Although the General Data Protection Regulation (GDPR) came into force more than six years ago, there are still problems with national laws that do not meet the requirements of the GDPR contradict. One particular example is the obligation to pay for a copy of one's own patient file, which is still regulated in the German Civil Code (BGB) and in the professional regulations of the medical professions. The Data protection conference has now decided to take action against this.
Clear ECJ ruling on free first copy of patient file
The Data protection conference (DSK) is the body of independent German data protection supervisory authorities at federal and state level. At its interim conference on September 11, 2024, the focus was on patient records, among other things.
Since the ruling of the European Court of Justice on October 26, 2023 (Case C-307/22) at the latest, it has been clear that every patient has the right to a free first copy of their patient file. A national regulation such as Section 630g (2) sentence 2 BGB must not impose a cost burden on the patient for this. For all further copies, the responsible However, the body may demand an appropriate fee based on the administrative costs.
According to the ECJ, a national regulation that was in force before the entry into force of the GDPR was issued, falls within the scope of Art. 23 para. 1 lit. i GDPR and thus limit the scope of the rights set out in Art. 15 GDPR restrict the data subject's right of access. However, such a possibility does not allow for the adoption of a national rule or the application of an existing rule which, in order to protect the economic interests of the controller, reimburses the data subject for the cost of a first copy of his or her personal data which are the subject of the data processing. Processing by the person responsible.
In its ruling, the ECJ also stated that the patient does not have to justify their request. The applicant's reasons for obtaining the copy are irrelevant.
Reading tip: ECJ ruling on data retention
Data protection authorities warn chambers about patient files
The German Data protection conference sees an urgent need for action in Germany in its resolution of September 11. The German government has already signaled that it will amend the BGB accordingly during this legislative period.
However, the professional regulations of the medical professional associations also contain regulations on the reimbursement of costs for the release of copies from the patient file (see Section 10 (2) a. E. Model Professional Code of the German Medical Association; Section 12 (4) Model Professional Code of the German Dental Association; Section 11 (1) Model Professional Code of the German Chamber of Psychotherapists), which correspond to the requirements of the GDPR and contradict the case law of the ECJ. However, it remains to be seen whether and when the necessary adjustments to professional law will be made.
The demand of the highest data protection authorities at federal and state level is more than clear: in the interests of a legal framework that is as uniform as possible and for reasons of legal clarity, the medical professional associations should promptly adapt their professional regulations to the requirements of the GDPR customize.
In conclusion, there is also an unusually harsh warning aimed directly at the chambers: "The existing civil and professional regulations, which stipulate that the patient must pay for the provision of an initial copy, are not applicable. Until the respective professional code of conduct has been amended, chamber members are to be encouraged to act in accordance with the law."
German 
English 
Italian 
French