Commissioner (Cyprus) - 11.17.001.009.077: Difference between revisions
From GDPRhub
mNo edit summary |
No edit summary |
||
| Line 10: | Line 10: | ||
|ECLI= | |ECLI= | ||
|Original_Source_Name_1=Office of the Commissioner for Personal Data Protection | |Original_Source_Name_1=Office of the Commissioner for Personal Data Protection | ||
|Original_Source_Link_1=https://www.dataprotection.gov.cy/ | |Original_Source_Link_1=https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/all/F880C7270072D4E0C2258AAE0049CEAB/$file/%25CE%2591%25CE%25A0%25CE%259F%25CE%25A6%25CE%2591%25CE%25A3%25CE%2597%2520%25CE%2593%25CE%25B5%25CE%25A3%25CE%25A5%252077.pdf?openelement | ||
|Original_Source_Language_1=Greek | |Original_Source_Language_1=Greek | ||
|Original_Source_Language__Code_1=EL | |Original_Source_Language__Code_1=EL | ||
| Line 22: | Line 22: | ||
|Outcome=Upheld | |Outcome=Upheld | ||
|Date_Started=28.04.2021 | |Date_Started=28.04.2021 | ||
|Date_Decided= | |Date_Decided=21.12.2023 | ||
|Date_Published= | |Date_Published= | ||
|Year=2023 | |Year=2023 | ||
|Fine= | |Fine=1,500 | ||
|Currency=EUR | |Currency=EUR | ||
|GDPR_Article_1=Article | |GDPR_Article_1=Article 4(2) GDPR | ||
|GDPR_Article_Link_1=Article | |GDPR_Article_Link_1=Article 4 GDPR#2 | ||
|GDPR_Article_2=Article | |GDPR_Article_2=Article 5(1)(a) GDPR | ||
|GDPR_Article_Link_2=Article | |GDPR_Article_Link_2=Article 5 GDPR#1a | ||
|GDPR_Article_3= | |GDPR_Article_3= | ||
|GDPR_Article_Link_3= | |GDPR_Article_Link_3= | ||
|GDPR_Article_4= | |GDPR_Article_4= | ||
|GDPR_Article_Link_4 | |GDPR_Article_Link_4= | ||
|EU_Law_Name_1= | |EU_Law_Name_1= | ||
| Line 51: | Line 47: | ||
|National_Law_Link_2= | |National_Law_Link_2= | ||
|Party_Name_1= | |Party_Name_1= | ||
|Party_Link_1= | |Party_Link_1= | ||
|Party_Name_2= | |Party_Name_2= | ||
|Party_Link_2= | |Party_Link_2= | ||
|Appeal_To_Body= | |Appeal_To_Body= | ||
| Line 65: | Line 57: | ||
|Appeal_To_Link= | |Appeal_To_Link= | ||
|Initial_Contributor= | |Initial_Contributor=im | ||
| | | | ||
}} | }} | ||
The | The DPA fined a doctor €1,500 for an unauthorized access to data subjects’ medical records and failing to prove how she got a possession of the patient’s data. | ||
== English Summary == | == English Summary == | ||
=== Facts === | === Facts === | ||
The data subject filed a complaint with the DPA for an unauthorized access to her personal data through a General Health System (‘GHS’) portal. The data subject provided a screenshot of a notification showing that on 9 March 2021 a doctor specialised in endocrinology, the controller, accessed their medical records without any referral in force. It stated that the data subject provided consent for the access to her records, however, the doctor has never examined the data subject. | |||
The | The doctor objected the complaint claiming that they did not visit the GHS portal concerning the data subject. As she does not know the data subject, she stated that it is impossible for her know their personal data such as name, date of birth and ID number needed to access their records. She indicated a possible mistake in entering details in the portal while trying to locate another patient, however, no processing of the patient’s data took place. Further, she stated that there was no malicious intent on her part and she was continued being guided by medical confidentiality. | ||
=== Holding === | |||
The DPA took into the consideration the important element that both data subject and the controller did not know each other and that the controller never examined the data subject. | |||
However, it was emphasized that any argument rejecting the possibility that patient’s medical data were processed must be disregarded. Even the DPA specified that the possession of the data as well as the access to the patient’s file constitute acts of processing under [[Article 4 GDPR#2|Article 4(2) GDPR]]. | |||
For that reason, the controller must prove how the data subject’s personal data such as name, date of birth and ID number came into her possession and demonstrate the legal basis for its processing. The controller indicated the possibility of an inadvertent error, however, the DPA considers this argument infinitesimal, if not impossible. | |||
The | |||
Taking the above | Taking into account all of the above, the DPA decided that the controller failed to process the data lawfully and fairly in a transparent manner provided for in [[Article 5 GDPR#1a|Article 5(1)(a) GDPR]]. The DPA imposed an administrative fine of €1,500. | ||
== Comment == | == Comment == | ||
| Line 99: | Line 89: | ||
<pre> | <pre> | ||
</pre> | </pre> | ||
Revision as of 07:50, 2 April 2024
| Commissioner - 11.17.001.009.077 | |
|---|---|
 | |
| Authority: | Commissioner (Cyprus) |
| Jurisdiction: | Cyprus |
| Relevant Law: | Article 4(2) GDPR Article 5(1)(a) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 28.04.2021 |
| Decided: | 21.12.2023 |
| Published: | |
| Fine: | 1,500 EUR |
| Parties: | n/a |
| National Case Number/Name: | 11.17.001.009.077 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Greek |
| Original Source: | Office of the Commissioner for Personal Data Protection (in EL) |
| Initial Contributor: | im |
The DPA fined a doctor €1,500 for an unauthorized access to data subjects’ medical records and failing to prove how she got a possession of the patient’s data.
English Summary
Facts
The data subject filed a complaint with the DPA for an unauthorized access to her personal data through a General Health System (‘GHS’) portal. The data subject provided a screenshot of a notification showing that on 9 March 2021 a doctor specialised in endocrinology, the controller, accessed their medical records without any referral in force. It stated that the data subject provided consent for the access to her records, however, the doctor has never examined the data subject.
The doctor objected the complaint claiming that they did not visit the GHS portal concerning the data subject. As she does not know the data subject, she stated that it is impossible for her know their personal data such as name, date of birth and ID number needed to access their records. She indicated a possible mistake in entering details in the portal while trying to locate another patient, however, no processing of the patient’s data took place. Further, she stated that there was no malicious intent on her part and she was continued being guided by medical confidentiality.
Holding
The DPA took into the consideration the important element that both data subject and the controller did not know each other and that the controller never examined the data subject.
However, it was emphasized that any argument rejecting the possibility that patient’s medical data were processed must be disregarded. Even the DPA specified that the possession of the data as well as the access to the patient’s file constitute acts of processing under Article 4(2) GDPR.
For that reason, the controller must prove how the data subject’s personal data such as name, date of birth and ID number came into her possession and demonstrate the legal basis for its processing. The controller indicated the possibility of an inadvertent error, however, the DPA considers this argument infinitesimal, if not impossible.
Taking into account all of the above, the DPA decided that the controller failed to process the data lawfully and fairly in a transparent manner provided for in Article 5(1)(a) GDPR. The DPA imposed an administrative fine of €1,500.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
