Dentoestetic Centro de Salud y Estética Dental SI – Complaint Upheld (Spain, 2022)

The data subject requested access to his medical records, but the controller, a dental clinic, did not respond. Therefore, the Spanish DPA has ordered the defendant to present the answer within ten days. According to the Spanish DPA, the data subject’s request is assured by the right to Access of his medical records, so the controller could not let him with no answers, even if it claimed there was no data subject’s data in its records. That is because the request has forced the clinic to give to the claimant an express response, including any justified reasons for denying the request or for requesting any rectifications that might be necessary. Since the clinic did not observe the requirements of art. 15 and 18 of the Spanish regulation regarding clinical information and documentation (“Ley Española 41/2002”), nor the provisions on transparency of information and right to access that are in the art. 12 and 15 of GDPR, the Spanish DPA imposed to the clinic the obligation to observe the right of access exercised by the claimant, or at least expressly deny it with a motivated reason.