US Rijeka - Us I-357/2024-6

US Rijeka - Us I-357/2024-6
Court:	US Rijeka (Croatia)
Jurisdiction:	Croatia
Relevant Law:	Article 34 GDPR Article 101 (2) ZUP Article 34 ZPOUZP Article 36 ZUS Article 58 (3) ZUS Article 79 (4) ZUS
Decided:	10.05.2024
Published:	13.11.2024
Parties:	A. T. AZOP (the DPA)
National Case Number/Name:	Us I-357/2024-6
European Case Law Identifier:
Appeal from:	AZOP (Croatia)
Appeal to:	Unknown
Original Language(s):	Croatian
Original Source:	Tražilica odluka sudova RH (in Croatian)
Initial Contributor:	leeve

A court ordered the DPA to decide on a complaint involving the loss of the data subject’s medical records by a hospital within 60 days. The DPA had failed to resolve the complaint within the time limit imposed by national law.

English Summary

Facts

The case concerns a data subject who filed a complaint with the DPA alleging a violation of the GDPR by the controller (a hospital) according to Article 34 of the Act on the Implementation of the GDPR (Zakon o provedbi Opće uredbe o zaštiti podataka - ZPOUZP). The data subject claimed the controller failed to provide access to her medical documentation and failed to inform her of its loss. The controller attributed the loss to irreversible server changes during a system overhaul in 2018/2019.

The data subject filed the complaint with the DPA in November 2023, which included details of the alleged personal data breach and supporting evidence. The DPA initiated an investigation requesting an explanation from the controller, including why the data subject was not informed about the data loss as required under Article 34 GDPR.

Despite the DPA's actions, including supervisory activities at the hospital, the DPA did not resolve the case within the 60-day deadline prescribed under Article 101(2) General Administrative Procedure Act (Zakon o općem upravnom postupku - ZUP). The delay was attributed to a high volume of cases and limited resources.

The data subject then initiated an administrative inactivity complaint, and the Administrative Court in Rijeka ruled in her favor.

Holding

The court ordered the DPA to issue a decision on the case within 60 days under Article 58(3) Act on Adminstrative Disputes (Zakon o upravnim sporovima - ZUS) and awarded the plaintiff €2,500 for the costs of the legal proceedings under Article 79(4) ZUS.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Croatian original. Please refer to the Croatian original for more details.

REPUBLIC OF CROATIAADMINISTRATIVE COURT IN RIJEKARijeka, Erazma Barčića 5Registration number: Us I-357/2024-6IN THE REPUBLIC OF CROATIAJUDGMENTThe Administrative Court in Rijeka, presided over by Judge Marija Renner Jakovljević, with the participation of the recorder Glorija Fićor, in the administrative dispute of the plaintiff A. T. from K., K., represented by the attorneys from the Joint Law Office A. B. J. and A. T., attorneys in R., F. S. 11, against the defendant the Personal Data Protection Agency, Zagreb, Savska cesta 136, due to the silence of the administration, 10 May 2024,judgment by I. The defendant is ordered to issue a decision within 60 (sixty) days from the date of receipt of this judgment, deciding on the plaintiff's request for a determination of a violation of the right to protection of personal data dated 20 November 2023, which was received by the defendant on 27 November 2023.II. The defendant is ordered to reimburse the plaintiff for the cost of the administrative dispute in the amount of 2,500.00 euros (two thousand five hundred euros) within 30 (thirty) days from the date of delivery of the final decision on the costs of this administrative dispute.Reasoning1. On 1 March 2024, this court received a complaint from the plaintiff A. T. from K., K. 23, represented by a proxy. attorneys at the Joint Law Office of A. B. J. and A. T. in R., F. S. 11, against the defendant, the Personal Data Protection Agency, Zagreb, Savska cesta 136, due to the silence of the administration, and in which the plaintiff essentially stated that on November 24, 2023, she submitted to the defendant by mail (registered with return receipt) a request for a determination of a violation of the right to personal data protection against the Special Hospital M. from Rijeka due to a violation of multiple provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC OJEU L119 (Official Gazette No. 42/18, hereinafter referred to as the General Data Protection Regulation), and the request to contain a description and time of the violation of the plaintiff's right to personal data protection and evidence substantiating the stated facts, as well as a proposal that the defendant by a decision to decide on the merits of the request. She pointed out that the defendant had not issued a decision by the date of filing the complaint, nor within the time limit prescribed by the provision of Article 101, paragraph 2 of the General Administrative Procedure Act (Official Gazette, No. 47/09 and 110/21, hereinafter: ZUP), and also that the defendant had not informed the plaintiff within three months of the outcome of her request or the progress of its resolution in accordance with the provision of Article 78, paragraph 2 of the General Data Protection Regulation, so the plaintiff proposed in her claim to issue a judgment without holding a hearing, in accordance with Article 36, paragraph 1, item 4 of the Administrative Disputes Act (Official Gazette, No. 20/10, 143/12, 152/14, 94/16, 29/17 and 110/21, hereinafter: ZUS), while in her claim she proposed to order the defendant to 60 days from the date of receipt of the judgment, the court shall decide on the plaintiff's request for a determination of a violation of the right to protection of personal data dated 20 November 2023 (received by the defendant on 27 November 2023), all with reimbursement of the costs of the administrative dispute. 2. In its response to the complaint received by this court on 22 April 2024, the defendant essentially stated that, based on the plaintiff's request, the defendant requested a statement from the Special Hospital M. from Rijeka, as the manager of personal data processing, and gave it a deadline of eight days to submit a statement as to why they did not comply with the plaintiff's request for access to personal data, or to provide a detailed statement on the cause due to which changes to the information system are underway during 2018/2019. there was an irreversible loss of certain image material located on the server, in connection with Article 15(3) of the General Data Protection Regulation and for what reason they did not inform the plaintiff as the applicant of the loss of her personal data based on the obligation under Article 34 of the General Data Protection Regulation. Furthermore, the defendant stated that he had also carried out supervisory activities at the Special Hospital M. from Rijeka, all for the purpose of establishing the accurate and complete factual situation, however, that the defendant currently has a very large number of cases in active work since the direct application of the General Data Protection Regulation and an increased influx of cases with a limited number of employees, as a result of which he was unable to resolve the plaintiff's case within 60 days. He stated that it is clear from the course of the proceedings so far that Special Hospital M., as the controller of personal data processing, did not deliver the requested copy of the medical documentation to the plaintiff due to the irretrievable loss of an as yet unknown number of medical documentation, and that additional supervisory activities are necessary to accurately and lawfully establish the facts, so the defendant is not able to issue a meritorious decision to decide on the plaintiff's request, but will do so immediately after collecting all evidence and establishing the facts. He noted that the defendant is conducting an extensive investigation into the compliance of Special Hospital M., as the controller, with the provisions of the General Data Protection Regulation, all due to suspicion of violations of several provisions of the General Data Protection Regulation, and in part, the proceedings are being carried out ex officio pursuant to Article 42 of the ZUP. Therefore, the defendant requested an extension of the deadline for issuing a decision on the request to establish a violation of the plaintiff's rights.3. In the submission received by this court on May 8, 2024, the plaintiff, responding to the defendant's allegations in the response to the complaint, fully maintained all allegations in the complaint and the claim, stating that it is clear from the defendant's response to the complaint that the defendant did not decide on the plaintiff's request received on November 27, 2023, so the plaintiff proposed adopting the claim by issuing a judgment without holding a hearing.4. Since the legally decisive facts in this administrative dispute are undisputed, the plaintiff disputes the application of substantive law, and the parties did not expressly request a hearing, the Court, without holding a hearing, applying the provision of Article 36, paragraph 1, item 4 of the ZUS, after reviewing the documentation attached to the file of the administrative dispute, based on consideration of all factual and legal issues, determined that the plaintiff's claim is well-founded.5. Namely, upon inspection of the documentation attached to the administrative dispute case file, it was determined that on November 24, 2023, the plaintiff submitted to the defendant a request for the determination of a violation of the right to protection of personal data against the Special Hospital M. from Rijeka, due to violations of the provisions of Regulation EU2016/679 of the General Data Protection Regulation, which the defendant received on November 27, 2023, and that the defendant, although taking certain actions, has not yet decided on the aforementioned request of the plaintiff, thus violating the provision of Article 101, paragraph 2 of the ZUP, which stipulates that an official is obliged, in cases of conducting an investigation procedure at the request of a party, to issue a decision and deliver it to the party no later than 60 days from the date of submission of a proper request. Paragraph 3 of the cited Article 101 of the ZUP stipulates that a party has the right to file an appeal or initiate an administrative dispute if the public body fails to decide on its request within the prescribed period.6. The provision of Article 34 of the Act on the Implementation of the General Data Protection Regulation (Official Gazette No. 42/18, hereinafter referred to as the Act) stipulates that anyone who believes that a right guaranteed by the Act and the General Data Protection Regulation has been violated may submit a request to the Agency for the determination of a violation of rights. A violation of the Agency's rights is decided by a decision. The Agency's decision is an administrative act. An appeal is not permitted against the Agency's decision, but an administrative dispute may be initiated before the competent administrative court (Article 34, paragraphs 1, 2, 3 and 4 of the Act).7. Considering that the defendant did not issue a decision within the time limit prescribed in the aforementioned provision of Article 101, paragraph 2 of the ZUP and deliver it to the plaintiff within the time limit prescribed above, the Court decided on the basis of Article 58, paragraph 3 of the ZUS as in the operative part of this judgment.8. The court's decision on the costs of the dispute is based on the provision of Article 79, paragraph 4 of the ZUS. Namely, the plaintiff requested in the claim the cost of drafting the claim in the amount of EUR 1,250.00 and the cost of drafting the submission of May 8, 2024, in which she responded to the defendant's allegations in the response to the claim in the amount of EUR 1,250.00, so the plaintiff was awarded, in accordance with Tbr. 27 and 46 of the Tariff on fees and compensation for attorneys' work (Official Gazette, No. 138/23, hereinafter: Tariff) should be awarded for each of the above actions the amount of EUR 1,250.00, or a total amount of EUR 2,500.00, which amount is increased by the VAT cost of 25%, and decided as in point II. of the operative part of this judgment. In Rijeka, 10 May 2024. Judge Marija Renner Jakovljević INSTRUCTIONS ON LEGAL REMEDY: No appeal is permitted against point I. of the operative part of this judgment (Article 66, paragraph 1 of the ZUS). An appeal against point II. of the operative part of this judgment is permitted to the High Administrative Court of the Republic of Croatia. The appeal shall be filed through this Court in three (3) copies, for the court and all parties to this dispute, within 15 days from the date of delivery of the judgment (Article 79, paragraph 7 of the ZUS).