On 5 September 2018, the German Data Protection Conference (Datenschutzkonferenz – “DSK”) provided new guidance on the interpretation of Art. 13 of the General Data Protection Regulation (“GDPR”) in the context of medical treatment. The Data Protection Conference consists of all German data protection authorities meeting twice a year with the purpose of safeguarding data protection rights, providing guidance on the application of data protection provisions and achieving a consistent application of the European and national data protection law.
Pursuant to Art. 13 of the GDPR, where personal data related to a data subject is collected, the controller shall provide the data subject with information such as the identity and the contact details of the controller, the purpose and the legal basis for the processing of personal data, the identity of the recipients of the personal data and the period for which the personal data will be stored.
Internal Records Are Sufficient
According to the Data Protection Conference, doctors and other health professionals may not refuse health treatment for the reason that a patient is not willing to sign the information material referred to in Art. 13 of the GDPR. Such a practice is not compatible with the GDPR as the information duty of Art. 13 of the GDPR only aims to give patients the opportunity to receive the respective information easily and directly. Yet, the patient is not obliged to take notice of the given information. In order to be able to demonstrate to the supervisory authority that the information duty has been complied with, it is sufficient that the controller keeps a record that the patient has been provided with the required information, or document a specific process showing how patients received the information.
Take Away
Even though the decision of the DSK refers expressly to health practitioners, the interpretation of Art. 13 of the GDPR is likely to apply to other sectors as well. As a general rule, it shall not be required to have data subjects sign information material regarding the processing of their personal data, and it shall be enough to document internally that information has been provided.
This article was originally published on AllAboutIP – Mayer Brown’s blog on relevant developments in the fields of intellectual property and unfair competition law. For intellectual property-themed videos, Mayer Brown has launched a dedicated YouTube channel.