14.02.2021
In Articles 12ff, the GDPR stipulates rights that data subjects can assert against data processors (= controllers). This includes the right to information under Article 15 GDPR, which is very relevant in practice, according to which controllers are obliged to disclose, among other things, whether they process data of the data subject, for what purpose they process it, where they got this data from and how long they expect to store this data. In addition, the controller must provide a free copy of the processed data. Only the first copy must be free of charge; a reasonable fee can be charged for additional copies. In Article 23 GDPR, the European legislator has formulated one (of many) opening clauses in this context, which allows member states to restrict the rights of data subjects under the GDPR to a certain extent, in other words: to make different regulations as part of any national implementation. Such a restriction of the rights of data subjects can take place in countless ways, one of which would be to allow controllers to charge a reasonable fee for the first copy in the sense of the right to information.
In a case (6 Ob 138/20t of December 17, 2020), the Supreme Court dealt with the question of whether a national standard, namely Section 17a Paragraph 2 Letter g of Wr KAG, which allows (Viennese) hospitals to charge a fee for a copy of the medical history, was in line with Article 23 of the GDPR. Section 17a Paragraph 2 Letter g of Wr KAG was not introduced in response to the GDPR, but existed beforehand. In the case in question, the plaintiff had requested that the medical history be transmitted; the defendant, the hospital, made this transmission dependent on the payment of the legally stipulated costs. The action was therefore for the (free) release of the medical history. The first instance court had affirmed the claim for release on the basis of the provisions of the General Data Protection Regulation; the appeal court had denied this claim (as a result of the appeal by the defendant hospital) and dismissed the action. The plaintiff appealed against this to the Supreme Court:
In this regard, the Supreme Court stated that standards that are older than the GDPR continue to apply, since Article 23 of the GDPR also allows member states to continue to maintain existing restrictions. It is therefore not necessary for restriction standards to be issued (or reaffirmed) in response to the GDPR; rather, in individual cases, national "old stocks" can also be regarded as permissible restrictions.
The Supreme Court also examined the restriction as such and affirmed its (fundamental) admissibility: Article 23 GDPR in paragraph 1 requires a permissible aim for the restriction of the rights of the data subject. This includes, among other things, the financial interests of the health sector of a member state according to paragraph 1 lit f) leg cit. Section 17a paragraph 2 lit g Wr KAG pursues precisely this interest, since this provision protects hospitals from excessive administrative tasks - namely copying medical records.
However, the Supreme Court also stated that exceptions to the EU data protection requirements must be limited to what is absolutely necessary. The benefit of the restriction must not be disproportionate to the risks and impairments for the persons concerned, i.e. the restriction must be the mildest means of achieving one of the objectives set out in Article 23(1) GDPR that least interferes with fundamental rights. The balancing of the weight of the interests of the hospitals and patients in the context of the proportionality test is therefore crucial.
However, the Supreme Court was unable to make a final assessment as to whether the fee for the copy of the medical history complied with the principle of proportionality. There is no factual basis that allows even an approximate assessment of the economic importance of the expense associated with providing copies for hospitals, and it is not clear what approximate proportion of patients would request further copies of the medical history in addition to the patient letter. It is also not clear whether the cost contributions collected by the defendant were based on its actual administrative expenses, as claimed.
The Supreme Court therefore overturned the two judgments without replacement and referred the case back to the court of first instance. The court of first instance will have to discuss with the parties the economic importance of producing copies of patients' medical records and the amount of the cost contributions to be borne by the patients on the basis of the principles outlined. Based on this, additional findings must be made that allow a proportionality test to be carried out in accordance with Article 23 of the GDPR. The outcome is therefore unclear and will depend on the circumstances in the individual case. An unsatisfactory interim status of the proceedings.