Commissioner (Cyprus) - 11.17.001.009.077: Difference between revisions

Revision as of 09:56, 31 January 2024

Commissioner - 11.17.001.009.077

Authority:	Commissioner (Cyprus)
Jurisdiction:	Cyprus
Relevant Law:	Article 5(1)(a) GDPR Article 57(1)(f) GDPR Article 58(2)(i) GDPR Article 83 GDPR
Type:	Complaint
Outcome:	Upheld
Started:	28.04.2021
Decided:	07.12.2023
Published:	07.12.2023
Fine:	1500 EUR
Parties:	Complainant Respondent
National Case Number/Name:	11.17.001.009.077
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Greek
Original Source:	Office of the Commissioner for Personal Data Protection (in EL)
Initial Contributor:	Evangelia Tsimpida

The Cypriot Commissioner for Personal Data Protection, following a complaint, imposed a fine in the amount of €1,500 on a doctor for acting in violation of Article 9(2)(h) GDPR and Article 5(1)(a) GDPR.

English Summary

Facts

A data subject found out that on 09 March 2021 her personal data was accessed by a doctor, the controller, to the portal of the beneficiaries of the General Health System (GHS), without a referral and without her permission. The reason given for accessing the data subject's online GHS account was "The provider created a visit without a referral and had the beneficiary's consent to access his/her Medical Record". The data subject, upon discovering the access to her medical records by the controller, attempted to contact her without success.

The Health Insurance Agency confirmed the access to the medical data of the data subject by the controller on in March 2021 without issuing a referral, claim for compensation for services or registering a visit involving the data subject.

On 28 April 2021 the data subject filed a complaint with the Cypriot Data Protection Commissioner, DPC, claiming a violation of Article

On 19 July 2022, the controller provided relevant submissions about the incident to both the Health Insurance Agency and the DPC's Office. She confirmed that she indeed did not know and had not examined the data subject and neither did her secretary have the data subject's details in her file. In order to access the data subject's medical records in the GHS, it was necessary to enter the beneficiary's full name, date of birth and ID number, and therefore the controller claimed that she assumed that she had spoken to the data subject by telephone for a visit and thus gained access to such data. Otherwise, she assumed that it was an accidental error in her attempt to access another patient's file. As a considerable amount of time had elapsed, she could not recall anything specific about the incident. In her explanations, the controller insisted that there was no processing of the data subject's personal data and that the data subject did not suffer any damage as a result of the incident.

On the next day, the data subject replied to the controller's submissions claiming that she never contacted the controller by telephone nor did she give her personal data to the controller's secretary. As soon as she became aware of the breach, she sought the controller and contacted her secretary, leaving her full name and telephone number (not her date of birth or her ID number) so that the controller could call her, but she was unable to contact the controller.

Holding

The Cypriot DPC assessed the above facts, underlining the fact that, as is evident from both sides, the controller did not know the data subject nor had examined her and could not prove that she obtained the data subject's personal data in a lawful manner or that she was authorised to access the beneficiary portal. The DPC noted that the processing of the data subjects's personal data by the controller could thus not be based on Article 9(2)(h) GDPR and that factors such as the absence of malicious intent or the absence of harm do not affect the fact that there was indeed a breach of the data subject's data. Furthermore, the DPC held that the personal data required for access to the data subject's medical file did not suggest that this was an accidental occurrence.

Taking the above into account, the DPC considered that there was a violation of Article 9(2)(h) GDPR and Article 5(1)(a) GDPR, because the data subject's personal data were not processed lawfully and fairly in a transparent manner and pursuant to Article 58(2)(i) GDPR and Article 83 GDPR imposed an administrative fine in the amount of €1,500 on the controller.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.

I reviewed a complaint submitted to my Office regarding access to the Complainant's General Health System (GHS) account by a medical practitioner. Specifically, as the Complainant mentioned, she found access to her personal data from the doctor, on the GeSY beneficiary portal, without knowing the doctor, without a referral and without her permission. During the investigation, both the Complainant and the doctor reported to my Office that each did not know the other and that the doctor did not examine the complainant.

I evaluated the doctor's positions regarding the possible ways of obtaining the Complainant's data, which were necessary to access the Complainant's beneficiary portal at the NHS. However, the doctor was unable to prove that she legally obtained the Complainant's personal data and that she was authorized to gain access to the beneficiary portal. Therefore, the Complainant's personal data were not processed lawfully and legitimately in a transparent manner. That is, the principle of "legality, objectivity and transparency", as provided for in Article 5(1)(a) of the Regulation, was not observed. For the violation of this article, I imposed on the doctor an administrative fine of one thousand five hundred euros (€1500).

@@ Line 74: / Line 74: @@
 === Facts ===
-A data subject was a patient of a doctor,  the controller, in 2018, when she underwent surgery. After the operation, the controller filed suit against the datra subject for defamation, as she left a negative review online. In this context, the data subject found out that in September and October 2020, the controller accessed her personal medical data through the portal of the beneficiaries of the General Health System (GHS), without a referral and without her permission. The justification insterted by the controller on the portal for accessing the data subject's GHS account was that the data subject once asked for a visit without a referral and then she was unconscious and needed urgent medical care, and that the controller had her consent.
+A data subject found out that on 09 March 2021 her personal data was accessed by a doctor, the controller, to the portal of the beneficiaries of the General Health System (GHS), without a referral and without her permission. The reason given for accessing the data subject's online GHS account was "The provider created a visit without a referral and had the beneficiary's consent to access his/her Medical Record". The data subject, upon discovering the access to her medical records by the controller, attempted to contact her without success.
-The data subject, first attempted to contact the controller without success. Then, on 28 April 2021 the data subject filed a complaint with the Cypriot Data Protection Commissioner, DPC.
+The Health Insurance Agency confirmed the access to the medical data of the data subject by the controller on in March 2021 without issuing a referral, claim for compensation for services or registering a visit involving the data subject.
-The DPC asked the parties to bring their relevant submissions and also asked the Health Insurance Agency some questions, as it can check all accesses to the GHS. The agency confirmed that the controller accessed medical data of the data subject between 2020 and 2021, a period in which there was no relation between the controller and the data subject: no referral, no visit was registered nor was there a need to provide urgent care to the data subject.
+On 28 April 2021 the data subject filed a complaint with the Cypriot Data Protection Commissioner, DPC, claiming a violation of Article
-On 19 July 2022, the controller provided its submissions claiming first of all, that the data subject had never withdrawn her consent. Then the controller claimed to have receive two phone calls by data subject's relatives who were concerned about her health conditions and needed the doctor's opinion, who then accessed the medical data of the data subject. The controller also claimed to have had a phone call with the data subject but it was not recorded.
+On 19 July 2022, the controller provided relevant submissions about the incident to both the Health Insurance Agency and the DPC's Office. She confirmed that she indeed did not know and had not examined the data subject and neither did her secretary have the data subject's details in her file. In order to access the data subject's medical records in the GHS, it was necessary to enter the beneficiary's full name, date of birth and ID number, and therefore the controller claimed that she assumed that she had spoken to the data subject by telephone for a visit and thus gained access to such data. Otherwise, she assumed that it was an accidental error in her attempt to access another patient's file. As a considerable amount of time had elapsed, she could not recall anything specific about the incident. In her explanations, the controller insisted that there was no processing of the data subject's personal data and that the data subject did not suffer any damage as a result of the incident.
-she confirmed that she indeed did not know and had not examined the data subject and neither did her secretary have the data subject's details in her file. In order to access the data subject's medical records in the GHS, it was necessary to enter the beneficiary's full name, date of birth and ID number, and therefore the controller claimed that she assumed that she had spoken to the data subject by telephone for a visit and thus gained access to such data. Otherwise, she assumed that it was an accidental error in her attempt to access another patient's file. As a considerable amount of time had elapsed, she could not recall anything specific about the incident. In her explanations, the controller insisted that there was no processing of the data subject's personal data and that the data subject did not suffer any damage as a result of the incident.
 On the next day, the data subject replied to the controller's submissions claiming that she never contacted the controller by telephone nor did she give her personal data to the controller's secretary. As soon as she became aware of the breach, she sought the controller and contacted her secretary, leaving her full name and telephone number (not her date of birth or her ID number) so that the controller could call her, but she was unable to contact the controller.
 === Holding ===
-The Cypriot DPC assessed the above facts, underlining the fact that, as is evident from both sides, the controller did not have any relationship with the data subject in the relevant period of time between 2020 and 2021 and could not prove that she obtained the data subject's personal data in a lawful manner or that she was authorised to access the GHS portal.
+The Cypriot DPC assessed the above facts, underlining the fact that, as is evident from both sides, the controller did not know the data subject nor had examined her and could not prove that she obtained the data subject's personal data in a lawful manner or that she was authorised to access the beneficiary portal. The DPC noted that the processing of the data subjects's personal data by the controller could thus not be based on [[Article 9 GDPR#2h|Article 9(2)(h) GDPR]] and that factors such as the absence of malicious intent or the absence of harm do not affect the fact that there was indeed a breach of the data subject's data. Furthermore, the DPC held that the personal data required for access to the data subject's medical file did not suggest that this was an accidental occurrence.
-The DPC noted that the processing operations by the controller included special categories of personal data under Article 9 GDPR, which can only be lawful if one of the exceptions of Article 9(2) apply. With respect to Article 9(2)(h) GDPR, the DPC held that this could not apply since the data subject was not receiving any medical care by the controller. Also, the controller could not rely on Article 9(2)(a) GDPR as a legal basis since the data subject did not give her specific consent to such processing.
-Further, the DPC considered that factors such as the absence of malicious intent or the absence of harm could not affect the fact that the processing was indeed unlawful, nor could this be considered an accidental occurrence.
 Taking the above into account, the DPC considered that there was a violation of [[Article 9 GDPR#2h|Article 9(2)(h) GDPR]] and [[Article 5 GDPR#1a|Article 5(1)(a) GDPR]], because the data subject's personal data were not processed lawfully and fairly in a transparent manner and pursuant to [[Article 58 GDPR|Article 58(2)(i) GDPR]] and [[Article 83 GDPR]] imposed an administrative fine in the amount of €1,500 on the controller.