Resolutions, opinions and reports search tool

Data protection regulations do not prevent the person from notifying the data they request, regarding access to their clinical history, including the identity of the professionals who have accessed it, in relation to the requested period.

According to Article 24.3 LTC, the resolution of the application for access to the clinical history of the applicant must be processed in accordance with the GDPR and the possible complaint must be processed before the Catalan Data Protection Authority, the competent authority to find out about the complaints in relation to the right of access provided for in Article 15 GDPR.

From the perspective of data protection regulations, providing the information relating to the cases attended to the traffic units, aggregated by sex and age "year by year, and not by age ranges", offers sufficient guarantees to be able to an effective anonymization of the health data of the affected persons will be considered.

The Public Health Agency of Catalonia communicated to the Labour Risk Prevention Services of the Catalan company in which it provides services denouncing the list of staff who did not have the complete pattern of vaccination against COVID-19. This communication was carried out within the framework of a vaccination campaign by the Health Department. In this respect, the communication in question does not contravene data protection regulations, insofar as both occupational risk prevention regulations and public health regulations empower health authorities to establish mechanisms for collaboration with the occupational risk prevention services of private companies.

The complainant complained that the Health Department would have disregarded two of his requests, one regarding copying a report and the other regarding images captured by the Department's video surveillance cameras. It is estimated in relation to the request for a copy of the report, given that although it is a reiteration request, it should have responded to the claimant by indicating this end; and it is dismissed with regard to video-monitor images, since they were deleted before the claimant submitted his request for access.

The Human Resources unit of a City Council ended up accessing, through its Occupational Risk Prevention Service, information on whether one of its workers had been inoculated with the 2nd dose of covid19.

It resolves to dismiss the request of the holder because restricting access to the health data of the holder, to all administrative, IT and citizen management staff of the Health Department, who may need access to it in the performance of their duties, would seriously distort the functioning and organisation of the health system. Furthermore, to the extent that the claimant also intended that the Ministry should enforce its right of opposition "in a global way and not individually", in relation to data relating to his or her health, which is treated at all Hospitals of Catalonia and Primary Care Centers, it is decided to also dismiss this claim, insofar as the Ministry of Health is not responsible for all the treatments pointed out by the claimant.

Revelation of health data to the complainant's father, the age of the person at the time of the event.

It is appropriate to file the complaint insofar as the access to HC3, made during the year 2020, was justified because it was for welfare and epidemiological surveillance reasons. As regards the alleged undue access to HC3, carried out during the year 2019, it is appropriate to file the actions due to prescription.

It is decided to sanction Badalona Health Services for the infringement of the principle of confidentiality, since the complained entity has confirmed that a worker from Badalona Municipal Hospital, managed by Badalona Health Services S.A, would have unduly accessed a third person's clinical history. The proposed sanction is EUR 2 000.