Hospital Recoletas Ponferrada – €20,000 Fine (Spain, 2022)

The data subject went to a hospital (the controller) for some health tests. They noticed that two boxes were pre-ticked when they had to read and consent to (parts of) the privacy notice. The first pre-ticked box referred to commercial communications, and the second one referred to the consent to disclose personal data regarding their stay at the hospital and their room number with third parties upon request. Since it was an electronic consent form on a tablet, the data subject complained to the receptionist who changed the settings and handed the tablet which allowed the data subject to tick the options as they wished. Later, the data subject complained in writing to the controller about the occurence and requested from the controller a copy of the privacy notice signed by them but did not receive it. Therefore, the data subject submitted a complaint before the Spanish DPA, which started an investigation and notified the controller about an alleged violation of Articles 6(1) and 15 in connection with Article 12 GDPR. In his own defense, the controller claimed that the pre-ticked clause about commercial communications was indeed a human error due to the long lines of patients waiting for their test in the morning, which made the receptionists change the settings to save time. Regarding the clause about communication of patients' personal data to third parties, the controller said that it did not apply to the data subject but to other patients who stayed at the hospital. The controller also mentioned that it was based on legitimate interest, and it was initially conceived as an opt-out box, giving to the patients the option to object to it when the privacy policy was in paper format, but the change to the electronic version on the tablet, made the system put it as a pre-ticked box. Additionally, the controller implemented measures, including staff training, in order to prevent such incidents in the future. The controller submitted that the data subject's written complaint was attended verbally the same day, and admitted that it was not treated as an access request. However, the controller sent a copy of the information requested once it was notified about the DPA's investigation. The DPA noted that the lawfulness of the processing carried out by the the controller for the management of the data subject's clinical history was covered by Article 6(1)(b) GDPR. However, for any other purposes, such as sharing personal data with third parties or for commercial purposes, the controller needed another legal basis, for example consent. The DPA recalled that when processing is based on consent under Article 6(1)(a) GDPR, the consent must meet the requirements of, among others, Article 7 GDPR. The DPA observed deficiencies regarding the consent request and referred to Article 7 GDPR and Recital 32 GDPR. Specifically, the use of pre-ticked boxes rendered consent invalid, resulting in a lack of legal basis under Article 6(1) GDPR. Therefore, the DPA held that the controller unlawfully processed data for third-party sharing and commercial purposes. Regarding the right to access, the DPA cited Recital 63, Articles 15, and 12 GDPR to conclude that in the written complaint submitted by the data subject to the controller, it was expressly stated that they were requesting access to the copy of the privacy policy signed on the tablet. However, the controller only provided the copy after the DPA started an investigation. Therefore, the access request was not processed in a timely manner, in violation of Articles 12 and 15 GDPR. The DPA initially imposed two fines of €10,000 each for the violation of Articles 6(1) and 15 in connection with Article 12 GDPR. The fine was reduced to €16,000 in total since the controller benefited from one reduction for acceptance of guilt and another one, for the voluntary payment of the fine.