Commissioner (Cyprus) - 11.17.001.007.251: Difference between revisions
(Created page with "{{DPAdecisionBOX |Jurisdiction=Cyprus |DPA-BG-Color=background-color:#ffffff; |DPAlogo=LogoCY.jpg |DPA_Abbrevation=Comissioner |DPA_With_Country=Comissioner (Cyprus) |Case_N...") |
No edit summary |
||
| Line 4: | Line 4: | ||
|DPA-BG-Color=background-color:#ffffff; | |DPA-BG-Color=background-color:#ffffff; | ||
|DPAlogo=LogoCY.jpg | |DPAlogo=LogoCY.jpg | ||
|DPA_Abbrevation= | |DPA_Abbrevation=Commissioner | ||
|DPA_With_Country= | |DPA_With_Country=Commissioner (Cyprus) | ||
|Case_Number_Name=11.17.001.007.251 | |Case_Number_Name=11.17.001.007.251 | ||
| Line 56: | Line 56: | ||
A patient after her hospitalization thought that a detailed medical report is part of her personal data which have been collected by the hospital and for that reason claimed that the she shall receive the medical report under the veil of GDPR. The Cypriot Office of the Commissioner for Personal Data Protection disagreed. | A patient after her hospitalization thought that a detailed medical report is part of her personal data which have been collected by the hospital and for that reason claimed that the she shall receive the medical report under the veil of GDPR. The Cypriot Office of the Commissioner for Personal Data Protection disagreed. | ||
== English Summary == | ==English Summary== | ||
=== Facts === | ===Facts=== | ||
According to the hospital's policy on discharges procedure, the patient receives only an attestation form and a digital copy of MRI scans. The complainant was hospitalized for several days back in 2016. In September 2019 she asked for her full medical report for which the hospital has asked her to pay administrative fees. | According to the hospital's policy on discharges procedure, the patient receives only an attestation form and a digital copy of MRI scans. The complainant was hospitalized for several days back in 2016. In September 2019 she asked for her full medical report for which the hospital has asked her to pay administrative fees. | ||
Furthermore, some days after the discharge from the hospital, her employer has fired her. She thought that the firing was on the ground of the health incident, and the only possible source to her employer was the very same hospital's employee. | Furthermore, some days after the discharge from the hospital, her employer has fired her. She thought that the firing was on the ground of the health incident, and the only possible source to her employer was the very same hospital's employee. | ||
=== Dispute === | ===Dispute=== | ||
The main part of the decisions dealing the question of whether the article 15 activate in advance any "ex-ante right" of the data-subject to access his or her personal data and/or information, even when these data have not prepared, drafted and/or assembled yet. | The main part of the decisions dealing the question of whether the article 15 activate in advance any "ex-ante right" of the data-subject to access his or her personal data and/or information, even when these data have not prepared, drafted and/or assembled yet. | ||
=== Holding === | ===Holding=== | ||
With regard to the leak of the complainant's health information, the Cypriot DPO has not been convinced for the substance of relevant complaints. It appears that a complainant for any allegation shall provide some evidence compatible with a minimum burden and standard of proof. Nevertheless, Cypriot DPO has not specified the bottom level of the required proof furthermore. | With regard to the leak of the complainant's health information, the Cypriot DPO has not been convinced for the substance of relevant complaints. It appears that a complainant for any allegation shall provide some evidence compatible with a minimum burden and standard of proof. Nevertheless, Cypriot DPO has not specified the bottom level of the required proof furthermore. | ||
| Line 73: | Line 73: | ||
Secondary allegation from the complainant was her belief that the medical report has been lost by negligence of the hospital's employees. Cypriot DPO was satisfied with the security measures which the health facility adopts, while had considered not only these measures of that sort was mentioned as the part of the defence reply. On the contrary, Cypriot DPO also considered all measures, which already have been brought to commissioner's notice by previous DPO's initiative enquiries and activities. | Secondary allegation from the complainant was her belief that the medical report has been lost by negligence of the hospital's employees. Cypriot DPO was satisfied with the security measures which the health facility adopts, while had considered not only these measures of that sort was mentioned as the part of the defence reply. On the contrary, Cypriot DPO also considered all measures, which already have been brought to commissioner's notice by previous DPO's initiative enquiries and activities. | ||
== Comment == | ==Comment== | ||
''Share your comments here!'' | ''Share your comments here!'' | ||
== Further Resources == | ==Further Resources== | ||
''Share blogs or news articles here!'' | ''Share blogs or news articles here!'' | ||
== English Machine Translation of the Decision == | ==English Machine Translation of the Decision== | ||
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details. | The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details. | ||
Revision as of 08:05, 29 July 2020
| Commissioner - 11.17.001.007.251 | |
|---|---|
 | |
| Authority: | Commissioner (Cyprus) |
| Jurisdiction: | Cyprus |
| Relevant Law: | Article 15 GDPR Article 32(1)(b) GDPR Article 32(1)(d) GDPR Article 32(4) GDPR |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | 25.05.2020 |
| Published: | |
| Fine: | None |
| Parties: | Nicosia General Hospital |
| National Case Number/Name: | 11.17.001.007.251 |
| European Case Law Identifier: | n/a |
| Appeal: | Not appealed |
| Original Language(s): | Greek |
| Original Source: | Commissioner for Personal Data Protection (Cyprus) (in EL) |
| Initial Contributor: | Panayotis Yannakas |
A patient after her hospitalization thought that a detailed medical report is part of her personal data which have been collected by the hospital and for that reason claimed that the she shall receive the medical report under the veil of GDPR. The Cypriot Office of the Commissioner for Personal Data Protection disagreed.
English Summary
Facts
According to the hospital's policy on discharges procedure, the patient receives only an attestation form and a digital copy of MRI scans. The complainant was hospitalized for several days back in 2016. In September 2019 she asked for her full medical report for which the hospital has asked her to pay administrative fees.
Furthermore, some days after the discharge from the hospital, her employer has fired her. She thought that the firing was on the ground of the health incident, and the only possible source to her employer was the very same hospital's employee.
Dispute
The main part of the decisions dealing the question of whether the article 15 activate in advance any "ex-ante right" of the data-subject to access his or her personal data and/or information, even when these data have not prepared, drafted and/or assembled yet.
Holding
With regard to the leak of the complainant's health information, the Cypriot DPO has not been convinced for the substance of relevant complaints. It appears that a complainant for any allegation shall provide some evidence compatible with a minimum burden and standard of proof. Nevertheless, Cypriot DPO has not specified the bottom level of the required proof furthermore.
Regarding the primary concern, Cypriot DPO started her reasoning with the fact that the state health rules command a health facility prepare a medical report only upon request from the patient and only if (s)he pays the regulated fee. Hence, before the patient's request, the desired information and data did not exist at all. That means the right of access, as the GDPR describes, it is entirely incompatible under such circumstances.
Secondary allegation from the complainant was her belief that the medical report has been lost by negligence of the hospital's employees. Cypriot DPO was satisfied with the security measures which the health facility adopts, while had considered not only these measures of that sort was mentioned as the part of the defence reply. On the contrary, Cypriot DPO also considered all measures, which already have been brought to commissioner's notice by previous DPO's initiative enquiries and activities.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
