DPA case 41/2020 – Complaint Upheld (Belgium, 2020)

In the light of deficiencies regarding the radiology service in a hospital, the hospital asked an external expert to carry out an audit in order to find explanations and possible solutions. After the audit, the hospital decided to dismiss the head of the radiology service, a doctor, for severe misconduct. The doctor in question requested access to the audit report and specifically to sections that related to her individually. The hospital refused to grant access, arguing that (i) the hospital was not the controller (but rather the external expert), (ii) the report was confidential, (iii) the report was protected by copyright and (iv) the report contained personal data of others. In reaction to this refusal, the doctor filed a complaint with the APD/GBA. If an external expert examines personal data at the request of an organisation, who is the controller? What are the limits to a data subject’s right to obtain a copy of personal data relating to him or her? *The defendant was the controller. Based on Article 4(7) GDPR, the APD/GBA stated that "in the present case, by giving mandate to doctor Z [the auditor], even in his capacity as independent expert, to carry out an evaluation of the radiology service of the hospital, the defendant [the hospital] determined the purposes and means of the processing." *As controller, the defendant was responsible for, and had to be able to demonstrate, compliance with the principles set out in Article 5(1) GDPR. The defendant also had to implement appropriate technical and organisational measures to ensure and to be able to demonstrate that the processing complied with the GDPR, with the APD/GBA explicitly referring to the obligation under Article 12 GDPR to facilitate the exercise by data subjects of their rights. *On Article 15(3) GDPR and the rejection by the hospital of access to the audit report, the APD/GBA examined the justification provided and rejected the hospital’s arguments: **On confidentiality, the APD/GBA stated