Although the General Data Protection Regulation (GDPR) came into force more than six years ago, there are still problems with national laws that contradict the requirements of the GDPR. One particular example is the obligation to pay for a copy of one's own patient file, which is still regulated in the German Civil Code (BGB) and in the professional regulations of the medical professions. The Data Protection Conference has now decided to take action against this.
Clear ECJ ruling on free first copy of patient file
The Data Protection Conference (DSK) is the body of independent German federal and state data protection supervisory authorities. At its interim conference on September 11, 2024, the focus was on the patient file, among other things.
Since the ruling of the European Court of Justice on October 26, 2023 (Case C-307/22) at the latest, it has been clear that every patient has the right to a free first copy of their patient file. A national regulation such as Section 630g (2) sentence 2 BGB must not impose a cost burden on the patient for this. For all further copies, however, the responsible body may charge a reasonable fee based on the administrative costs.
According to the ECJ, a national regulation that was enacted before the GDPR came into force may fall within the scope of Art. 23 para. 1 lit. i GDPR and thus limit the scope of the data subject's right of access provided for in Art. 15 GDPR, among others. However, such a possibility does not permit the adoption of a national regulation or the application of an existing regulation which, in order to protect the economic interests of the controller, imposes on the data subject the costs of a first copy of their personal data which are the subject of processing by the controller.
In its ruling, the ECJ also stated that the patient does not have to justify their request. The applicant's reasons for obtaining the copy are irrelevant.
Reading tip: ECJ ruling on data retention
Data protection authorities warn chambers about patient files
In its resolution of September 11, the German Data Protection Conference sees an urgent need for action in Germany. The German government has already signaled that it will make a corresponding amendment to the German Civil Code before the end of this legislative period.
However, the professional regulations of the medical professional associations also contain regulations on the reimbursement of costs for the release of copies from the patient file (see Section 10 (2) a. E. Model Professional Code of the German Medical Association; Section 12 (4) Model Professional Code of the German Dental Association; Section 11 (1) Model Professional Code of the German Chamber of Psychotherapists), which contradict the requirements of the GDPR and the case law of the ECJ. However, it remains to be seen whether and when the necessary amendments to professional law will be made.
The demand from the highest data protection authorities at federal and state level is more than clear: in the interests of a legal framework that is as uniform as possible and for reasons of legal clarity, the medical professional associations should adapt their professional regulations to the requirements of the GDPR as soon as possible.
In conclusion, there is also an unusually harsh warning aimed directly at the chambers: "The existing civil and professional regulations, which stipulate that the patient must pay for the provision of an initial copy, are not applicable. Until the respective professional code of conduct has been amended, chamber members are to be encouraged to act in accordance with the law."
English 
German 
Italian 
French