European Debate: Should People be Allowed to Have Access to Their Personal Data?
- Privacy Law In Canada
- Nov 14, 2023
- 2 min read
Updated: Apr 18, 2024
November 14th, 2023
The Court of Justice of the European Union (CJEU) issued a judgment in the case of FT v. DW, clarifying key provisions on data subject access requests. The case involved a patient (DW) who requested a free initial copy of their medical records from a dentist (FT) suspected of malpractice. The dentist refused, citing German national law requiring patients to cover costs for obtaining copies of medical records. The CJEU addressed three main questions:
Right to Access Personal Data: The CJEU clarified that a controller, such as a medical practitioner, is obligated to offer an individual a free copy of their personal data, even if the reason for the request isn't explicitly listed in the GDPR's Recital 63. The court concluded that the GDPR mandates controllers to provide a free first copy of processed personal data to individuals, irrespective of the reason for the request.
Balancing Economic Interests: The court examined whether national legislation, established before the GDPR, can require data subjects to bear the costs for a first copy of their processed personal data. It found that such legislation cannot make data subjects pay for the first copy to protect the controller's economic interests.
Access to Complete Medical Records: The CJEU clarified that patients are entitled to a comprehensive reproduction of their medical data, not just a summary. The court emphasized that patients should receive an accurate and clear copy of all their data, and controllers may be obliged to provide entire documents if it helps the data subject effectively exercise their rights.
In summary, the judgment reinforces individuals' right to a free initial copy of their personal data, restricts the ability of national legislation to impose fees on data subjects for the first copy, and ensures that patients receive a comprehensive reproduction of their medical data.
For more information please visit: https://iapp.org/news/a/cjeu-rules-individuals-have-right-to-free-copy-of-their-personal-data/