CA - 22PA01320

CAA - 22PA01320
Court:	CAA Paris (France)
Jurisdiction:	France
Relevant Law:	Article 6(1)(e) GDPR Article 9(2)(h) GDPR Article 13(2) GDPR Article 17(3)(c) GDPR
Decided:	11.04.2023
Published:
Parties:
National Case Number/Name:	22PA01320
European Case Law Identifier:
Appeal from:	Tribunal administratif de Paris 2105347/6-3
Appeal to:	Unknown
Original Language(s):	French
Original Source:	Légifrance (in French)
Initial Contributor:	ls

The Administrative Appeal Court of Paris confirmed that the processing of personal data by hospitals for medical purposes did not have to rely on consent and did not constitute a privacy violation.

English Summary

Facts

The data subject was admitted urgently to the hospital after an anxiety crisis. On arrival, she was treated by a psychiatrist who wrote a report. This report mentioned elements of the personal and family life of the data subject.

Some months later, she was admitted urgently to another hospital. A doctor also wrote a report in which personal details were mentioned, including data about her sexual and professional life.

The data subject considered that the processing was unlawful since she had not given her consent to the collection. She also considered that the collection of her data was not necessary for the performance of the hospital's care mission and that she had not been informed of her right to rectification. She nevertheless exercised her right to rectification by letter without result. The data subject therefore brought an action before the Administrative Tribunal of Paris to obtain damages for moral prejudice resulting from an infringement of her privacy. The court rejected her claim and she appealed to the Administrative Court of Appeal.

The arguments of the hospitals are not explained in the decision.

Holding

The Court explained that according to national law, hospitals must draw up a medical file for each hospitalised patient. This file must include among other things the information received from the patient and the reasons for hospitalisation. According to the Court, the information received in this case by the two hospitals allowed the psychological state of the data subject to be assessed and medical decisions to be taken. This data could therefore be entered in the data subject's medical file and processed in accordance with Articles 6(1)(e) and 9(2)(h) GDPR. The processing therefore had a legal basis and did not have to be based on consent.

The Court added that under Article 17(3)(c) GDPR, the hospitals could decide not to erase the data in question. Indeed, the data was useful in order to assess the data subject's state of health and make medical decisions.

The Court noted that the hospitals had not informed the data subject of her right to rectify her data. The hospitals were therefore responsible for a breach of Article 13(2) GDPR, which requires controllers to provide information about the rights of data subjects. However, the Court noted that the data subject had exercised her right to rectification and that she had therefore not suffered any damage as a result of not being informed of the existence of this right. The Court also considered that the professionals who had access to the data subject's data were bound by professional secrecy and that in these circumstances, the data subject had not suffered an invasion of her data protection.

The Court therefore confirmed the decision of the administrative court and rejected the appeal.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.