On 26 October 2023 an interesting case from the perspective of the scope of the right of access was decided by the CJEU in case C-307/22.
In the case before the national court which was referred to the CJEU for a preliminary ruling, a patient claimed that he is entitled to a copy of his medical record free of charge.
On the background, the patient asked his dentist for a copy of his medical records to hold him accountable for errors alleged to have been made in the dental treatment he has received. The doctor requires the patient to pay the cost of providing the copy of the medical record, based on the German law provisions.
In today’s decision, CJEU recalls that the GDPR enshrines the patient’s right to obtain a first copy of his or her register without this involving, in principle, costs. The controller may only request a payment when the patient has already obtained a first copy of his data free of charge and is in fact making a new request.
The CJEU recalled that by virtue of its wording, the first sentence of Article 15 (3) of the GDPR confers on the data subject the right to obtain a true copy of his personal data, understood in a broad sense, which are the subject of operations which must be classified as ‘processing’ carried out by the controller of that processing (paragraph 28 of the judgment of 4 May 2023 in Österreichische Datenschutzbehörde and CRIF, C-487/21).
Secondly, the CJEU confirmed once again what it held in its judgment rendered in case C-487/21 (i.e., paragraph 32), i.e. the term “copy” refers not to a document as such, but to the personal data contained therein, which must be complete. The copy must therefore contain all the personal data being processed.
In view of the particularities of the case referred to the CJEU, in the case of the results of examinations, opinions of treating doctors and treatments or interventions administered to a patient, which, as a general rule, include a large amount of technical data or even images, the provision of a simple summary or compilation of that data by the doctor could create the risk that certain relevant data might be omitted or reproduced incorrectly or, in any event, that verification of their accuracy and completeness and their comprehension by the patient can be difficult.
CJEU highlighted that the Article 12(5) of the GDPR lays down the principle that the exercise of the data subject’s right of access to his data undergoing processing and to information relating thereto does not entail any costs for the data subject. In addition, this provision envisages two reasons why a controller may either charge a reasonable fee considering administrative costs, or refuse to comply with a request (i.e., where the data subject’s requests are “manifestly unfounded” or “excessive”, in particular due to their repetitive nature).
That being said, the dentist, as a controller of his patient’s personal data, is obliged to provide him with a first copy of his data free of charge. National rules may not charge a patient for the cost of the first copy of his medical record. Additionally, the CJEU stated that the patient is not obliged to justify his request.
In a nutshell, the CJEU answers the questions submitted for a preliminary ruling in this case as follows:
- Article 12 (5) and Article 15 (1) and (3) of GDPR must be interpreted as meaning that the obligation to provide the data subject, free of charge, with an initial copy of his personal data undergoing processing is binding on the controller even where that request is made for a purpose other than those referred to in the first sentence of recital 63 of the GDPR.
- Article 23(1) of GDPR must be interpreted as meaning that national legislation adopted before the entry into force of that regulation may fall within the scope of that provision. However, such an option does not permit the adoption of national legislation which, in order to protect the economic interests of the controller, charges the data subject the costs of an initial copy of his personal data which are the subject of that processing.
- The first sentence of Article 15 (3) of GDPR must be interpreted as meaning that in the context of a doctor/patient relationship, the right to obtain a copy of personal data undergoing processing implies that the data subject is provided with a faithful and intelligible reproduction of all those data. This right implies the right to obtain a full copy of the documents in his medical file which contain, inter alia, the said data, if the provision of such a copy is necessary to enable the data subject to check the accuracy and completeness of the data and to ensure that they are intelligible. In the case of data relating to the health of the data subject, this right shall in any event include the right to obtain a copy of the data in his or her medical file containing information such as diagnoses, test results, opinions of treating doctors and any treatment or intervention administered to the data subject.
It seems that the CJEU partially adhered to the opinion of the AG published on 20 April, 2023. Our blog post on the AG opinion rendered in this case is available here.
The CJEU judgment is available here.
