Resolutions, opinions and reports search tool

The data protection regulations do not prevent the complainant from communicating the information he requests, regarding access to his clinical history, including the identity of the professionals, rank and professional category, who have accessed it.

The claiming entity has not accredited that it has responded to the request for rectification exercised by the claimant.

It is appropriate to estimate the claim, since the ICS did not respond in time to the request of the claimant. Regarding the fund, it is not appropriate to make any pronouncement or require any action, since the ICS has accredited that it has delivered the documentation to the claimant in the requested terms, that is, it has made effective the right exercised by the claimant, although extemporaneously.

The person making the complaint showed that her HC3 was accessed from CABO Centelles on four occasions, during the months of May 2022, despite not having been visited at that health center. In response, the DPD of the reported entity has confirmed that it is the material author of the accesses and has justified them by arguing that they were necessary to be able to respond to a request for information that this Authority notified to the aforementioned entity, within the framework of another complaint. filed by the same person complaining. In relation to this, during the prior information phase it was found that the accesses carried out by the personal data protection delegate to the complainant's HC3 were justified, given that they were carried out in the exercise of his duties. , and to respond to a request from this Authority. For all this, the filing of these proceedings is appropriate.

Resolution with ammunation in the sanctioning procedure against the Garraf Health Consortium, Hospital Residencia Sant Camil, due to violation of the principle of accuracy. For having used a mobile phone that had in its database since 2011, instead of using the telephone provided with the derivation of the Sitges EAP, 2022.

One person reported that he had received a call from a call centre for the purposes of COVID-19 vaccination, in which he was asked why he did not want to be vaccinated, and was informed that the call would be recorded. The Authority processed a sanctioning procedure against the Department of Health, who was warned for not having fulfilled the duty of information provided for in art. 13 RGPD. At the same time, he filed the rest of the reported facts, since, on the one hand, it was found that the call had been made by SEMSA, on behalf of the CatSalut, to whom the Department had commissioned to make those calls; and on the other hand, it was found that the collection of the reason for not wanting to be vaccinated (by free will) was protected by the applicable health regulations.

The filing of the complaint is necessary for the following reasons: 1) It is accredited that no improper access has been made to the clinical history of the complainant. 2) In this case, it is considered that giving an extemporaneous response and requesting to fill in a specific form are management irregularities that do not have enough entity to start a sanctioning procedure.

It is resolved to declare that the Department of Health has committed the infringement provided for in Article 83.5a), in relation to Article 5 RGPD, which contemplates the principle of accuracy of personal data, since the platform "My Health" of the complainant contains inaccurate information about health professionals who would have attended it in different medical consultations. The discord is also manifested between the information contained on the one hand in the HC of the health center and the HC3; and on the other hand, in the information that appears in the LMS viewer.

The person making the complaint complained of improper access to his or her medical records. It is resolved to archive the proceedings to the extent that within the framework of the prior information it has not been verified that any act that could constitute an infringement has occurred, while it has been sufficiently justified that the controversial access was carried out within the framework of the tasks assigned to the professional who carried it out.

The archiving of the actions is resolved since the reported entity has justified that the controversial access to HC3 of the complainant was caused by a typing error, within the framework of the RedCov project, in which certain parameters had to be consulted in various clinical stories.