By Giorgos Skampoulos, Associate LL.M.
By its decision No 37/2022, the Authority was called upon to rule on a complaint by a male father, who complained about the non-response of the complainant paediatrician to the right of access exercised by the latter in writing by means of an electronic message (sms), concerning medical data of his child that he had lawfully and voluntarily acknowledged. The complainant claimed that the complainant had never challenged his status as father, nor had she asked him for the notarial deed of recognition of the child, so as to justify her non-response.
In the proceedings before the Authority, the complainant admits that she contacted the mother of the child, who prohibited her from providing the complainant with any information or document, after stressing that she had custody of the child, confirming the break-up of her relationship with the complainant, and admits that she did not thereafter satisfy the contested right of access exercised by the complainant. As regards the non-response to the complainant’s text message dated 8-10-2021, the paediatrician claimed that she did not respond because the message came from an unknown number and her standard practice is to respond only to e-mails and not to personal messages. Furthermore, she noted that she had not received any document showing the complainant’s status as the father of the child, while the mother of the child pointed out that her relationship with the complainant had broken down, which made her skeptical about satisfying the contested right of access.
The Authority, after analyzing the obligation of doctors to keep medical records of their patients (Article 14 of Law 3418/2005), pointed out that the right of access under Article 15 of the GDPR includes the right of data subjects to have access to data concerning their health and does not require the invocation of reasons for which the data subject wishes to exercise this right. In particular, in the case of minors and in accordance with Article 1513 CC, parental responsibility is exercised by both parents jointly even in the event of divorce or annulment of the marriage or dissolution or annulment of the cohabitation agreement or termination of the cohabitation of the spouses or parties to the cohabitation agreement.
Following the above, the Authority found a violation of Article 15 of the GDPR by the doctor, as, according to the entire Greek legislation, she is obliged to satisfy relevant access rights exercised by the father and the person exercising parental care of the minor child for whom she has given an opinion, in the context of providing services concerning the minor child and imposed an administrative fine of EUR 2,500. The Authority pointed out that where the controller has reasonable doubts as to the identity of the natural person making the access request, it may request additional information necessary to confirm the identity of the data subject but, in the present case, it was not shown that such doubts were actually expressed to the complainant and that additional information was requested.
