On 20 April 2023, Advocate General Emiliou issued his opinion in case C-307/22 (FT v DW – Data access request aiming to receive a copy of all medical records free of charge), pending before the Court of Justice of the European Union (“CJEU”).
The background of this case and national proceedings
In brief, DW suspected that he received inadequate improper dental treatment from FT and requested FT to provide a copy of all medical records concerning him, free of charge. FT took the view that a copy of the medical records should be provided only if the patient reimbursed the costs.
FT lodged an appeal before the German Federal Court of Justice against the judgment holding that the fact that DW requested the information to verify whether he would have claims under medical liability law did not nullify his rights under Article 15 of the GDPR.
During the appeal proceedings, the German Federal Court of Justice observed that (i) under the provisions of national law, FT is not obliged to provide DW with copies of the medical records concerning him free of charge, but (ii) however, DW’s right to have them provided free of charge could arise directly from Article 15 (3) of the GDPR, read in conjunction with Article 12 (5) thereof. Thus, the German Federal Court of Justice referred several questions to the CJEU for a preliminary ruling.
The AG Opinion
In a nutshell, the AG proposes that the CJEU answers the questions submitted for a preliminary ruling in this case as follows:
- Articles 12 (5) and 15 (3) of the GDPR must be interpreted as requiring a data controller to provide the data subject with a copy of his or her personal data, even where the data subject does not request the copy for the purposes referred to in recital 63 of the GDPR, but for a different purpose, unrelated to data protection;
- Article 23 (1) of the GDPR permits national legislation which requires patients seeking copies of their personal data contained in medical records to reimburse the doctors for the costs incurred, provided that the restriction to the right of access is, in the light of all relevant circumstances, necessary and proportionate to the objectives of protecting public health and the doctors’ freedom to conduct business. In particular, it is for the national court to verify that the costs for which doctors may ask for reimbursement from the patients are strictly limited to the actual costs incurred in that regard;
- In the context of a doctor-patient relationship, the phrase “copy of the personal data undergoing processing” in Article 15 (3) of the GDPR cannot be interpreted as conferring on the data subject a general right to obtain a full copy of the documents included in his or her medical file. However, the controller is to provide the data subject with a partial or full copy of the documents, when that is necessary to ensure that the data provided is intelligible and that the data subject is able to verify that the data provided is complete and accurate.
A press release is not yet available, but the full opinion is available here.
Following this opinion, now we await the CJEU’s decision.
