Datatilsynet (Denmark) - 2019-32-0988
From GDPRhub
| Datatilsynet - 2019-32-0988 | |
|---|---|
 | |
| Authority: | Datatilsynet (Denmark) |
| Jurisdiction: | Denmark |
| Relevant Law: | Article 5(1)(e) GDPR Article 9(2) GDPR Article 9(3) GDPR Article 12(3) GDPR Article 13(1) GDPR Article 13(2) GDPR Journalføringsbekendtgørelsens § 15 (the Danish Act on Medical Record-Keeping) Databeskyttelseslovens § 7, stk. 3 (The Danish Data Protection Act), |
| Type: | Complaint |
| Outcome: | Partly Upheld |
| Started: | |
| Decided: | |
| Published: | 10.02.2021 |
| Fine: | None |
| Parties: | Lægevagten Region Syddanmark |
| National Case Number/Name: | 2019-32-0988 |
| European Case Law Identifier: | n/a |
| Appeal: | Not appealed |
| Original Language(s): | Danish |
| Original Source: | datatilsynet.dk (in DA) |
| Initial Contributor: | Tetyana Porokhonko |
The Danish Data Protection Agency (DPA), published on 10 February 2021 its decision, in which it expressed severe criticism of Lægevagten Region Syddanmark for keeping the records of emergency calls (around 7.5 million records since January 2013) and ordered the company to delete all phone records that are more than five years old.
English Summary
Facts
On 3 July 2019, a complainant requested Lægevagten Region Syddanmark to delete all call records between her and the company´s emergency service arguing that she has not provided the company with a consent for recording the conversations.
On 16 August 2019, the company rejected the complainant´s request for deletion pursuant to Article 6 (1) (e) and (f) of the GDPR arguing that the recordings of emergency calls are part of the patient medical record and therefore, must be retained for at least 10 years after the last contact in accordance with § 15 of the Danish Act on Medical Record-Keeping (in Danish: Journalføringsbekendtgørelsen).
The complainant contacted the DPA on 11 and 18 August 2019 to complain about the way her request for the data deletion had been handled.
Dispute
The DPA considered whether:
- the company had a legal basis for recording emergency calls,
- the data deletion conducted in the scope of storage limitation,
- the data subject request handled in accordance with Article 12 (3) and
- the data subject has been provided with the information according to Article 13 (1) and (2).
Holding
The DPA severely criticised the company´s retention period for the records of emergency calls. The Agency stated that records of emergency calls cannot be considered as medical records and therefore, are subject to the general data protection requirements for storing data. The retention period of up to 5 years would be in line with the data protection rules.
Moreover, the DPA expressed criticism for failing to handle the complainant´s request in good time and provide all relevant information.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Danish original. Please refer to the Danish original for more details.
New decision: Regional medical guards' recording of telephone conversations Published 10-02-2021 Decision Public authorities The Danish Data Protection Agency has made a decision in a case where a citizen i.a. complained that the Medical Guard Region of Southern Denmark had recorded telephone conversations between her and the medical guard, and that the medical guard subsequently refused to delete the telephone recordings. The Danish Data Protection Agency has expressed serious criticism that the emergency medical service had kept recordings of telephone conversations that were more than five years old and has given the emergency medical service an order to delete all recordings of telephone conversations that are more than five years old. Journal number: 2019-32-0988 Summary The Danish Data Protection Agency has made a decision in a case where a citizen i.a. complained that the Medical Guard Region of Southern Denmark had recorded telephone conversations between her and the medical guard, and that the medical guard subsequently refused to delete the telephone recordings. During the case, it emerged that the doctor on duty had recorded and saved approx. 7.5 million calls since January 2013. The emergency medical service was of the opinion that recording telephone conversations with citizens was material that should be considered part of a patient record and should therefore be kept in accordance with the rules that apply to the storage of information contained in patient records (as a starting point 10 years after last patient contact). The Danish Data Protection Agency found - i.a. after submitting the question to the Ministry of Health and the Elderly - that recording telephone conversations with the emergency room cannot be considered part of a patient record. The question of how long the medical guard could keep the recordings should therefore instead be decided in accordance with the general rules of data protection law. The Danish Data Protection Agency found that a storage period of up to 5 years would be in accordance with the data protection rules. The Danish Data Protection Agency emphasized that the purpose of recording telephone conversations with the emergency services is to ensure documentation for use in any complaints about health professional treatment, and that according to the Act on access to complaints and compensation within the health service, it is possible to complain up to 5 years after day on which the complaint took place. Against this background, the Danish Data Protection Agency expressed serious criticism that the emergency medical service had kept recordings of telephone conversations that were more than 5 years old and ordered the medical emergency service to delete all recordings of telephone conversations that were more than 5 years old. 1. Order The Danish Data Protection Agency hereby returns to the case, where a complainant on 11 and 18 August 2019, respectively, has complained to the Authority about the processing of personal data about her by the Medical Service Region of Southern Denmark (hereinafter the Medical Service). The Danish Data Protection Agency has understood the complainant's inquiry as a complaint about: that the doctor's doctor has recorded telephone conversations between her and the doctor's doctor, that the medical guard has not complied with the duty to provide information in connection with the recording of the telephone conversations, and the medical officer's handling and response to her request for deletion. The Danish Data Protection Agency finds - after the case has been dealt with at a meeting of the Data Council - that the emergency services' recording of telephone conversations can take place on the basis of Article 9 (1) of the Data Protection Ordinance [1]. 2, letter h, cf. the Data Protection Act [2] § 7, para. 3, and Article 6, para. 1, letter e. However, the Danish Data Protection Agency finds grounds for expressing serious criticism that the emergency medical service has kept recordings of telephone conversations that are more than 5 years old, cf. Article 5 (1) of the Regulation. 1, letter e. The Danish Data Protection Agency also finds grounds for issuing an order to the emergency medical service to delete all recordings of telephone conversations that are more than 5 years old. The emergency medical service must comply with the order as soon as possible and no later than 31 March 2021. The order is issued in accordance with Article 58 (1) of the Data Protection Regulation. 2, letter d. According to the Data Protection Act, section 41, subsection 2, no. 5, is punishable by a fine or imprisonment for up to 6 months for anyone who fails to comply with an order issued by the Danish Data Protection Agency pursuant to Article 58 (1) of the Regulation. 2. As only recordings of telephone conversations that are more than 5 years old can no longer be processed by the Medical Service, the Danish Data Protection Agency finds that recordings of the Medical Service's telephone conversations with complaints can thus not at present be required to be deleted under Article 17 of the Regulation. The Danish Data Protection Agency also finds grounds for expressing criticism that the medical service's handling of the complainant's request for deletion has not taken place in accordance with Article 12 (1) of the Data Protection Regulation. 3. In addition, the Danish Data Protection Agency finds that the emergency service can fulfill the duty to provide information by providing the data subjects with the most relevant information in a speak in connection with the call combined with an easily accessible reference to where on the emergency services 'website the data subjects can find further information about the emergency services' telephone conversations, cf. Article 13 of the Regulation. Below is a more detailed review of the case and a justification for the Danish Data Protection Agency's decision. 2. Case presentation It appears from the case that on 24 February and 29 June 2019, respectively, the emergency services recorded a telephone conversation between the complainants and the emergency services. On 3 July 2019, complainants requested the Region of Southern Denmark to delete all recordings of telephone conversations between her and the emergency medical service. Complainants stated in this connection that she had not given consent for the telephone conversations to be recorded and that the information about her had therefore been processed illegally. On 9 July 2019, the Region of Southern Denmark forwarded the complainant's request to the emergency medical service, as the emergency medical service is data responsible for the treatment in question. On 16 August 2019, the medical guard rejected the complainant's request for deletion. The emergency medical service stated in this connection that the emergency medical service has recorded conversations for approx. 10 years, and that it involves a total of 7.5 million conversations. In addition, the medical officer stated that the audio recordings constitute very important information in connection with complaints, and that the conversations are only used in the connection where there is a converging interest in having a complaint clarified in the best possible way. As a basis for the treatment, the medical officer pointed to Article 6 (1) of the Data Protection Regulation. 1, letter f. On 11 and 18 August 2019, respectively, complainants contacted the Danish Data Protection Agency and complained about the emergency medical service's failure to respond to her request for deletion within the time limit in Article 12 (1) of the Data Protection Regulation. 3, lack of authority to record the telephone conversations and failure to comply with the duty to provide information pursuant to Article 13 in connection with the emergency medical service's recording of the telephone conversations. 2.1. The emergency room's remarks On 12 September 2019, 16 October 2019, 5 March 2020 and 19 May 2020, the emergency services issued statements for the purpose of processing the case, respectively. Categories of information The emergency medical service has stated that the emergency medical service processes information about the complainant's name, social security number and health information. The doctor on duty has explained in detail that the visiting doctor who takes the doctor's telephone, notes the citizen's social security number and health professional questions in the doctor's medical record system and provides medical advice and / or visits the citizen to other relevant parts of the health service. Purpose The medical service has generally stated that it is the medical service's opinion that it is important to record conversations with the citizens, as they have a "special character". These are inquiries from citizens at the hours of the day, which concern acute health professional issues with sometimes worried citizens. Regarding the purpose of the audio recordings, the medical officer has stated that the recordings are made in order to live up to the medical officer's obligations under the Authorization Act [3] and the Executive Order on Records [4]. In this connection, the medical guard has stated that the medical officer considers the audio recordings to be part of the medical record that the medical guard is obliged to keep and store, and that the audio recordings are included in the medical record material in the same way as a medical record note. This for i.a. to ensure proper record keeping. In this connection, the emergency medical officer has noted that the emergency medical officers strive to ensure that all relevant information about the medical professional assessment of the acute inquiry is included in the medical record that emergency medical officers prepare during or after the interview with the citizen, and which is sent to the person's own doctor. In addition, the medical guard has stated that the purpose of the audio recordings is to use these in connection with service complaints and professional complaints in order to shed light on the complaint in the best possible way before a decision is made, and that this avoids being in a situation where claim becomes claim. This is particularly relevant in cases where there are complaints about incorrect assessments, or where the on-call doctors may have acted responsibly. The medical guard has also stated that the duty manager and the duty committee, on the basis of the work with specific complaints, take the initiative to work continuously to improve the quality of the visitation and change guidelines for the work, which increases patient safety in the medical service. In addition, the medical staff has stated that the visitation is very dynamic. The on-call doctors spend a lot of attention on whether the patients can follow all the way, that they understand what the doctor wants and on what basis the medical decision is made. The visits are short-lived, and it is not possible to write down exactly how the conversation takes shape. The doctor cannot describe in the note how the contact was or how the tone was between doctor and patient, which is not a requirement either. Both parties need agreement before the visitation ends. This sense of collaboration between doctor and patient is very important, but can not always be described in a medical record note, where the focus is on uncovering the health professional problem and solving it. The Medical Emergency Service has also pointed out that in a decision of 2 May 2018, the Danish Agency for Patient Complaints has considered audio recording of a telephone visit in the emergency department of an emergency inquiry to be part of the patient record. [5] Authorization to record telephone conversations The Medical Service has stated that the processing of personal data, including the recording of telephone conversations, takes place on the basis of Article 6 (1) of the Data Protection Regulation. Article 6 (1) (e), the processing being necessary for the performance of a task in the public interest which has been assigned to the data controller, and Article 6 (1) (e). 1, letter f, as the emergency medical service has a legitimate and legal interest in recording the conversations with the citizens. Processing of information on e.g. health, the medical officer has stated, is based on Article 9 (1) of the Data Protection Regulation. 2, letter h. Similarly, the medical service has found that there is a legal basis for the processing of health information in the Data Protection Act, section 7, subsection. 3. In this connection, the medical guard has referred to section 21 of the Authorization Act, from which it follows that doctors are obliged to keep patient records of their medical professional activities. The emergency medical service has also referred to the fact that the patient record serves several purposes, as it both documents the treatment and care performed, ensures continuity of treatment and care, informs the patient and ensures the exchange of relevant information between professionals involved in the treatment and care of the patient. In addition, the medical staff has referred to section 10 (1) of the Executive Order on Record Keeping. 2, no. 2, letter p, from which it appears that patient records must contain information from e.g. video and audio recordings, etc. carried out as part of processing until necessary information from this has been recorded. Storage period The emergency medical service has stated that the audio recordings form part of the medical record that the medical emergency service is obliged to keep, and that the medical emergency service must therefore keep the audio recordings in accordance with the general rules for keeping patient medical records; i.e. a minimum of 10 years after the last contact in accordance with section 15 of the Executive Order on Medical Records. The Medical Service has stated that certain medical records must be kept for more than 10 years if the medical records are relevant for complaints, supervision or compensation cases, which in some cases be. In this connection, the medical emergency service has noted that the medical emergency service has been storing audio recordings since January 2013. The emergency medical service has stated that the emergency medical service has no authority to delete the audio recordings, as they are included as an essential element in patient treatment and on an equal footing with the doctors' other medical records. The doctor's duty has stated that the individual doctors do not have access to the audio files, and that it is the duty manager who listens to the audio files and contributes to a possible complaint information. The duty to provide information The emergency medical service has stated that in connection with calls, the patient is automatically informed that the conversation is recorded and saved, but that it is not stated why the conversation is recorded and saved, including how long the recording is stored, or what the legal basis for recording and saving the conversation is. . The medical service has stated that the medical service on that basis assesses that the medical service does not currently fulfill the duty to provide information, and that this will be rectified. 2.2. Complainant's remarks Complainants have on 10 September 2019 and 23 March 2020, respectively, submitted comments on the emergency services' statements. Complainants have stated that the emergency medical service has not complied with the duty to provide information in connection with the recording of the telephone conversations, cf. Article 13 of the Regulation, including in particular information on how long the emergency medical service retains the audio recordings, cf. 2, letter a. Complainants have further stated that the medical officer does not comply with the basic principles for the processing of personal data in accordance with Article 5 of the Regulation, including in particular the principle of data minimization, cf. Article 5 (1) of the Regulation. 1, letter c. Complainants have in this connection noted that the medical officer had previously stated that the telephone conversations were recorded in the event that a complaint should arise, but that this is not relevant in her case, as she does not want to file a complaint as to why the processing in question does not comply with the principle of data minimization. Finally, the complainants have stated that the medical officer illegally processes the audio recordings, in accordance with Article 9 of the Regulation. The complainant has in this connection noted that the medical officer has previously referred to Article 6 (1) of the Data Protection Regulation. 1, letter f, as a legal basis for the processing, but that the legal basis for the processing in the opinion of the complainant must be found in Article 9 of the Regulation, as the audio recordings contain information about the complainant's health. Complainants have stated that she still finds it very unclear and opaque what the audio recordings are to be used for and what constitutes the legal basis for this treatment, as the medical officer informs various legal sources and purposes of the audio recordings. 2.3. Comments from the Ministry of Health and the Elderly For the purpose of processing the case, the Danish Data Protection Agency has obtained an opinion from the Ministry of Health and the Elderly on, among other things: the interplay between section 10 (1) of the Executive Order on Record Keeping 2, no. 2, letter p, and § 15. The Ministry of Health and the Elderly has stated the following: “The Ministry of Health and the Elderly has obtained a contribution from the Danish Agency for Patient Safety. In this connection, the Ministry notes that it is the Danish Agency for Patient Safety that, pursuant to section 21, section 22, subsection 1 of the Authorization Act. 4, § 23, para. 3, § 24, para. 2, § 25, para. 3 and 4, have laid down more detailed rules on record keeping in Executive Order no. 530 of 24 May 2018 on authorized healthcare professionals' patient records (record keeping, storage, disclosure and transfer, etc.). Re 1 [on the interplay between section 10, subsection 2, no. 2, letter p, and § 15] The Ministry of Health and the Elderly has obtained a contribution from the Danish Agency for Patient Safety, to which the Ministry can refer. The Board states the following: “It appears from the Record Keeping Order § 2, paragraph. 1, that a patient record means records which provide information about the patient's condition, the planned and performed treatment, etc., including what information has been provided and what the patient has stated on that basis. Records that otherwise contain information about purely private matters and other confidential information about the patient are also part of the patient record. Of para. 2 states that health professional statements, diagrams and help sheets, discharge letters (epicrisis), referrals and referrals, X-rays / descriptions, clinical photos, models and the result of examination and treatment courses are covered by the medical record, to the extent that they are important for treatment. mv The purpose of the patient record is, for the sake of patient safety, to form the basis for information and treatment of the patient, document the treatment performed, act as the necessary internal means of communication between the staff participating in the treatment of the patient, ensure continuity of treatment and form a basis for supervision. The Danish Agency for Patient Safety has understood that the audio recordings in the emergency room have been introduced by the regions for quality assurance reasons. The recordings are not made for therapeutic reasons, and they are not intended to be used by healthcare professionals in the further treatment of the patient. […] It is still the Agency's opinion that sound recordings that have been recorded for reasons other than treatment do not form part of the record, and thus are not covered by the record keeping executive order, including the duty to keep. It is only the doctor's medical record note itself that is covered by the medical records executive order. Re 2 [whether there is an obligation to record information from video and audio recordings pursuant to section 10 (1) of the Executive Order on Record Keeping. 2, No. 2, letter p] The Ministry of Health and the Elderly has obtained a contribution from the Danish Agency for Patient Safety, to which the Ministry can refer: “The Danish Agency for Patient Safety can state that it follows from the Authorization Act, section 22, subsection. 2, that the patient record must contain the information necessary for a good and safe patient treatment. Of section 10, subsection 2, a number of matters appear, which must appear in the medical record if they are relevant and necessary. Below are video and audio recordings etc. carried out as part of processing until the necessary information from this has been recorded, under section 10, subsection 2, No. 2, letter p. What information in a specific situation must be considered relevant and necessary will always depend on the healthcare professional's professional assessment. It can be stated that the video and audio recordings referred to in section 10 (1) of the Executive Order. 2, no. 2, letter p, are recordings that are specifically made for the purpose of a health professional review with the purpose of subsequently making a final professional assessment, which must then be entered in the patient record. It is the Agency's understanding that audio recordings in the emergency room are not made for this purpose. It can also be stated that audio and video recordings covered by the executive order cannot replace the healthcare professional's usual record recordings. If such recordings are used as a basis for journal entries, they may not be deleted until the necessary information has been recorded in the usual manner. " Re 3 [whether, in the Ministry's view, there is an obligation to delete video and audio recordings after the necessary information from the recordings has been recorded] The Ministry of Health and the Elderly has obtained a contribution from the Danish Agency for Patient Safety, to which the Ministry can refer. The Board states the following: “As stated above, the Danish Agency for Patient Safety does not in principle perceive audio and video recordings as part of the record if they are not used as a basis for record recording. The recordings are thus not covered by the Executive Order on Record Keeping, and thus not by the storage period of the Executive Order on Record Keeping. Against this background, in the opinion of the Danish Agency for Patient Safety, there is no obligation to keep the recordings in accordance with health legislation. The information will thus have to be stored in accordance with the rules in the Data Protection Act and the Data Protection Regulation. The Danish Data Protection Agency administers these rules and is the supervisory authority in the area. The Danish Agency for Patient Safety thus does not have the opportunity to comment on whether there is a mandatory deletion obligation in the situation in question. ” Re 4 [other relevant provisions concerning the recording of telephone inquiries from citizens by authorized healthcare professionals and the possibilities for deletion] Neither the Ministry of Health and the Elderly nor the Danish Agency for Patient Safety is aware of other relevant provisions regarding authorized healthcare professionals' recording of telephone inquiries from citizens and the possibilities for deletion. ” Justification for the Danish Data Protection Agency's decision 3.1. Authorization to record telephone conversations 3.1.1. Pursuant to Article 9 (1) of the Data Protection Regulation 1, there is in principle a ban on the treatment of e.g. health information. Article 9 (1) of the Data Protection Regulation Article 9 (2) (a) to (j) sets out the prohibition on the processing of specific categories of personal data, including health data, in Article 9 (2) of the Regulation. 1 does not apply. Article 9 (1) of the Data Protection Regulation Article 2 (2) (h) states that the prohibition on the processing of health information does not apply if the processing is necessary for the purpose of preventive medicine or occupational medicine for the assessment of the worker's ability to work, medical diagnosis, provision of social and health care or treatment or management of social and health care and services on the basis of EU law or the national law of the Member States or under a contract with a healthcare professional and subject to the conditions and guarantees referred to in paragraph 1; 3. It follows from Article 9 (1) 3, that personal data as referred to in para. 1 may be processed for the purposes referred to in para. (H) if this information is processed by a professional who is bound by professional secrecy under Union or national law or by rules laid down by national competent bodies, or under the responsibility of such person, or by another person; which also has a duty of confidentiality under EU law or the national law of the Member States or rules laid down by national competent bodies. Article 9 (1) of the Regulation 3, includes preventive disease control, medical diagnosis, nursing or patient care as well as management of medical and health services. The provision was necessary for the data controller, as hitherto, to be able to process health information in connection with the performance of his tasks in the health area, including e.g. in connection with patient treatment. It is a condition that the person in charge of the processing of personal data has a duty of confidentiality, which is generally fulfilled in relation to persons in the health sector. Persons working in the health sector are generally subject to sections 152 and 152 of the Criminal Code [6] on the duty of confidentiality, which constitutes the general rules of Danish law on professional secrecy, section 40 of the Health Act on the patient's claim to the healthcare professional's and - presumably - the Public Administration Act [7 ] rules on professional secrecy. Article 9 (1) of the Regulation 2, letter h, and para. 3, presupposes that the treatment has a legal basis in national law. However, it has been assumed in the literature that there is nothing to prevent Article 9 (1) of the Regulation. 2, letter h, is implemented as treatment rules in a general way by an almost literal implementation. [8] It thus follows from the Data Protection Act, section 7, subsection That the processing of data covered by Article 9 (1) of the Data Protection Regulation 1, may take place if the processing of information is necessary for the purpose of preventive disease control, medical diagnosis, nursing or patient treatment or management of medical and health services, and processing of the information is carried out by a person in the health sector who is subject to professional secrecy, cf. Article 9 (1) of the Data Protection Regulation 2, letter h. 3.1.2. The Medical Service has stated to the Danish Data Protection Agency that the Medical Service's processing of personal data in the form of recording telephone conversations can take place on the basis of Article 9 (1) of the Data Protection Ordinance. 2, letter h, cf. the Data Protection Act § 7, para. And Article 6 (3) of the Regulation. 1, letters e and f. In this connection, the emergency medical service has stated that the emergency medical service is obliged to keep patient records of the emergency medical service's medical activities, cf. section 21 of the Authorization Act, and that the audio recording of the conversation between the doctor and the patient is included as part of the patient record. section 10, subsection 2, No. 2, letter p. The medical guard has also stated that the audio recordings are used in connection with complaints and compensation cases, and that the audio recordings help to ensure correct record keeping. 3.1.3. The Danish Data Protection Agency assumes that the (main) purpose of the emergency medical service's recording of telephone conversations is to ensure documentation for use in any complaints and compensation cases, and that the audio recordings thus contribute to quality assurance of conversations between the emergency medical service and the citizens. It is against this background that the Danish Data Protection Agency is of the opinion that the emergency medical service's recording of telephone conversations cannot be made on the basis of section 21 of the Authorization Act and section 10 of the Executive Order on Records. The Danish Data Protection Agency has hereby emphasized the Danish Agency for Patient Safety's information that audio recordings that are recorded for reasons other than treatment are not included as part of a patient record and are thus not covered by the Executive Order on Record Keeping, including the Executive Order's rules on retention. The Danish Data Protection Agency finds, however, that the medical service's recording of telephone conversations can be made on the basis of Article 9 (1) of the Data Protection Regulation. 2, letter h, cf. the Data Protection Act § 7, para. And Article 6 (3) of the Data Protection Regulation. 1, letter e. The Danish Data Protection Agency has emphasized that not only the health professional treatment itself, but also the management of health care and health services can be included within the scope of Article 9 (1) of the Regulation. 2, letter h, cf. the wording of the provision. The Data Protection Act, section 7, subsection 3, also includes the processing of health information in connection with the management of medical and health services. Administrative data in connection with health professional treatment must thus, in the Data Inspectorate's opinion, also be able to be accommodated within the aforementioned provisions, and in the Authority's assessment, the emergency services' recording of telephone conversations is closely linked to health professional treatment, very important contribution in dealing with complaints about healthcare treatment. The Danish Data Protection Agency has also emphasized that recording telephone conversations with the emergency doctor constitutes an extra security for both the registered person and the emergency doctor. For the data subject, the audio recordings mean that the data subject avoids being in a situation where he or she cannot document, e.g. what information he provided to the doctor on duty for his assessment of the situation. It will also be possible for the doctor on duty to document the background on which he or she made his / her assessment. This is particularly relevant, as the outcome of a complaint can have a major impact on the person's authorization and thus the opportunity to practice medicine. Recording of the emergency services 'telephone conversations can thus constitute an important element in relation to raising the quality of the emergency services' activities through better coverage of complaints and thus also contributing to increasing patient safety. The Danish Data Protection Agency has also emphasized that the emergency medical service is staffed by the general practitioners in the Region of Southern Denmark, and that the general practitioners are subject to the provisions of professional secrecy in sections 152 and 152 of the Criminal Code and section 40 of the Health Act [10]. which the general practitioners perform for the emergency room. It is therefore the Data Inspectorate's assessment that the recording of telephone conversations can be accommodated within Article 9 (1) of the Regulation. 2, letter h, cf. the Data Protection Act § 7, para. 3. In addition, the telephone conversations may be recorded on the basis of Article 6 (1) of the Data Protection Regulation. 1, letter e, as the processing must be considered necessary for the purpose of performing a task in the interest of society or which falls within the exercise of public authority, which has been imposed on the data controller. The Danish Data Protection Agency has hereby, among other things, emphasized that section 3 of the Health Act states that regions and municipalities are responsible for the health service offering a population-oriented effort regarding prevention and health promotion as well as treatment of the individual patient, and that on the basis of the agreement between Region Syddanmark and PLO Syddanmark it is the duty of the medical guard to ensure "(...) a rational and well-functioning on-call duty system of high quality, which provides the population in the Region of Southern Denmark with good and reassuring medical care and service during the on-call time." [11] Finally, the Danish Data Protection Agency's assessment is that the processing is sufficient, relevant and limited to what is necessary in relation to the purpose for which the data is processed, cf. Article 5 (1) of the Regulation. 1, letter c. It is thus the Data Inspectorate's assessment that the consideration of adequate information of a complaint with potentially very intrusive significance for the parties involved will not be met to the same extent by the doctor in question continuously or after the call notes in the record how the call went, and what medical assessments were made, including the background to the assessment in question. 3.2. Storage restriction The emergency medical service has stated that the medical emergency service has recorded and saved telephone conversations since January 2013, and that the medical emergency service has recorded a total of 7.5 million calls. According to the emergency medical service's assessment, the audio recordings are part of the patient record and must therefore, pursuant to section 15 of the Executive Order on Record Keeping, be kept for at least 10 years. On the basis of the information from the Danish Agency for Patient Safety, it is as stated above the Data Inspectorate's assessment that the audio recordings cannot be considered part of the patient record and thus are not covered by the record keeping order until 10 years after last contact. The Danish Data Protection Agency estimates that the storage of audio recordings for up to 5 years will be in accordance with Article 9 (1) of the Regulation. 2, letter h, as the processing during that time period will be necessary to fulfill the purpose. The Danish Data Protection Agency has emphasized that the purpose of recording telephone conversations with the emergency services is to ensure documentation for use in any complaints, and that it appears from section 3 a of the Act on access to complaints and compensation within the health service [12] that complaints must be submitted within 2 years after the time when the complainant was or should have been aware of the matter complained of, but no later than 5 years after the day on which the complaint has taken place. An absolute time limit for lodging complaints has thus been set at 5 years. The Danish Data Protection Agency finds grounds for expressing serious criticism of the emergency medical service's retention of recorded telephone conversations that are more than 5 years old, cf. Article 5 (1) of the Regulation. 1, letter e. The Danish Data Protection Agency also finds grounds for issuing an order to the emergency medical service to delete all recordings of telephone conversations that are more than 5 years old. In this connection, the Danish Data Protection Agency has noted that it also appears from the on-call instructions for the Medical Officers' Region of Southern Denmark, section 4.8., That telephone calls to i.a. the visitation may be stored for 5 years. With regard to the two recorded telephone conversations on 24 February 2019 as well as the recorded telephone conversation on 29 June 2019, which the complainant has asked the emergency services to have deleted with reference to the fact that she does not intend to complain about the emergency medical services, this cannot lead to a changed assessment. The Danish Data Protection Agency thus finds that the emergency medical service was entitled to reject the complainant's request to delete the audio recordings in question. 3.3. Handling of deletion request Article 12 (1) of the Data Protection Regulation 3, it follows that the data controller shall, without undue delay and in all cases no later than one month after receipt of the request, inform the data subject of measures taken on the basis of a request pursuant to e.g. Article 17 of the Regulation. This period may be extended by two months, if necessary taking into account the complexity and number of the request. The controller shall notify the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. The Danish Data Protection Agency finds that the medical officer's handling of the complainant's request for deletion has not been in accordance with Article 12 (1) of the Regulation. 3, as the medical guard on 9 July 2019 received the complainant's request for deletion from the Region of Southern Denmark, but did not respond to the request until 16 August 2019. It is against this background that the Danish Data Protection Agency is of the opinion that the medical service's handling of the request for insight in question has not taken place in accordance with Article 12 (1) of the Regulation. 3, why the Authority expresses criticism. 3.4. Duty to provide information If personal data about a data subject is collected from the data subject, the data controller must provide the data subject with a number of data at the time of collection, in accordance with Article 13 (1) of the Data Protection Regulation. 1 and 2. The Medical Service has stated to the Danish Data Protection Agency that the "speak" that the Medical Service gives in connection with calls to the Medical Service does not live up to the requirements in Article 13 (1) of the Regulation. 1 and 2, in relation to the treatment that takes place in connection with the emergency medical service's recording of telephone conversations. In addition, the medical guard has stated that the medical guard has begun work on writing and recording a new speak that meets the requirements for the duty to provide information. It is the opinion of the Danish Data Protection Agency that in the specific situation it is inappropriate to require that all the information that must be provided in accordance with Article 13 of the Regulation is given to the data subject in a speak when the emergency medical service is called. In this connection, the Danish Data Protection Agency has emphasized that a longer listing of information that could potentially take several minutes will not be in the data subject's interest in such a situation, just as it can hardly be assumed to be clear to the data subject. In the opinion of the Danish Data Protection Agency, this must be particularly true in connection with the recording of telephone conversations with the emergency medical service, where the conversations may be of an urgent or acute nature. It is against this background that the Danish Data Protection Agency's assessment that the emergency medical service can fulfill the duty to provide information in Article 13 of the Regulation by providing the data subject with the most relevant information in a speak in connection with the call combined with an easily accessible reference to where the data subject can find further information. on the emergency room recording of telephone conversations. Concluding remarks The Danish Data Protection Agency is then awaiting notification from the Medical Guard, Region of Southern Denmark. The notification must be received by the Authority no later than 31 March 2021. [1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC (General data protection regulation). [2] Act No. 502 of 23 May 2018 on supplementary provisions to the Regulation on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the Data Protection Act). [3] Statutory Order no. 731 of 8 July 2019 on authorization of healthcare professionals and on healthcare professional activities. [4] Executive Order no. 530 of 24 May 2018 on authorized healthcare professionals' patient records (record keeping, storage, disclosure and transfer, etc.) [5] https://stpk.dk/da/afgoerelser/afgoerelser-fra-styrelsen-for-patientklager/patientrettigheter/2018/18sps10/. [6] Statutory Order no. 976 of 17 September 2019 on the promulgation of the Penal Code. [7] Executive Order no. 433 of 22 April 2014 on the Executive Order of the Public Administration Act. [8] The Data Protection Ordinance and the Data Protection Act with comments, Kristian Korfits Nielsen et al., 1st edition, 2020, pages 442 and 1020. [9] Statutory Order no. 976 of 17 September 2019 on the promulgation of the Penal Code. [10] Executive Order no. 903 of 26 August 2019 on the Executive Order on the Health Act. [11] Agreement between the Region of Southern Denmark and PLO Southern Denmark on the organization of the regional emergency room and visitation to emergency rooms from 27 October 2014, page 1, 1st sentence. The agreement between the Region of Southern Denmark and PLO Southern Denmark can be read here: https://www.laeger.dk/sites/default/files/plo-syddanmark_underskrevet_vagtaftale_2014.pdf. [12] Executive Order no. 995 of 14 June 2018 on access to complaints and compensation within the health care system.
