Right to Copy of Medical Records Free of Charge According to Article 15 (3) Sentence 1 of the GDPR vs. Mandatory Reimbursement of Costs by Patient under National Law

On May 25^th 2018, the Regulation (EU) 2016/679 (known by the abbreviation GDPR), adopted in April 2016, superseded the former Data Protection Directive 95/46/EC and came into force. Article 15 (3) sentence 1 of the GDPR contains the obligation of the controller (i.e. the responsible person) to provide a copy of the personal data undergoing processing to the data subject. Just for any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs in accordance with Art. 15 (3) sentence 2 of the GDPR. Possibly deviating from this, some provisions of the EU Member States (e.g. in Austria and Germany) include the patient’s general obligation to pay for the cost of copies of their medical record. This leads to the question of the relationship between these national provisions and the EU law.

Both the ranking of the two levels of regulation and the possible deviations contained in the GDPR must be discussed here. At this point, the conceptual difference between the “duplicates of the medical records” according to Section 630g (2) sentence 1 of the BGB and the “copy of the personal data undergoing processing” according to Art. 15 (3) sentence 1 of the GDPR must also be considered. The fact that the German Federal Court of Justice (2022) recently submitted these questions to the ECJ for a preliminary decision offers a timely occasion to discuss these questions.

With the German Patient Rights Act from 2013 (German Federal Law Gazette I, 2013), the legislature has expressly enshrined a patient’s right to inspect their own medical record in the German Civil Code (BGB). Long before that, the German Federal Constitutional Court and the German Federal Court of Justice had already derived such a right to inspect medical records from the principle of human dignity and the general right to self-determination according to Art. 1 (1) in conjunction with Art. 2 (1) of the Basic Law for the Federal Republic of Germany.

Section 630g (1) & (2) of the BGB (Inspection of the medical records):

“(1) The patient is on request to be permitted to inspect the complete medical record concerning him/her without delay to the extent that there are no considerable therapeutic grounds or third-party rights at stake to warrant objections to inspection. Reasons must be provided for a refusal to permit inspection. Section 811 [BGB] is to be applied with the necessary modifications.

(2) The patient can also request electronic duplicates of the medical records. He/she shall reimburse to the treating party the costs incurred.”

According to Section 630g (1) sentence 1 of the BGB “the patient is […] to be permitted to inspect the complete medical records concerning him/her without delay to the extent that there are no considerable therapeutic grounds or third-party rights at stake to warrant objections to inspection”. This basic statement is supplemented by the right to “electronic duplicates of the medical records” according to Section 630g (2) sentence 1 of the BGB. The emphasis on the electronic form contained therein was only included in the text in the course of the legislative process (German Bundestag’s documents, 17/10488) and prima facie gives the grammatical impression of a restriction. However, this was not intended by the legislature. The patient’s right not only extends to the paper form but also to electronically stored records and data in the form of a file (German Bundestag’s documents, 17/11710).

Based on the German civil law basic rule for the presentation of documents in Section 811 (1) sentence 2 of the BGB (German Bundestag’s documents, 17/10488) the patient must pay the treating person according to Section 630g (2) sentence 2 of the BGB reimbursement for requested copies. The same principle applies to the professional law by the Chambers of Physicians according to Art. 10 (2) sentence 2 of the (Model) Professional Code for Physicians in Germany. According to this, “the patient must be given copies of the documents in return for reimbursement of the costs”. The law does not set an absolute cost limit but corresponding to Section 7 (2) No. 1 of the German Judicial Remuneration and Compensation Act, 0.50 euros per page for the first 50 pages and 0.15 euros for each additional page are generally considered reasonable (Gruner, 2021; Munich I District Court, 2008).

On the one hand, this can result in considerable costs for the patient and thus in individual cases can influence their decision to request copies. On the other hand, the obligation to bear the costs protects the physician from a considerable and at the same time free use of their resources by the patient, which goes beyond the general civil law obligation to enable inspection of documents according to Section 810–811 of the BGB. Compared to the general German data protection law under the former Federal Data Protection Act (before the GDPR came into force), the Higher Regional Court Hamm, for example, gave priority to the special claim according to Section 630g of the BGB. Thus, the principle under the data protection law that information should be free of charge according to Section 34 (8) sentence 1 of the former German Federal Data Protection Act was superseded if the patient wanted to inspect their medical record.

The GDPR also contains rules on the right to information about personal data. These regulations can contradict national regulations; nevertheless, they have a fundamental application priority (European Court of Justice, 1964). This results from the direct anchoring of the right to information in Art. 15 of the GDPR and the associated conversion of the previous regulations of national data protection law into directly binding (Article 288 (2) of the TFEU) EU secondary legislation.

In accordance with Art. 15 (1) of the GDPR, the data subject has the right to request a confirmation from the controller as to whether personal data relating to them are being processed. If this is the case, such person also has the right to information about the data according to Art. 15 (1) of the GDPR. According to the relevant recital No. 63 sentence 2 of the GDPR, this right expressly “includes the right for data subjects to have access to data concerning their health, for example, the data in their medical record containing information such as diagnoses, examination results, assessments by treating physicians and any treatment or interventions provided.” In addition to this right to information, Art. 15 (3) sentence 1 of the GDPR obliges the responsible person (i.e. the controller) to provide a copy of the personal data undergoing processing. Art. 4 No. 7 of the GDPR designates any natural or legal person, public authority, agency or other body as “controller” which, alone or jointly with others, determines the purposes and means of the processing of personal data. In the context of health data, this can be the physician in their own practice office, an association for practice of the profession or the legal entity of a hospital or medical care centre. Furthermore, according to Art. 26 of the GDPR, joint responsibility of several practitioners is also possible.

Compliant with Art. 4 No. 1 of the GDPR, “personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular, by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. This is worded very broadly and is intended to provide comprehensive protection for the data subject.

The same also applies to the concept of processing data according to Art. 4 No. 2 of the GDPR. In this context processing “means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction”.

In an information paper on the requirements for data protection in the practice of medicine, the German Medical Association pointed out that a fundamental distinction must be made between a right to information under the EU data protection law and the patient’s right to inspect their medical record (German Federal Medical Association, 2018). On closer inspection, however, it becomes clear that the patient’s wish to have access to their medical record may fulfil both criteria simultaneously. Therefore, both regulations (Sec. 630 (2) sentence 1 of the BGB and Art. 15 (3) sentence 1 of the GDPR) grant the patient’s right to receive copies from their medical data. Deviating from Sec. 630g (2) sentence 2 of the BGB, the claim from the GDPR is not linked to the patient’s obligation to bear the costs. This becomes particularly clear in Art. 15 (3) sentence 2 of the GDPR, according to which the “controller may charge a reasonable fee based on administrative costs for any further[!] copies requested by the data subject.” This principle is also confirmed by Art. 12 (5) sentence 1 of the GDPR, according to which all notifications and measures of Art. 15 to 22 and Art. 34 of the GDPR must be provided free of charge.

In accordance with Art. 12 (5) sentence 2 of the GDPR, the situation is different only for manifestly unfounded or excessive requests from the data subject, in particular because of their repetitive character. For this reason, the obligation to bear the costs already for the first copy under Sec. 630g (2) sentence 2 of the BGB seems to be superseded by the higher-ranked order (Walter/Strobl, 2018) according to Art. 15 (3) sentence 1 in conjunction with Art. 12 (5) sentence 1 of the GDPR. This priority has now also been confirmed by some German courts of lower instance (Dresden District Court, 2020).

For a number of years, there has been a discussion in the legal literature (Bayer, 2018; Hahn, 2019; Hartwig & Schäker, 2020; Walter & Strobl, 2018) as to whether Sec. 630g (2) sentence 2 of the BGB anchored obligation to bear costs is a permissible national deviation within the meaning of Art. 23 (1) of the GDPR. In a decision from 2020, the Austrian Supreme Court of Justice assumed that a comparable Austrian regulation on the obligation to bear costs falls under the possibility of limitation according to Art. 23 (1) lit. e of the GDPR. In accordance with Art. 23 (1) lit. e of the GDPR, the Member State law, which the data controller or processor is subject to, may restrict by way of a legislative measure the scope of the obligations and rights provided for in Art. 12 to 22 and Art. 34 of the GDPR when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard a Member State’s financial interests, including public health and social security. However, in this case a submission by the Austrian Supreme Court of Justice to the ECJ was not made (2020).

Sec. 17a (1) & (2) lit. g of the Vienna Hospital Act 1987 (unofficial translation):

“(1) The legal entity of the hospital has to ensure that the rights of the patients in the hospital are observed and that the patients are able to exercise their rights in the hospital, taking into account the purpose of the hospital and the range of services.

(2 lit. g) This applies in particular to the following patient rights: the right to access the medical history or to have a copy of the medical history made against reimbursement of costs.”

In Germany, on the other hand, there has not yet been a decision by a Federal Court about the relationship between Sec. 630g (2) sentence 2 of the BGB and Art. 15 (3) sentence 1 in conjunction with Art. 12 (5) of the GDPR. Nevertheless, now such a legal dispute has reached the German Federal Court of Justice. This lawsuit concerns a patient’s claim against their dentist for a free copy of all of their medical record held by the defendant. In this way, the plaintiff wants to receive the necessary documents to examine possible claims for damages due to an alleged incorrect treatment. The defendant believes that they only have to provide a (full) copy of the patient’s record in return for reimbursement of costs.

In 2022, the German Federal Court of Justice has suspended the proceedings and submitted them to the ECJ for a preliminary ruling on the scope and possible exceptions to the right to information in accordance with Art. 15 of the GDPR. First, the German Federal Court would like to know whether Art. 15 (3) sentence 1 in conjunction with Art. 12 (5) sentence 2 of the GDPR should be interpreted so that a request for a copy of the medical record is “excessive” if the copy is not requested for data protection purposes mentioned in recital 63 of the GDPR but serves to assert claims for damages against the physician. Secondly, the Court asks the ECJ to decide whether the obligations and rights resulting from Art. 15 (3) sentence 1 in conjunction with Art. 12 (5) of the GDPR can be restricted in accordance with Art. 23 (1) lit. i of the GDPR by a national regulation that (1) was enacted before the GDPR came into force and (2) that always and independently of the specific circumstances of the individual case provides a reimbursement claim by the physician against the patient if a copy of the patient’s personal data from the patient’s record is handed over by the physician. In addition, the German Federal Court of Justice would like to know whether Art. 23 (1) lit. i of the GDPR is to be interpreted in such a way that the “rights and freedoms of other persons” mentioned there also include their interest in the reimbursement of the costs for issuing a copy of the data in accordance with Art. 15 (3) sentence 1 of the GDPR and other costs for the provision of the copy.

In contrast to the argumentation of the Austrian Supreme Court of Justice from 2020, the alternative reason for a restriction, “financial interests, including public health and social security”, according to Art. 23 (1) lit. e of the GDPR was not addressed at all in the German referral decision. On the one hand, this could be due to the respective national financing structure of the health care system. On the other hand, an obligation to bear the costs for copies of medical records based solely on “important economic and financial interests in the area of public health and social security” is likely to be significantly less promising than the path chosen by the German Federal Court of Justice via Art. 23 (1) lit. i of the GDPR. Finally, the German Federal Court of Justice would like to know from the ECJ whether Art. 15 (3) sentence 1 of the GDPR justifies a right to the transfer of copies of all parts of the patient record containing the patient’s personal data in the physician-patient relationship, or whether the patient only has a right to obtain a copy of the personal data as such, allowing the physician to compile such data according to their own views.

The forthcoming decision of the ECJ on the relationship between Art. 15 (3) of the GDPR and the patient’s obligation to bear the costs for a copy of the medical record under national law is eagerly awaited. The submission by the German Federal Court of Justice gives the ECJ the opportunity to clarify a large number of legal issues in the context of Articles 12, 15 and 23 of the GDPR. Although the decision will be based on German law as an example, its justification will also be important for the legal systems of other EU member states.

However, since the questions referred by the Federal Court of Justice are interdependent, it is possible that the ECJ cannot answer some questions because they are excluded by the answer to a preliminary question. This concerns in particular the suitability of Sec. 630g (2) sentence 2 of the BGB as a restriction within the meaning of Art. 23 (1) lit. i of the GDPR. Should the ECJ affirm this differently than represented here, the scope of the term “copy of the personal data” according to Art. 15 (3) sentence 1 of the GDPR is no longer relevant in the context of German medical records. In any case, it is to be hoped that the ECJ will create far-reaching clarity for legal practice with its decision on the obligation to bear costs, so that physicians and hospitals can deal with the corresponding claims of patients more securely in the future.