Erasmus University Medical Centre Rotterdam – Court Ruling (Netherlands, 2019)

The plaintiff asked from the Erasmus University Medical Centre Rotterdam (“EUMCR”) to provide her the DNA material of a person died in 2018 alleging that this person was her father. The deceased man had participated in a medical-scientific research at the EUMCR, prior to which he had filled in a “patient consent form”. According to this form, he expressed his wish that his body material would be treated confidentially. The EUMCR refused to provide the plaintiff the DNA material claiming that: * there is no legal basis under which it is obliged to provide this material, * the man’s wish had been expressed unambiguously, thus such a disclosure would contravene the GDPR and * it is bound by professional secrecy. The Court had to balance the plaintiff’s right to personality which includes her right to know her parents and the right of the deceased man and his family to privacy which is here protected by the EUMCR’s duty of confidentiality. The Court went through this balancing exercise and first invoked Recital 1 GDPR and Recital 4 GDPR and the definition of processing under Article 4(2) GDPR. Then, it noted that according to Article 9 GDPR and Recital 35 GDPR genetic data must be protected as sensitive data. The man’s consent to processing was only referred to the purposes of the research he participated in. Further, none of the requirements in Article 9(2) GDPR is fulfilled. The Court concluded that in this case the interest of the EUMCR must outweigh the plaintiff’s interest and the EUMCR must not provide her the DNA material. The Court rejected the plaintiff's claim.