On 5 September 2018, the German Data Protection Conference (Datenschutzkonferenz – "DSK") provided new guidance on the interpretation of Art. 13 of the General Data Protection Regulation ("GDPR") in the context of medical treatment. The Data Protection Conference consists of all German data protection authorities meeting twice a year with the purpose of safeguarding data protection rights, providing guidance on the application of data protection provisions and achieving a consistent application of the European and national data protection law.
Pursuant to Art. 13 of the GDPR, where personal data related to a data subject is collected, the controller shall provide the data subject with information such as the identity and the contact details of the controller, the purpose and the legal basis for the processing of personal data, the identity of the recipients of the personal data and the period for which the personal data will be stored.
Internal Records Are Sufficient
According to the Data Protection Conference, doctors and other health professionals may not refuse health treatment for the reason that a patient is not willing to sign the information material referred to in Art. 13 of the GDPR. Such a practice is not compatible with the GDPR as the information duty of Art. 13 of the GDPR only aims to give patients the opportunity to receive the respective information easily and directly. Yet, the patient is not obliged to take notice of the given information. In order to be able to demonstrate to the supervisory authority that the information duty has been complied with, it is sufficient that the controller keeps a record that the patient has been provided with the required information, or document a specific process showing how patients received the information.
Take Away
Even though the decision of the DSK refers expressly to health practitioners, the interpretation of Art. 13 of the GDPR is likely to apply to other sectors as well. As a general rule, it shall not be required to have data subjects sign information material regarding the processing of their personal data, and it shall be enough to document internally that information has been provided.
This article was originally published on AllAboutIP – Mayer Brown's blog on relevant developments in the fields of intellectual property and unfair competition law. For intellectual property-themed videos, Mayer Brown has launched a dedicated YouTube channel.
Mayer Brown is a global legal services provider comprising legal practices that are separate entities (the "Mayer Brown Practices"). The Mayer Brown Practices are: Mayer Brown LLP and Mayer Brown Europe – Brussels LLP, both limited liability partnerships established in Illinois USA; Mayer Brown International LLP, a limited liability partnership incorporated in England and Wales (authorized and regulated by the Solicitors Regulation Authority and registered in England and Wales number OC 303359); Mayer Brown, a SELAS established in France; Mayer Brown JSM, a Hong Kong partnership and its associated entities in Asia; and Tauil & Chequer Advogados, a Brazilian law partnership with which Mayer Brown is associated. "Mayer Brown" and the Mayer Brown logo are the trademarks of the Mayer Brown Practices in their respective jurisdictions.
© Copyright 2018. The Mayer Brown Practices. All rights reserved.
This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.
