De Vereniging Zorgaanbieders voor Zorgcommunicatie (VZVZ) – Court Ruling (Netherlands, 2020)

In the letter dated 27 July 2017, the plaintiff requested the defendant to take enforcement action against VZVZ - the administrator of a network to which certain categories of healthcare providers can connect and consult medical data about their patients in each other's systems (LSP). The claims made were as follows: a. The Personal Data Authority (defendant) must take action against VZVZ for the lack of explicit consent collected by people registered in the LSP; b. the defendant must review the view of its legal predecessor, the Dutch Data Protection Authority (Cbp), from 2014, that VZVZ has put in place sufficient technical and organisational safeguards to ensure that only personal data of patients who have given their consent for this purpose are processed; c. the defendant must confirm that VZVZ may not ask for a national identification number (BSN) in combination with a copy of a valid identity document in response to written requests to the effect that someone has been registered with the LSP. The plaintiff submitted four cases of patients who had been registered with the LSP without their permission. According to the plaintiff, she has thus demonstrated that patients are registered with the LSP without their explicit consent and that the system as such is therefore flawed. According to the plaintiff, the defendant must take enforcement action against VZVZ in order to rectify this. In addition to this enforcement request, the plaintiff also submitted an enforcement request to the defendant aimed at addressing pharmacists about the unlawful registration of patients with the LSP. The plaintiff lodged an appeal against the decision of 24 December 2018 (the contested decision), by which the defendant dismissed the claimant's complaint. The appeal is unfounded. The District Court dismissed the plaintiff's argument that the LSP as a system is unlawful. There is no reason to follow plaintiff in her view that healthcare providers are reporting patients in