DPA case 07106-8-2023 – Complaint Upheld (Slovenia, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A daughter requested access to her deceased father's medical records, but the healthcare provider denied her request. The provider claimed a document signed by her father prohibited sharing his medical information, but the daughter argued it didn't clearly stop access after his death. This case highlights the importance of clear communication regarding medical records after a person's passing.
What happened
The healthcare provider denied a daughter's request for her deceased father's medical records based on a signed document.
Who was affected
The daughter of the deceased man, who wanted access to his medical records.
What the authority found
The DPA found that the document did not clearly prohibit the daughter from accessing her father's medical records after his death.
Why this matters
This decision emphasizes that healthcare providers must clearly communicate the rights of family members regarding access to medical records after a patient's death. It serves as a reminder for healthcare providers to ensure their policies align with legal requirements.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject requested access to her father's medical records after his death on 24 October 2023. The healthcare provider denied this request based on a document purportedly signed by the deceased father, which prohibited the disclosure of his medical information to his daughter and argued that he therefore respected the deceased persons’ clearly expressed wishes. However, according to the data subject the document did not explicitly prohibit access to medical records after the father's death. The data subject also argued it could be assumed that her father lacked the capacity to understand the implications of the document due to his dementia. On this account, she provided evidence of her father’s medical condition and claimed that it was produced during a period when he was not of sound mind. The data subject filed a complaint with the DPA against a healthcare provider regarding the denial of access to the medical records of her deceased father. The DPA found that the evidence presented by the healthcare provider, the document signed by the deceased person, did not clearly and unambiguously prohibit the daughter’s access to her father’s medical records after his death. The DPA referred to the right to be informed of the patient's medical records after the patient's death which is regulated in Article 42 of the Slovenian Act on Patient Rights (‘ZPacP’). After the patient's death, the right to be informed of the patient's medical records includes, among others, the patient's spouse, common-law partner, same-sex partner, children and adopted children, and, in the absence of these persons, the patient's parents. These persons shall only be granted access to the information necessary to achieve the legitimate purpose of the consultation. The DPA further clarified that pursuant to Article 42(4) ZPacP, the data subject is indeed entitled to be informed of her deceased father's medical records in so far as they related to reasons which might have a significant i
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 07106-8-2023 in SI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 07106-8-2023 - Slovenia (2024). Retrieved from cookiefines.eu
Last updated: