purposes. The Act on Pharmaceutical Registration constitutes lex specialis in relation to the Personal Data Act and the rules of the Personal Data Act will apply to pharmaceutical registers to the extent that the rules of the Pharmaceutical Register Act do not stipulate otherwise.
The purpose behind the adoption of the Pharmaceutical Register Act is first and foremost the endeavour to ensure efficient and secure healthcare. Provided that the prescriber is given access to accurate information about the patient’s use of drugs, that will, at least in theory, ensure secure and proper treatment. The Pharmaceutical Register Act only allows registration of the following categories of personal data: name, birth registration number, date of purchase, name of the drug, purchased quantity and dose. Thus, the registered information under the Pharmaceutical Register Act constitutes “sensitive personal data” under the Personal Data Act. Further, the personal data registered in the pharmaceutical register may only be processed with the purpose to: (i) achieve secure assigning of future prescriptions; (ii) prepare healthcare or treatment; (iii) supplement patient acts; (iv) facilitate the control of the assignment of drugs and (v) to facilitate patients’ use of drugs.
The registration of prescriptions can of course be regarded as a violation of personal integrity but most bodies to which the proposal was submitted for consideration during the legislative process supported it due to the obvious benefits from a healthcare perspective and that personal integrity is preserved to some extent due to the patient’s right to deny access to the registered information.