An increasing number of organisations are receiving requests from individuals seeking access to data. However, not all access requests are the same. Depending on the type of organisation and the data concerned, a request may be based on different laws, each with its own rules, deadlines and grounds for refusal. In this article, we discuss three types of access requests that we frequently encounter.
The General Data Protection Regulation (GDPR) gives every individual the right to ask a data controller whether their personal data is being processed and, if so, to obtain access to that data. This right applies to every data controller, regardless of the type of entity involved. This means that online retailers, healthcare institutions and supermarkets alike may receive such requests.
When submitting an access request, the data subject is entitled not only to access their personal data but also to receive information about, among other things, the purposes of processing, the categories of data concerned, the recipients of the data and the applicable retention periods. As a data controller, you are obliged to provide a copy of the personal data. However, this does not automatically mean that access must be granted to entire files or documents. The deadline for responding is one month from receipt of the request, with a possible extension of two additional months for complex requests.
Refusing a request is not permitted without valid grounds. A request may be refused, or a fee may be charged, if it is manifestly unfounded or excessive, for example because of its repetitive nature. The burden of proving that a request is manifestly unfounded or excessive rests with you, the data controller. Furthermore, complying with an access request must not adversely affect the rights and freedoms of others. In certain circumstances, third-party information may be anonymised or omitted.
Are you a healthcare provider? If so, you may also receive access requests under the Dutch Medical Treatment Contracts Act (Wet op de geneeskundige behandelingsovereenkomst, WGBO). Under Article 7:456 of the Dutch Civil Code, patients have the right to inspect and obtain a copy of the information contained in their medical records. The grounds for refusal are more limited than under the GDPR. Access may only be refused to the extent necessary to protect another person's privacy, for example where the medical records contain information about family members or other third parties. Unlike under the GDPR, the WGBO does not provide for a general right to refuse access requests on the grounds of workload, costs or the excessive nature of the request.
Particular attention must be paid to requests for access to medical records following a patient's death, as regulated by Article 7:458a of the Dutch Civil Code. The law provides four grounds on which access may be granted.
First, access may be granted to a person to whom the patient gave written or electronic consent during their lifetime. Second, a surviving relative within the meaning of the Healthcare Quality, Complaints and Disputes Act (Wet kwaliteit, klachten en geschillen zorg, Wkkgz), or the patient's legal representative, is entitled to access if that person has received notification of an incident under the Wkkgz. Third, any person with a compelling interest may request access, provided they can demonstrate that this interest may be adversely affected and that access is necessary to protect that interest. Fourth, a person who exercised parental authority over a patient who was under the age of sixteen at the time of death is entitled to access, unless granting access would conflict with the duty to act as a responsible healthcare provider.
If you refuse access under the third ground and the request was submitted because of a suspected medical error, the applicant may, pursuant to Article 7:458b of the Dutch Civil Code, request that an independent physician designated by them review the relevant information. If that physician concludes that the refusal is unjustified, you must grant access after all.
It is important to note that, under all four grounds, only information relevant to the specific legal basis for requesting access may be disclosed. In any event, access must be denied if the deceased patient, having reached the age of twelve and being capable of reasonably assessing their own interests, recorded in writing or electronically during their lifetime that they did not wish access to be granted. Access must also be denied where disclosure would infringe upon another person's privacy. Since granting access to anyone other than the patient, including after the patient's death, constitutes an exception to the duty of medical confidentiality, such requests must be handled with considerable caution.
Does your organisation provide youth care services? If so, the right of access is governed by Article 7.3.10 of the Dutch Youth Act (Jeugdwet), which closely resembles the provisions of the WGBO. Upon request, youth care providers must allow the person concerned to inspect and obtain a copy of the information contained in their records. Please note that the term person concerned (betrokkene) has a different meaning under the Youth Act than the term data subject under the GDPR.
The grounds for refusing access to the person concerned are the same as those under the WGBO. Access may be refused only to the extent necessary to protect another person's privacy.
A particular feature of the Youth Act is the position of parents who exercise parental authority. For example, in the case of children under the age of twelve, the obligations of the youth care provider towards the person concerned also apply directly to the parents or guardian exercising parental authority.
Correctly identifying the type of access request is the first step towards handling it appropriately. The grounds for refusal vary depending on the applicable legislation. Under the GDPR, the threshold for refusing a request is high, and the burden of proof rests with the data controller. By contrast, the WGBO and the Youth Act allow access to be refused where necessary to protect the privacy of others. In addition, special conditions apply to requests for access to the medical records of deceased patients. An incorrect approach may result in complaints to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), professional disciplinary proceedings or civil litigation.
Are you unsure which type of access request you are dealing with, how to respond to it or how to substantiate a refusal?
Please do not hesitate to contact our IT, Privacy & Cybersecurity specialists for advice and assistance.
Would you like to receive a monthly overview of our latest legal updates and blog articles? Subscribe to our newsletter to stay informed.
