View source for Commissioner (Cyprus) - 11.17.001.007.251

{{DISPLAYTITLE:Commissioner - 11.17.001.007.251}}
{{DPAdecisionBOX

|Jurisdiction=Cyprus
|DPA-BG-Color=background-color:#ffffff;
|DPAlogo=LogoCY.jpg
|DPA_Abbrevation=Commissioner
|DPA_With_Country=Commissioner (Cyprus)

|Case_Number_Name=11.17.001.007.251
|ECLI=

|Original_Source_Name_1=Commissioner for Personal Data Protection (Cyprus)
|Original_Source_Link_1=http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/D9EDB20F259B7F76C2258596003B9748/$file/%CE%9F%CE%9A%CE%A5%CE%A0%CE%A5%20%CE%91%CE%9D%CE%9F%CE%9D%CE%A5%CE%9C%20%CE%91%CE%A0%CE%9F%CE%A6%CE%91%CE%A3%CE%97.pdf
|Original_Source_Language_1=Greek
|Original_Source_Language__Code_1=EL

|Type=Complaint
|Outcome=Rejected
|Date_Decided=25.05.2020
|Date_Published=
|Year=2020
|Fine=None
|Currency=

|GDPR_Article_1=Article 15 GDPR
|GDPR_Article_Link_1=Article 15 GDPR
|GDPR_Article_2=Article 32(1)(b) GDPR
|GDPR_Article_Link_2=Article 32 GDPR#1b
|GDPR_Article_3=Article 32(1)(d) GDPR
|GDPR_Article_Link_3=Article 32 GDPR#1d
|GDPR_Article_4=Article 32(4) GDPR
|GDPR_Article_Link_4=Article 32 GDPR#4



|Party_Name_1=Nicosia General Hospital
|Party_Link_1=
|Party_Name_2=
|Party_Link_2=
|Party_Name_3=
|Party_Link_3=
|Party_Name_4=
|Party_Link_4=
|Party_Name_5=
|Party_Link_5=

|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=Not appealed
|Appeal_To_Link=

|Initial_Contributor=Panayotis Yannakas
|
}}

A patient, after her hospitalisation thought that a detailed medical report is part of her personal data which have been collected by the Hospital, and for that reason, claimed that she shall receive the medical report under the veil of GDPR. The Cypriot Office of the Commissioner for Personal Data Protection disagreed. 

==English Summary==

===Facts===
According to the Hospital's policy on its discharges procedure, the patient receives only an attestation form and a digital copy of MRI scans. The complainant was hospitalised for several days back in 2016. In September 2019, she asked for her full medical report for which the hospital has asked her to pay administrative fees. 

Furthermore, some days after the discharge from the hospital, her employer fired her. She thought that the firing was on the grounds of the health incident, and the only possible source to her employer was the very same Hospital's employee.

===Dispute===
The central part of the decisions dealing the question of whether the Article 15 activates in advance any "''ex-ante right''" of the data-subject to access his or her personal data and/or information, even when these data have not been prepared, drafted, and/or assembled yet.

===Holding===
With regard to the leak of the complainant's health information, the Cypriot Office of the Commissioner for Personal Data Protection has not been convinced of the substance of relevant complaints. It appears that a complainant for any allegation shall provide some evidence compatible with a minimum burden and standard of proof. Nevertheless, Cypriot DPA has not specified yet the minimum level of the required proof.  

Regarding the primary concern, Cypriot DPA started her reasoning with the fact that state health require command a health facility to prepare a medical report only upon request from the patient and only if (s)he pays the regulated fee. Hence, before the patient's request, the desired information and data did not exist at all. That means the right of access, as the GDPR describes, it entirely incompatible under such circumstances.

The secondary allegation from the Complainant was her belief that the medical report has been lost due to negligence of the Hospital's employees. The Cypriot Commissioner for Personal Data Protection was satisfied with the security measures that the health facility has adopted, while had considered not only these measures of that sort was mentioned as part of the defence’s reply. On the contrary, the Cypriot Commissioner for PDP also considered all measures, which already have been the brought to Commissioner's notice by previous DPA's initiative enquiries and activities.

==Comment==
''Share your comments here!''

==Further Resources==
''Share blogs or news articles here!''

==English Machine Translation of the Decision==
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.

<pre>

</pre>
{{DEFAULTSORT:Commissioner_-_11.17.001.007.251}}