Stichting Bravis Ziekenhuis (hospital) – Court Ruling (Netherlands, 2022)

The data subject went through a turbulent divorce with her ex-partner. Afterwards, her ex wrote a book about it. Some parts of the book contained information on the data subject’s medical status. Coincidentally, the publisher of the book used to worked at the hospital (the controller) where the data subject was a patient. On top of that, the publisher was the ex’s new partner. After the book was published, the data subject requested the controller for access to the logging data of her patient record. The logging data revealed that her ex’s new partner frequently accessed her patient file for four years. The data subject therefore filed a complaint with the controller, to which the controller replied in a letter. The controller stated that the ex's new partner's employment had been terminated. However it could not establish that she was the reason that the data subject's medical information was published in the book. The data subject was not satisfied with the content of the response and took the case to court. The data subject claimed that the controller was liable for the (non-material) damages that she suffered because (1) the controller took insufficient measures to protect her medical data and (2) insufficiently investigated the data breach. In addition, the data subject argued that the controller was liable for damages caused by its employee (the ex’s new partner/publisher) who accessed her medical records and subsequently published those in the book. The Court held that the controller's monitoring policy did not meet the necessary standard, as it was non-existent. As a result, logging by employees with unrestricted access (like the present case) was not monitored at all and only two patient files were randomly checked every month. The Court found that this fell short, given the amount of personal data processed by the controller. It therefore held that the controller violated Article 32 GDPR, as no appropriate measures were taken to protect the data subject's medical data. The Court held that the controller sufficiently investigated the breach, however it noted that it could have been handled better (for example by personally contacting the data subject). The Court noted that to allow the claim for non-material damages, the data subject's honour or reputation must have been harmed, or she had to have suffered in some other way pursuant to article 6:106(b) BW. The Court stated that it could not establish whether her honour or reputation were harmed. Hence, it investigated whether she suffered 'in some other way'. The Court assessed whether the nature and gravity of the violation would imply such obvious adverse consequences for the data subject, that notable harm to her could be assumed. The Court considered that the data subject’s fundamental right to privacy and data protection were violated. Moreover, special categories of personal data (medical data) were involved. The Court stated that the data was frequently accessed, over a long period of time, and inadequately protected. The medical information was then shared with third parties and published in a book. The Court therefore held that it was obvious that the data subject suffered adverse consequences from the violation (e.g. anxiety). In addition, the Court noted that the concept of 'damages' must be interpreted broadly pursuant to Recital 146. Furthermore, the importance of control over personal data and enforcement of the violated rule follows from the GDPR. The Court therefore held that a regulation-compliant interpretation of article 6:106(1) BW (also) implied that data subject was entitled to fair compensation for her non-material damages. Therefore, the Court ordered the controller to pay the data subject €2,000 in immaterial damages.