E-mail has no data security

In recent weeks, there have been conversations in Finland on several occasions about the decision of the Parliamentary Ombudsman, according to which the health care district broke the law by sending patient data unprotected by e-mail. The Ombudsman underlines that "no patient information by unprotected e-mail". Also the Data Protection Ombudsman has taken a position on the protection obligation of the data in question.

In several adjacent topic discussions, such as the opinion writings published in newspaper Helsingin Sanomat, the decision has been criticized, and it has been wrongly interpreted in such a way that the traditional post would be the only alternative. However, this is not the case; the question is how the confidentiality of e-mail must be assured.

Information security of an e-mail is at the level of a postcard. Anyone can read the message on its way. In order to communicate patient information confidentially, for example, the e-mail requires protection around itself. Just like a letter needs an envelope.

As far as the constitutional protection of communications is concerned, the sender of an e-mail, unfortunately, has no way of knowing in which country the mail is in and which country's law is obeyed. This means that the Finnish law does not necessarily provide protection for e-mail, even to its own citizens.

Many Finns have a personal e-mail account for example in Hotmail and Gmail. The mailboxes are not necessarily located in Finland, and therefore Finnish laws about the secrecy of correspondence can no longer be followed. Even the fact that an address ends with .fi does not mean that the servers are located in Finland. One has to remember that the Internet is always global.

I agree with many speakers about the fact that in modern society one must be able to communicate without queuing on the phone or waiting next to it. Communicating about confidential matters, however, is only possible with secure e-mail.

It should also be noted that in Finland the law obligates health care groups to be careful when handling patient and personal data. There is little room to diverge. If we want to improve our electronic service, the confidentiality factors must be taken into account.

Juha Lappi
CEO
Deltagon Group Oy