DPA case Region Sjælland – Violation Found (Denmark, 2023)

The staff of the Danish region of Zealand had access to a health database concerning patients treated by public hospitals. The database contains names, addresses, social security numbers and health data. The Region claimed that the access by staff members was necessary to perform multidisciplinary administrative tasks and improve efficiency. The Region also stressed that staff members were subject to professional secrecy obligations. The Danish DPA started an ex officio investigation. The DPA clarified that the Region of Zealand was the controller in the case at issue. According to Article 32 GDPR, the controller shall implement technical and organisational measures to ensure a level of security appropriate to the risks concerning the processing. The DPA stressed that access to personal data follows the principle of data minimisation and should be limited to those data that are strictly necessary to perform job-related tasks. The DPA did not disregard the argument that efficient health services require extensive processing activities by public administrations. However, the controller had to check that only staff members whose tasks were related to health services had access to the files. In this case, the database was accessible to a large number of people – actually more than 16,000. This was clearly disproportionate in light of Article 32 GDPR. Moreover, the DPA found that the controller did not keep a record of the log-ins to the database by their employees. Therefore, it was not possible to monitor whether such a broad access was in practice only theoretical or members of the staff made excessive use of the tool. Thus, the controller could not prove compliance with the Regulation. In light of the above, the DPA reprimanded the controller pursuant to Article 58(2)(b) GDPR.