OGH - 6Ob138/20t
From GDPRhub
| OGH - 6Ob138/20t | |
|---|---|
 | |
| Court: | OGH (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 12(5) GDPR Article 15 GDPR Article 23(1)(e) GDPR Article 77(1) GDPR Article 79(1) GDPR Rechtsinformationssystem des Bundes § 6 (1) GTelG |
| Decided: | 17.12.2020 |
| Published: | |
| Parties: | |
| National Case Number/Name: | 6Ob138/20t |
| European Case Law Identifier: | ECLI:AT:OGH0002:2020:0060OB00138.20T.1217.000 |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | Rechtsinformationssystem des Bundes (in German) |
| Initial Contributor: | Agnieszka Rapcewicz |
The Supreme Court of Austria (OGH) confirmed that the data subject's right of access under Article 15 GDPR also covers his or her own health data, such as data in the patient's file, diagnoses, test results, doctors' findings after treatment and information about treatments or interventions.
The Court pointed out that in order to determine whether it is permissible to apply a restriction of the right of access under Article 23 GDPR, it is decisive to balance the importance of the interests pursued by the responsible parties (hospitals) and the persons limited in their rights (patients) under the proportionality test. The Court indicated that it could not make such a definitive assessment on the basis of the current results of the proceedings. It considered that it was necessary to repeal the judgments, so that the proportionality test could be conducted by the court of first instance.
English Summary
Facts
The claimant was hospitalised in a hospital for which the defendant was responsible. After being discharged from hospital, the claimant asked the hospital to send his entire medical history to his email address free of charge, citing the GDPR. The hospital responded that the transfer of the medical history was subject to the payment of a fee. The claimant did not pay the fee and the defendant did not provide the claimant with the medical history until the conclusion of the oral proceedings at first instance.
The complainant sued the hospital operator for €7,000. The court of first instance upheld the claim, holding that the GDPR regulations overrode national law on the provision of medical records. The claimant was entitled to a free initial copy of the medical history under Article 15(3) GDPR in conjunction with Article 12(3) GDPR. The Court of Appeal amended the judgment to dismiss the claim. It valued the subject matter of the decision at €5,000, but no more than €30,000, and allowed the ordinary appeal because there was no supreme court case law on a patient's right to receive a free initial copy of his medical history under the Data Protection Act.
The plaintiff has appealed.
Dispute
Is the right to receive a first copy of medical history free of charge limited by national legislation in a way that is permissible under Article 23 GDPR, or must the principle of chargeability remain inapplicable as a national law contrary to Article 23 GDPR?
Holding
The Supreme Court repealed the judgments of the lower courts and referred the case back to the court of first instance for re-examination and determination.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Head The Supreme Court, as a court of appeal, by the President of the Senate, Dr Schramm, as Chairman, and the Court Councillors, Dr Gitschthaler, Univ. Prof. Dr. Kodek, Dr. Nowotny and the Hofrätin Dr. Faber as further judges in the case of the plaintiff Ing. J*****, represented by Dr. Stephan Duschel, Mag. Klaus Hanten, lawyers in Vienna, against the defendant City of W*****, represented by Dr. Andreas Joklik, lawyer in Vienna. Andreas Joklik, lawyer in Vienna, on the appeal of the plaintiff against the judgment of the Regional Court for Civil Matters Vienna of 10 April 2020, GZ 36 R 27/20t-11, by which the judgment of the District Court Innere Stadt Vienna of 6 December 2019, GZ 52 C 873/19x-7, was amended, in closed session, the following order Decision passed: Spruch The appeal of the plaintiff is allowed. The judgments of the lower courts are set aside and the case is referred back to the court of first instance for a new hearing and decision. The costs of the appeal proceedings are additional procedural costs. Text Grounds: [1] As a result of an accident at work, the plaintiff was treated as an in-patient from 17. 5. 2019 to 19. 5. 2019 at a hospital of which the defendant is the sponsor. He was given a patient letter dated 19. 5. 2019. In a letter dated 18 June 2019, the representative of the plaintiff requested the hospital to send the entire medical history to his e-mail address free of charge, referring to the GDPR. The hospital replied by letter of 28 June 2019 that the transmission of the medical history was dependent on the payment of a contribution to costs. The plaintiff did not pay the contribution to costs; the defendant did not send the medical history to the plaintiff until the end of the oral proceedings at first instance. 2] The plaintiff requested that the defendant be obliged to provide him, free of charge, with "the medical history" of his inpatient stay from 17 May 2019 to 19 May 2019, as well as any follow-up treatments and checks. The claim arose from Art 15(3), Art 12(5) Previous search termDSGVNext search term. He valued the claim at EUR 7,000 because he intended to use the treatment records to assert claims for damages in this amount arising from his accident. He added that he had only requested one (single) copy. The defendant was free to decide in which form to send it. 3] The defendant countered the claim by arguing that Article 15 of the Data Protection Act did not grant a claim for the release of "the medical records"; these - meaning the original - had to be kept by the hospital. According to § 17(4) and § 17a(2)(g) WrKAG, the plaintiff only had the right to inspect his medical records or to have a copy made against reimbursement of costs. Also according to Article 15(3) of the Data Protection Act, the defendant was only obliged to provide him with a copy for the purpose of inspecting his processed data, but not to give it to him free of charge. For each additional copy, he had to pay an appropriate fee in accordance with Article 15(3) of the previous search term Data Protection Act. Article 15(3) of the previous search term Data Protection Act was only intended to enable the data subject to check the lawfulness of the data processing, but not to obtain evidence free of charge for a damages action. The requirements standardised in § 6 para 1 GTelG (Health Telematics Act) for the electronic transmission of health data would not be fulfilled in the case of transmission by e-mail. 4] The court of first instance allowed the claim. In summary, it stated that the provisions of the Previous search termDSGVNext search term superseded national law. According to Article 15(3) in conjunction with Article 12(5) of the previous search term data protection regulation, the plaintiff was entitled to a free initial copy of his medical history. Article 23(1)(e) of the previous search term Data Protection Act does not permit any restriction of the rights of the persons concerned for the protection of financial interests in the area of public health and social security, because this would require an economically relevant extent, which is not reached. The conditions of § 6 GTelG were not relevant because the request was not directed at the transmission by e-mail. 5] The Court of Appeal amended the judgement to dismiss the action. It valued the object of the decision at EUR 5,000, but not more than EUR 30,000, and allowed an ordinary appeal because there was no case law from the highest courts on the right of a patient to receive a free initial copy of his or her medical history in accordance with the Previous search termDSGVNext search term. 6] Legally, it discussed that the obligation to reimburse costs under the WrKAG, which deviated from Art 15(3) and Art 12(5) of the previous search term Data Protection Act, was covered by Art 23(1)(e) of the previous search term Data Protection Act, because the free provision of copies of medical records could assume an economically relevant extent due to the administrative effort required for this, if it was demanded "across the board". On the other hand, the impairment of the person concerned was less, especially since all relevant basic data in the patient letter were provided free of charge and without being requested. The handing over of the patient letter already fulfilled the right to information according to the Data Protection Act. 7] The plaintiff's appeal is directed against this, in which he seeks the restoration of the decision of the court of first instance granting the action. In the alternative, a motion to set aside is filed. 8] In its response to the appeal, the defendant requested that the appeal be rejected or, in the alternative, that it be dismissed. Legal assessment 9] The appeal is admissible for the reason stated by the Court of Appeal and is also justified in the sense of the alternative motion to set aside. (10) 1. interpretation of the relief sought 1.1 The statement of claim is to be understood as it is meant by the plaintiff in connection with the statement of claim. The court has to correctly formulate a claim that was only inadvertently formulated incorrectly (RS0037440 [T4, T5]). 1.2 In this case, the wording of the claim is directed towards the free handing over of "the medical history". However, it is clear from the statement of claim, which speaks of the "printout of the relevant documents", a "data copy", the "first copy" and the "transmission in copy", that the plaintiff is not seeking the surrender of the medical record in the original, but the transmission of a copy in electronic or paper form. The defendant's argument, also maintained at third instance, that the claim is precluded by the obligation to retain the medical records pursuant to section 17(2) sentences 4 and 5 WrKAG (cf. Neumayr/Resch, Dürfen Zivilgerichte Krankenanstalten zur Übermittlung der Krankengeschichte im Original verpflichten? JBl 2012, 627), therefore comes to nothing. (13) 2. admissibility of the legal action and the appeal: (14) 2.1 The admissibility of legal action is an absolute procedural requirement that must be observed ex officio at every stage of the proceedings until the decision becomes final (RS0046249 [T4]; RS0046861 [T5]). 15] However, the inadmissibility of legal proceedings for claims under Article 15(3) of the previous search termDSGV next search term, which was raised by the defendant in its response to the appeal, is not present in this case. Pursuant to Article 79(1) of the Regulation, every data subject shall have the right to an effective judicial remedy, without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77 of the Regulation, if he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data which does not comply with this Regulation. 2.3 In the doctrine, different positions are taken on the question of whether a judicial remedy pursuant to Article 79 (1) of the Data Protection Act is available to enforce the data subject rights of Article 15 of the Data Protection Act. [18] 2.3.1. On the one hand, these refer to the enforcement of information pursuant to Art 15 (1) first half-sentence, i.e. whether personal data are processed at all (against enforcement pursuant to Art 79 (1), i.e. whether personal data are processed at all): Kreße in Sydow, EU-Previous search termDSGVNext search term² [2018] Art 79 Rz 15 ff; weighing Martini in Paal/Pauly, Previous search termDSGVNext search term/BDSG² [2018] Art 79 Previous search termDSGVNext search term Rz 22a; for the opening of a judicial remedy: Bergt in Kühling/Buchner, Previous search termDSGVONnext search term/BDSG³ [2020] Art 79 Rz 6, 9; Leupold/Schrems in Knyrim, DatKomm, 16. Lfg [2018] Art 79 Rz 13). 19] The plaintiff is not seeking such information here; it is undisputed that the defendant processes his personal data. [20] 2.3.2 There is also disagreement in the literature as to whether the rights to information under Articles 12 to 15 of the Prior Search Data Protection Act can only be enforced under Article 79(1) of the Prior Search Data Protection Act if the data subject alleges data processing in breach of the Ordinance - and not merely a breach of a right to information. 21] This question is addressed in the present case. Article 15(3) of the GDPR does not make the right to be provided with a copy of the personal data processed dependent on the alleged unlawfulness of the processing. The plaintiff does not even question the lawfulness of the data processing by the defendant, but only requests the provision of a copy. Based on the wording of Article 79(1) of the EU Data Protection Regulation, Kreße argues that the mere infringement of information rights cannot be asserted by way of a judicial remedy. Rather, the data subject must claim that his or her rights have been violated by a "processing of his or her personal data which does not comply with this Regulation" (Kreße in Sydow, EU-Vorheriger SuchbegriffDSGVONächster Suchbegriff² Art 79 Rz 18). 23] According to Leupold/Schrems, on the other hand, the processing on the basis of which the information rights have arisen does not itself have to be in breach of the Regulation for the data subject to have a right of action under Article 79(1) of the EU Privacy Regulation (Leupold/Schrems in Knyrim, DatKomm, Art 79 of the EU Privacy Regulation); in this sense also Martini in Paal/Pauly, Vorheriger SuchbegriffDSGVONächster Suchbegriff/BDSG² Art 79 Vorheriger SuchbegriffDSGVONächster Suchbegriff Rz 22). Rather, processing is already not in compliance with the previous search termDSGV next search term if the rights of the data subject to information and disclosure are violated (Bergt in Kühling/Buchner, Vorheriger SuchbegriffDSGVONächster Suchbegriff/BDSG³ Art 79 Previous search termDSGV next search term margin no. 9; cf. Leupold/Schrems in Knyrim, DatKomm, Art 79 margin no. 14). In the opinion of the Senate, systematic considerations also speak in favour of the second interpretation, which is oriented towards the effectiveness of law enforcement: According to the wording of Article 77 (1) of the GDPR, the right to lodge a complaint with a supervisory authority also presupposes that the data subject is of the opinion that the processing of personal data relating to him or her violates the GDPR. 25] If, in order to enforce the right to a copy of the personal data processed pursuant to Art 15(3) of the GDPR, one required - in each case based on the wording of the provisions - an allegation of processing in breach of or inconsistent with the Regulation pursuant to both Art 77(1) of the GDPR and Art 79(1) of the GDPR, the right to be provided with a copy pursuant to Article 15(3) of the previous search term Data Protection Ordinance would not be covered by either Article 77(1) or Article 79(1) of the previous search term Data Protection Ordinance in the case of (allegedly) lawfully processed data. This would result in incomplete legal protection under the system of the Previous search termDSGVNext search term, which the Union legislature could not be expected to accept. 2.4 The Discerning Division therefore agrees with the view that affirms the admissibility of a judicial remedy pursuant to Article 79 (1) of the Previous Search Term Data Protection Act, also for the assertion of the right to be provided with a copy pursuant to Article 15 (3) of the Previous Search Term Data Protection Act, irrespective of whether or not the plaintiff alleges a violation of the Previous Search Term Data Protection Act by the data processing that has taken place. 2.5 In the case of a violation of the fundamental right to data protection, the interference with the most personal legal sphere is in the foreground, even if the legal consequence of a violation of the fundamental right can be a monetary claim for damages (6 Ob 127/20z; 6 Ob 134/20d). On the basis of this consideration, the specialised court has already denied the necessity of an evaluation statement according to § 500 para 2 subpara 1 ZPO for a claim for the provision of information according to Art 15 para 1 Previous search termDSGVNext search term (6 Ob 127/20z). Nothing else can apply to the assertion of the claim for a copy of the data pursuant to Art 15 (3) of the previous search termDSGVONnext search term. 28] In the present case, the fact that the defendant is prepared to provide a copy of the plaintiff's medical history in return for payment of EUR 51.10 is therefore irrelevant, as is the assessment made by the Court of Appeal. (29) 3. Justification of the claim According to § 17a para 2 lit g WrKAG, the patient has the right to inspect the patient's medical history or to have a copy of the medical history made against reimbursement of costs. According to the case-law of the Court of Justice of the European Union, the national court, which is required to apply the provisions of Union law within its jurisdiction, is required to ensure the full effectiveness of those provisions by disapplying, if necessary, any contrary provision of national law on its own authority (RS0109951 [T3]). 32] Based on this case law, the lower courts assessed the claimant's claim in accordance with the provisions of the Previous search termDSGVNext search term. The parties do not dispute the qualification of the defendant as a data controller and the plaintiff as a data subject within the meaning of Article 15, Article 4(1) and Article 7 of the Regulation. However, the defendant takes the view that Article 15(3) of the previous search term data protection act/next search term does not apply to the claim asserted - and therefore cannot take precedence over Article 17a(2)(g) of the WrKAG - because the right to "production of a copy of the medical history" pursuant to Article 17a(2)(g) of the WrKAG is not congruent with the claim pursuant to Article 15(3) of the previous search term data protection act/next search term. This follows from the fact that the medical history must have the entire content provided for in section 17(1) WrKAG, which goes beyond a copy of the personal data pursuant to Art 15(3) Previous search termDSGVNext search term. 34] This line of argument cannot be followed. Pursuant to Article 15(3) of the previous search term Data Protection Act, the next search term, a copy of the personal data that are the subject of the processing must be made available. Pursuant to Article 4(1) of the GDPR, personal data means any information relating to an identified or identifiable natural person, whereby an identifiable person is one who can be identified, directly or indirectly. As the lower courts have already pointed out, the legislator of the Regulation expressly assumes that the data subject's right of access also includes his or her own health-related data, such as data in the patient's files, diagnoses, examination results, findings of the doctors providing follow-up treatment and information on treatments or interventions (Previous search termDSGVNext search term Recital 63). 4.3 The fact that the production of copies of medical records is a case of application of Art. 15 (3) of the Act was also recognised by the Austrian federal legislator (cf. Explanatory Memorandum 108 BlgNR 26. GP 61 on § 10 (1) 4a of the KAKuG). This is also unconstrainedly seen in the literature (Kopetzki, Krankenanstaltenrecht, in Holoubek/Potacs, Öffentliches Wirtschaftsrecht4 [2019] 535). 4.4 The Defendant does not specifically state which of the circumstances to be documented in the medical records pursuant to § 17 (1) WrKAG it does not consider to be data relating to the Plaintiff. This is also not evident. If the medical records contained data that did not relate to the plaintiff, it would have been up to the defendant to bring this forward. However, this would not necessarily result in the dismissal of the action. Rather, in such a case, the data subject would have a claim to the provision of a partial copy containing only the personal data or in which the other data are made unrecognisable (cf. Bäcker in Kühling/Buchner, Vorheriger SuchbegriffDSGVONächster Suchbegriff/BDSG³ Art 15 Vorheriger SuchbegriffDSGVONächster Suchbegriff Rz 41). The copy must be complete (Bäcker in Kühling/Buchner, Vorheriger SuchbegriffDSGVONächster Suchbegriff/BDSG³ Art 15 Vorheriger SuchbegriffDSGVONächster Suchbegriff Rz 41). The handing over of the patient's letter is therefore not sufficient. Pursuant to Article 15(3) of the Data Protection Act, the controller shall provide a copy of the personal data undergoing processing; for any further copies requested by the data subject, the controller may charge a reasonable fee based on the administrative costs. 41] Pursuant to Art 12(5) of the previous search term Data Protection Act, "all notifications and measures pursuant to Articles 15 to 22 and 34 of the previous search term Data Protection Act shall be provided free of charge". In the case of manifestly unfounded or - especially in the case of frequent repetition - excessive requests by a data subject, the controller may either charge a reasonable fee, which takes into account the administrative costs of informing or notifying the data subject or of implementing the requested measure (Art 12(5)(a)Previous search termPrivilege Data Protection Act), or refuse to act on the request (Art 12(5)(b)Previous search termPrivilege Data Protection Act). The controller must provide evidence of the manifestly unfounded or excessive nature of the request (Art 12(5), last sentence, previous search termDSGDOnext search term). [42] 5.2. It is derived from these provisions that the first copy of the personal data is free of charge for the data subject (Bäcker in Kühling/Buchner, Vorheriger SuchbegriffDSGVONächster Suchbegriff/BDSG³ Art 15 Vorheriger SuchbegriffDSGVONächster Suchbegriff Rz 45; Dix in Simitis/Hornung/Spiecker, Datenschutzrecht [2019] Art 12 Previous search termDSGVONachster Suchbegriff Rz 30, Art 15 Rz 30; Ehmann in Ehmann/Selmayr, DS-GVO² [2018] Art 15 Rz 28; Paal in Paal/Pauly, Previous search termDSGVNext search term/BDSG² Art 15 Previous search termDSGVNext search term Rz 34 f; Franck in Gola, DS-GVO² [2018] Art 15 Rz 32; Stollhoff in Auernhammer, Previous search termDSGVNext search term/BDSG6 [2018] Art 15 Rz 30; Specht in Sydow, EU-Previous search termDSGVONächster Suchbegriff² Art 15 Rz 20; Diregger, Handbuch Datenschutzrecht [2018] 733; Souhrada-Kirchmayer, Das Auskunftsrecht nach der Datenschutz-Grundverordnung, Jahrbuch Datenschutzrecht 2017, 75, 80). As an interim result, it should therefore be noted that the patient's right to be provided with a copy of his or her medical history, whereby the first copy must be provided free of charge, arises in principle from Art 15(3), Art 12(5) Prior search termDSGVNext search term. 6.1 Restrictions on the rights of data subjects granted in Article 15 of the Regulation on the Protection of Individuals with regard to the Processing of Personal Data (previous search term) must, insofar as they go beyond Article 15(4) of the Regulation on the Protection of Individuals with regard to the Processing of Personal Data (previous search term) (not relevant here), meet the requirements of Article 23 of the Regulation on the Protection of Individuals with regard to the Processing of Personal Data (previous search term) (Dix in Simitis/Hornung/Spiecker, Datenschutzrecht, Art 15 of the Regulation on the Protection of Individuals with regard to the Processing of Personal Data (previous search term), margin no. 36). This also applies to the restriction of gratuitousness. 6.2 In the present case, it must therefore be assessed whether the right to be provided with a free initial copy of the medical history is restricted by Article 17a(2)(g) WrKAG in a manner permissible under Article 23 Previous search termDSGVOnext search term, or whether the remuneration rule of Article 17a(2)(g) WrKAG must remain inapplicable as national law that is contrary to the Previous search termDSGVOnext search term. 6.3 In this context, it must first be pointed out that the federal legislature amended the basic provision of section 10(1)(4a) of the KAKuG in the 2nd Data Protection Amendment Act 2018 (Federal Law Gazette I 37/2018) in order to bring it into line with Article 15(3) of the Act (Explanatory Report 108 BlgNr 26. GP 61) with regard to the obligation to reimburse costs for transcripts of medical records. According to the current version of section 10(1)(4a) of the KAKuG, hospitals are obliged by provincial legislation to grant patients access to their medical records and to allow copies to be made "in accordance with Article 15(3) of the previous search termDSGV next search term". The previous regulation, according to which the production of copies was to be made possible "against reimbursement of costs", was amended. The federal legislator thus takes into account the concerns that can be derived from Art 15 (3) of the previous search term Data Protection Act against a cost reimbursement obligation, but does not oblige the Laender to provide for gratuitousness in the implementing legislation. 6.4 In the literature, Kopetzki concludes from Article 15(3) of the Act that the first copy of the medical history must be handed over to the patients of a hospital free of charge (Kopetzki in Holoubek/Potacs, Öffentliches Wirtschaftsrecht4 535). [48] Jahnel argues with regard to the comparable provision of section 51(1) last sentence ÄrzteG, according to which the doctor is obliged to grant the patient access to the documentation or to enable the production of copies against reimbursement of costs, that the possibility of reimbursement of costs is in conflict with the directly applicable Art 12(5) Previous search termDSGVNext search term (Jahnel, Auswirkungen der Previous search termDSGVNext search term in im medizinischen Bereich, RdM 2019/123, 248, 258). [49] Whether the cost bearing rules could be based on the opening clause of Art 23 Previous search termDSGVONnext search term is not addressed by either author. [50] 6.5. On the other hand, Haidinger considers - albeit without a conclusive opinion - that the obligation to reimburse costs for transcripts from the patient's file provided for in the hospital laws of the Länder could be based on Art 23 (1) lit e Previous search termDSGVOnext search term (Haidinger in Knyrim, DatKomm Art 16, 17 Previous search termDSGVOOnext search term Rz 60; dies, Darf ein Krankenhaus nach der Previous search termDSGVONächster Suchbegriff einen Kostenersatz für Auskunftsanträge verlangen? DaKo 2018/18, 21). [51] 6.6 The legal situation in Germany shows a comparable conflict between gratuitousness under Art 15(3), Art 12(5) Previous search termDSGVOnext search term and national law. According to Section 630g (2) of the German Civil Code (BGB), the patient may request (also electronic) copies of the patient's file; he or she must reimburse the costs incurred to the practitioner for this. 52] The obligation of the patient to bear the costs is viewed critically in the commentary literature: It contradicts Art 12 (5), Art 15 (1) and (3) (Wagner in MüKo BGB8 [2020] § 630g BGB Rz 29). There is some evidence that the Union law provision supersedes the cost bearing rule of § 630g BGB due to its primacy of application (Rehborn/Gescher in Erman, BGB16 [2020] § 630g Rz 1; cf. Wagner in MüKo BGB8 630g Rz 4, 6). [53] Walter/Strobl (Erweiterte Auskunfts- und Einsichtsrechte in Patientenakten, MedR 2018, 472, 477) consider the opening clause under Art 23(2)(i) second case Previous search termDSGVNext search term - protection of the rights and freedoms of other persons - but after detailed consideration come to the conclusion that the obligation to bear the costs under section 630g(2) BGB is inapplicable. In the present case, the Court of Appeal took the legal view that the patient's obligation to bear the costs for the production of a copy of the medical history pursuant to section 17a(2)(7g) WrKAG qualified as a permissible restriction of the rights of the person concerned pursuant to Article 23(1)(e)Previous search termDSGVNext search term. The appellant counters this assessment by arguing that the Austrian legislature did not impose any restriction on the rights of the persons concerned on the basis of a legal provision; the Court of Appeal wrongly considered the economic aspect to be essential; this leads to an unobjective differentiation between private and public hospitals. Article 23 of the previous search term of the Data Protection Act allows the Union and the Member States to create or maintain exceptions to the rights of data subjects, including the rights under Article 15 of the previous search term of the Data Protection Act and the procedural provisions of Article 12 of the previous search term of the Data Protection Act (Haidinger in Knyrim, DatKomm, Art 23 of the previous search term of the Data Protection Act, Rz 1). 57] The restriction must take the form of "legislative measures", respect the essence of fundamental rights and freedoms, be necessary and proportionate in a democratic society, pursue one of the objectives listed in a taxonomy and meet certain requirements (see only Haidinger in Knyrim, DatKomm, Art 23 Vorheriger SuchbegriffDSGVONächster Suchbegriff Rz 7; Peuker in Sydow, EU-Vorheriger SuchbegriffDSGVONächster Suchbegriff² Art 23 Rz 1; ua). 7.4 Legislative measures within the meaning of this provision are not only laws in the formal sense, but also legal acts that have acquired external effect through publication that is appropriate and accessible to every citizen, such as national regulations of administrative authorities (Haidinger in Knyrim, DatKomm, Art 23 Previous search termDSGVONnext search term Rz 8). 7.5 The respect for the essence of fundamental rights and freedoms required by Article 23 (1) of the Data Protection Act refers to the standard of the Charter of Fundamental Rights. The reference to the essence of the Charter (Article 52 CFR) makes it clear that the rights of data subjects under Articles 12 to 22 and 34 of the previous search term of the Data Protection Act have the character of concretising fundamental rights (Dix in Simitis/Hornung/Spiecker, Datenschutzrecht, Art 23 of the previous search term of the Data Protection Act, para. 13). 60] In the present case, therefore, Article 8 CFR on the protection of personal data must be observed. Pursuant to Art 8 (2) sentence 2 GRC, every person has the right to obtain information on data collected concerning him or her and to have the data rectified. [61] Moreover, a rule which does not provide for the possibility for the citizen to obtain access to the personal data concerning him or to obtain their rectification or erasure by means of a judicial remedy violates the essence of the fundamental right to effective judicial protection enshrined in Art 47 of the Charter (ECJ C-362/14, EU:C:2015:650, Schrems, para 95). [62] 7.6. It can be inferred from the objectives mentioned in Article 23(1) of the Data Protection Act as a whole that the concern to save certain data controllers the effort involved in fulfilling the rights of data subjects can only be a suitable purpose of restriction if one of the legal interests mentioned in paragraph 1 would otherwise be impaired by the effort (Bäcker in Kühling/Buchner, Vorheriger SuchbegriffDSGVONächster Suchbegriff/BDSG³ Art 23 Vorheriger SuchbegriffDSGVONächster Suchbegriff Rz 12). Article 23(1)(e) of the GDPR next search term recognises the protection of other important objectives of general public interest, in particular an important economic or financial interest of the Union or of a Member State, (inter alia) in the field of public health and social security, as a legitimate aim of restriction. The area of public health and social security were newly included in Art 23 (1) lit e Previous search termDSGVNext search term compared to the predecessor provision of Art 13 DSR, which only identified monetary, budgetary and fiscal matters as cases of important economic or financial interests (Peuker in Sydow, EU-Previous search termDSGVNext search term² Art 23 Rz 27). 64] As follows from the qualification as an "important" economic or financial interest, the rights of data subjects may not be restricted for every objective lying in the public interest (Dix in Simitis/Hornung/Spiecker, Datenschutzrecht, Art 23 Vorheriger SuchbegriffDSGVONächster Suchbegriff Rz 27; Herbst in Auernhammer, Vorheriger SuchbegriffDSGVONächster Suchbegriff/BDSG6 Art 23 Rz 15). Rather, a balancing of the state interest and the data subject's interest under data protection law is required (Paal in Paal/Pauly, DS-GVO/BDSG² Art 23 Rz 31). [65] 7.8. The objective of protection of data subjects and other persons mentioned in Art 23(1)(i) of the Data Protection Act also includes the protection of the controller (Bäcker in Kühling/Buchner, Vorheriger SuchbegriffDSGVONächster Suchbegriff/BDSG³ Art 23 Rz 32), but economic interests or a high level of effort on the part of the controller in fulfilling the rights of data subjects are generally not sufficient for this (Haidinger in Knyrim, DatKomm, Art 23 Vorheriger SuchbegriffDSGVONächster Suchbegriff Rz 21; Dix in Simitis/Hornung/Spiecker, Datenschutzrecht, Art 23 Vorheriger SuchbegriffDSGVONächster Suchbegriff Rz 32; Bäcker in Kühling/Buchner, Vorheriger SuchbegriffDSGVONächster Suchbegriff/BDSG³ Art 23 Rz 32; Herbst in Auernhammer, Vorheriger SuchbegriffDSGVONächster Suchbegriff/BDSG6 Art 23 Rz 19). 7.9 Exceptions to the requirements of Union law on data protection must be limited to what is necessary (Dix in Simitis/Hornung/Spiecker, Datenschutzrecht [2019] Art 23 Rz 17). The proportionality test must take into account that the restriction must be necessary to achieve the purpose of the restriction and that the benefit of the restriction must not be disproportionate to the risks and impairments for the data subjects (Bäcker in Kühling/Buchner, Vorheriger SuchbegriffDSGVONächster Suchbegriff/BDSG³ Art 23 Vorheriger SuchbegriffDSGVONächster Suchbegriff Rz 58). The restriction must be the mildest, least intrusive means of achieving one of the objectives set out in Article 23(1) of the Regulation (Dix in Simitis/Hornung/Spiecker, Datenschutzrecht, Art 23DSGVO Rz 18). 67] The restricted right of the data subject, the purpose of the restriction and the modalities of the data processing are significant for the concretisation (Bäcker in Kühling/Buchner, Vorheriger SuchbegriffDSGVONächster Suchbegriff/BDSG³ [2020] Art 23 Rz 58). As a rule, the application of the restriction rule will require the possibility of an assessment in the individual case (Bäcker in Kühling/Buchner, Vorheriger SuchbegriffDSGVONächster Suchbegriff/BDSG³ Art 23 Rz 58; Dix in Simitis/Hornung/Spiecker, Datenschutzrecht, Art 23 Vorheriger SuchbegriffDSGVONächster Suchbegriff Rz 3). However, a field exception, i.e. an exception for a certain category of data and/or data controllers, may also be proportionate by way of exception (Bäcker in Kühling/Buchner, Vorheriger SuchbegriffDSGVONächster Suchbegriff/BDSG³ Art 23 Rz 58). [68] 7.10. Finally, Article 23(2) of the Privacy Act provides for substantive requirements for restriction regulations, which on the one hand describe the subject matter and scope of the restriction as precisely as possible (lit a, b, c and e), and on the other hand (lit d, f, g, h) - as a consequence of the principle of proportionality - concern protective measures as compensation for the restriction of the rights of the data subjects (Haidinger in Knyrim, DatKomm, Art 23 of the Privacy Act, no. 24 f). However, Art 23(2) of the previous search termDSGV next search term does not stipulate a mandatory minimum content of a restrictive provision; whether the content addressed is relevant rather results from the nature of the restrictions (Haidinger in Knyrim, DatKomm, Art 23 of the previous search termDSGV next search term margin no. 24 f). In the present case, the restriction of the gratuitousness of the first copy as stipulated in Art 15 (3) and Art 12 (5) of the previous search term Data Protection Act is carried out by way of a Provincial Act. This is undoubtedly a legislative measure within the meaning of Article 23 (1) of the previous search term Data Protection Act. 8.2 A violation of the essence of the rights to receive a copy of data guaranteed by the Previous Search Term Data Protection Act and the CFR does not result solely from the obligation to reimburse costs at issue here. It is important to note that the right to receive a copy of data is not excluded, but only limited in its exercise by a payment obligation based on the number of copies. 8.3 With regard to the restriction objectives listed in Article 23(1) of the Data Protection Act, it is obvious that Section 17a(2)(g) of the WrKAG aims to reduce the economic burden on hospitals caused by the production of copies of the data processed by them. In the opinion of the Discerning Panel, this objective cannot be subsumed under Art 23(1)(i) of the previous search termDSGV next search term, because this provision does not suffice to seek to reduce the burden on the data controller. 8.4 On the other hand - as the Court of Appeal rightly recognised - the objective of Article 23(1)(e) of the Prior Search Term Data Protection Act is affected. It is obvious that the restriction of the free-of-charge nature of the first copy of the medical history in the area of publicly financed hospitals, as ordered by Art 15 (3), Art 12 (5) of the previous search term Data Protection Act, serves the financial interests of the financing regional authority. 8.5 Even if § 17a para 2 lit g WrKAG provides for an exception for certain groups of responsible persons (hospitals) and certain data (the medical history), this does not conflict with the proportionality of the regulation here. On the contrary, such an exception corresponds to the structure of Art 23 (1) (e) Previous search termDSGVNext search term, which explicitly recognises important financial interests concerning a specific area, namely public health and social security, as a reason for restriction. [74] 8.6. The substantive requirements addressed in Art 23(2) Previous search termDSGVONext search term result from the unambiguous wording of Section 17a(2)(g) WrKAG with regard to the subject matter and scope of the restriction; the objective pursued (protection of the financial interests of hospitals) is recognisable from the subject matter of the regulation itself and therefore does not require any further reference in the legal provision itself (cf. Haidinger in Knyrim, DatKomm, Art 23 Vorheriger SuchbegriffDSGVONächster Suchbegriff Rz 24, Art 15 Vorheriger SuchbegriffDSGVONächster Suchbegriff Rz 60). [75] 8.7. The fact that section 17a(2)(g) WrKAG is the older provision in comparison to the previous search termDSGVOnext search term does not prevent it from being qualified as a restriction permissible under Article 23 previous search termDSGVOnext search term, because Article 23 previous search termDSGVOnext search term also allows Member States to maintain existing restrictions (Paal in Paal/Pauly, Vorheriger SuchbegriffDSGVONächster Suchbegriff/BDSG² Art 23 Rz 1; Haidinger in Knyrim, DatKomm Art 23 Vorheriger SuchbegriffDSGVONächster Suchbegriff Rz 1). 8.8 Since in this case a restriction objective recognised by Article 23(1) of the previous search term Data Protection Act - important economic and financial interests in the area of public health and social security - is pursued with a fundamentally suitable means - the ordering of a cost reimbursement obligation for copies of the medical history - the weighing of the weight of the pursued interests of the responsible parties (the hospitals) and the persons whose rights are restricted (the patients) within the framework of the proportionality test proves to be decisive. 77] In this context, it must be taken into account that hospitals are legally obliged to process personal data of their patients (see only § 17 WrKAG; § 10 para 1 KAKuG [basic provision]). It must also be taken into account that § 17a para 2 lit g WrKAG allows patients to (merely) inspect their medical history free of charge. 8.9 Whether the obligation to reimburse costs for the production of the first copy of the medical history, as provided for in § 17a (2) (g) WrKAG, complies with the principle of proportionality, cannot yet be conclusively assessed on the basis of the current results of the proceedings. 79] There is no factual basis that allows an even approximate assessment of the economic weight of the costs associated with the provision of transcripts for the hospitals. For example, it is not known what approximate proportion of patients request further copies of the medical history in addition to the patient letter, nor whether the cost contributions levied by the defendant are, as claimed, based on their actual administrative burden; nor was it otherwise discussed with the defendant from which circumstances a possible relevant economic burden results. 80] This makes it necessary to reverse the decisions of the lower courts. 81] The questions of the economic weight of the production of copies of patients' medical records as well as the amount of the cost contributions to be borne by the patients will have to be discussed with the parties on the basis of the principles described. Based on this, additional findings must be made that allow a proportionality test to be carried out within the meaning of Article 23 of the Regulation. The reservation of costs is based on § 52 ZPO.
