Official Journal of the European Union

Series C

C/2023/1109

4.12.2023

(Case C-307/22, (1) FT (Copies of medical records))

(Reference for a preliminary ruling - Processing of personal data - Regulation (EU) 2016/679 - Articles 12, 15 and 23 - Data subject’s right of access to his or her data undergoing processing - Right to obtain a first copy of those data free of charge - Processing of a patient’s data by his or her medical practitioner - Medical records - Reasons for the request for access - Use of data for the purpose of triggering the liability of the person providing treatment - Concept of ‘copy’)

(C/2023/1109)

Language of the case: German

Referring court

Parties to the main proceedings

Appellant on a point of law: FT

Respondent in the appeal on a point of law: DW

Operative part of the judgment

1.Article 12(5) and Article 15(1) and (3) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), must be interpreted as meaning that the controller is under an obligation to provide the data subject, free of charge, with a first copy of his or her personal data undergoing processing, even where the reason for that request is not related to those referred to in the first sentence of recital 63 of that regulation.

2.Article 23(1)(i) of Regulation 2016/679 must be interpreted as meaning that a piece of national legislation adopted prior to the entry into force of that regulation is capable of falling within the scope of that provision. However, such a possibility does not permit the adoption of a piece of national legislation which, with a view to protecting the economic interests of the controller, makes the data subject bear the costs of a first copy of his or her personal data undergoing processing.

3.The first sentence of Article 15(3) of Regulation 2016/679 must be interpreted as meaning that, in the context of a doctor-patient relationship, the right to obtain a copy of personal data undergoing processing means that the data subject must be given a faithful and intelligible reproduction of all those data. That right entails the right to obtain a full copy of the documents included in his or her medical records and containing, inter alia, those data if the provision of such a copy is essential in order to enable the data subject to verify how accurate and exhaustive those data are, as well as to ensure they are intelligible. Regarding data relating to the health of the data subject, that right includes in any event the right to obtain a copy of the data in his or her medical records containing information such as diagnoses, examination results, assessments by treating physicians and any treatment or interventions provided to him or her.

(1) OJ C 311, 16.8.2022.

ELI: http://data.europa.eu/eli/C/2023/1109/oj

ISSN 1977-091X (electronic edition)