Hamburgische Krebsregister (Hamburg Cancer Registry) – Court Ruling (Germany, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A court case in Germany involved a woman whose cancer treatment data was shared by the Hamburg Cancer Registry. She had consented to data sharing but later questioned the registry's data handling practices. The case underscores the need for transparency in how sensitive health data is processed and shared.
What happened
The Hamburg Cancer Registry shared a woman's cancer treatment data after she had consented, leading to a legal dispute over data handling practices.
Who was affected
A woman diagnosed with breast cancer whose treatment data was shared by the Hamburg Cancer Registry.
What the authority found
The court reviewed the registry's data handling practices, focusing on transparency and consent in processing health data.
Why this matters
This case highlights the importance of clear communication and transparency when handling sensitive health data. Organizations should ensure data subjects understand how their data will be used and shared.
GDPR Articles Cited
National Law Articles
The parties are in dispute about Hamburg Cancer Registry data processing and data transfers procedures. The data subject was diagnosed with breast cancer in 2019 and is a resident of the federal city-state of Hamburg. Treating physicians are legally obliged to transfer personal data of their cancer patients to the Cancer Registry. The Hamburg Cancer Registry (HKR) is an independent department of the regional Authority for Science, Research, Equality and Districts. Task of the registry is to identify cancers to be recorded in relation to the population, i.e. occurrence and frequency of diseases and their distribution according to age, sex and place of residence. Transferred data contains name, health insurance number, residence, data of birth, sex, sometimes personal habits (e.g. smoker) and health related data like diagnose, start, length and result of treatment. The data is processed in a confidential (physical) area within the HKR. Moreover, to pseudonymise the data, a set of hash-based control numbers will be automatically generated for every data set. Only the employees of the confidential area have access to the unencrypted personal data. Health related data sets will be shared with other cancer registers and cancer combating organizations on the federal level. The regional law applied here is the Hamburg Cancer Registry Act (HmbKrebsRG). The concerned data subject received a data protection declaration of consent and privacy information with her treatment contract from the hospital. The data subject gave consent to all data transfers at the end of April 2019. In March 2020, the data subject received a request from the University of Lübeck to take part in a cancer-study. According to the letter, contact was made, because the data subject was registered in the HKR. Subsequently, the data subject submitted a right to access request to the HKR. According to the HKR, the data subject received a complete overview of the stored data. This overview contained a
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Hamburgische Krebsregister (Hamburg Cancer Registry) in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Hamburgische Krebsregister (Hamburg Cancer Registry) - Germany (2022). Retrieved from cookiefines.eu
Last updated: