In the Case C‑307/22 Advocate General Emiliou on April 20, 2023 his Opinion posed. The procedure is based on a Reference for a preliminary ruling from the German Federal Court of Justice of May 10, 2022.
The background to this is an initially successful lawsuit filed by a patient who suspected a (dental) error in treatment and therefore demanded that the dentist provide him with free of charge, a copy of all medical records concerning him/her to make available.
Information for non-privacy purposes?
In doing so, the BGH presented three questions, first the following:
Is the first sentence of Article 15(3) in conjunction with Article 12(5) [GDPR] to be interpreted as meaning that the controller […] is not obligedto provide the data subject […] with a first copy of his […] personal data free of charge if the data subject does not request the copy for the pursuit of the purposes referred to in recital 63, first sentence […], […] but another – purpose that is not related to data protection, but is legitimate. (here: the examination of the existence of medical liability claims)?
The Advocate General proposes the following response:
[…] that Article 12(5) and Article 15(3) of the GDPR must be interpreted as obliging the controller to provide the data subject with a copy of his or her personal data, as follows even thenif the data subject does not use the copy for the purposes referred to in the 63rd recital of the GDPR, but for a other, non-privacy related purpose applied for.
The BGH asks about non-privacy-related, “but legitimate” purposes, the Advocate General answers generally for non-privacy-related purposes – but this means little, because fundamentally illegitimate purposes were not at issue.
It is then understandable that the person providing the information is not bound to the purposes mentioned in recital 63 (awareness, control of lawfulness). However, the question would have been whether a prohibition of abuse of rights does not apply within the framework of the GDPR. The Advocate General says nothing about this – unfortunately or fortunately. From his statements it only emerges – but still – that there is not per se is said to be abusive of the right not to pursue a data protection-specific purpose.
Reimbursement of costs under national law?
The second question referred for a preliminary ruling relates to Section 630g of the German Civil Code (“Inspection of the patient file”). According to this, patients have the right to inspect their patient file. However, if a patient wants an electronic copy, he or she must pay the costs incurred. Reimburse costs. The BGH asks whether such a provision is compatible with the GDPR.
The Advocate General thinks in principle yes and suggests the following answer:
[…] that a national rule requiring patients who request copies of their personal data contained in patient files to reimburse the doctors for the costs incurred, under Article 23(1) of the GDPR permissible is permissible, provided that the restriction of the right to information, taking into account all relevant circumstances with regard to the objectives of protecting public health and the entrepreneurial freedom of physicians is necessary and proportionate. In particular, the national court must determine whether the costs for which physicians may seek reimbursement from patients are strictly limited to the actually incurred costs limited are.
Entitlement to copy documents?
The third question concerns the right to request copies of personal data:
If the claim […] in the doctor-patient relationship includes a claim to Provision of copies of all parts of the patient’s file containing the patient’s personal data or is it only on Release of a copy of the patient’s personal data as such directed, leaving it up to the data-processing physician to decide how to compile the data for the patient concerned?
Here the Advocate General says that it is no fundamental claim documents that contain personal data, that such a right exists, and that the in certain situations but could exist:
[…] not may be interpreted as conferring on the data subject a general right to obtain a Complete copy of all documents contained in their patient file to receive. This does not exclude the possibility that the data controller must provide data subjects with a copy of certain documents, in part or in full. This is the case when a copy of the document is necessary to ensure that the data transmitted are intelligible and that the data subject is able to verify that the data transmitted are complete and accurate are.
Whether the ECJ sees the matter in the same way is open – one way or another, this result can at most be adopted in part for Switzerland:
- It goes without saying that the data protection law Right to information only on personal data direct. The claim does not affect documents any more than it does the server on which the data is stored; both are things that contain personal data but are not.
- According to Art. 16(4) DPA, the “form” of the information must be comprehensible – so it is the form that is at issue, not the content. This is not a sophism, but also the view of the explanatory report: “If personal data are stored in a technical formIf the data is delivered in a format that is not common, for example, in a file format that is not readable and/or understandable by the data subject, the data controller must be able to provide the data subject with the information. supplementary explanations to give, for example, orally”. If the data protection information comes in a JSON format, the data subject can at best ask for it. This can be seen as such, because an incomprehensible disclosure is a non-disclosure. However, an objective standard applies, not subjective restrictions.
- In any case, however, this does not mean that the person responsible must give the data subject Context information must provide. If the information is provided in a readable format, the duty to provide information is basically fulfilled. The person responsible then does not have to provide any additional explanations – unless this is inferred from the General clause in Art. 25 Para. 2 nDSG. In this case, however, the obligation to explain is not punishable because the general clause is far too vague to withstand the requirement of certainty.
- But even if one were to affirm an obligation to provide explanations: This would result in a claim for necessary explanations, but still no right to copies of documents also with reference to non-personal passages.