What does confidentiality mean in practice?

According to Article 21 of the OPCAT, NPMs have a duty to preserve confidential information and the confidentiality of personal data. Protection by the NPMs of personal data is important to ensure that the work of the NPM does not violate the privacy rights of individuals and to ensure that all individuals feel they can be open with the NPM. In practice, this means that NPMs should take measures to identify and protect confidential information, in particular when it includes sensitive personal data. 

This may include ensuring that information enabling the identification of individuals is not disclosed without their free and informed consent. This includes not sharing such information with the authorities or in public reports. NPMs should, however, have the ability to publish data about individuals where the individual has given their consent and / or when the data is anonymized, including through the use of pseudonyms. 

Explaining to individuals how the information they provide will be used is of outmost importance for their protection, as well as for building trust, particularly during interviews.   

In some situations, including when interviewing children or persons with learning disabilities or psychosocial conditions that may make obtaining consent difficult, NPMs should nevertheless do their best to explain their mandate and the use of information, including if relevant to obtain consent. 

As the SPT has noted, NPMs should assess with particular caution whether sharing information with a third party related to a particular situation or offence would inevitably involve the disclosure of personal data, or the identification of a person who has not given his or her express consent for his or her personal data to be made public.