Court case 22PA01320 – Court Ruling (France, 2023)

The data subject was admitted urgently to the hospital after an anxiety crisis. On arrival, she was treated by a psychiatrist who wrote a report. This report mentioned elements of the personal and family life of the data subject. Some months later, she was admitted urgently to another hospital. A doctor also wrote a report in which personal details were mentioned, including data about her sexual and professional life. The data subject considered that the processing was unlawful since she had not given her consent to the collection. She also considered that the collection of her data was not necessary for the performance of the hospital's care mission and that she had not been informed of her right to rectification. She nevertheless exercised her right to rectification by letter without result. The data subject therefore brought an action before the Administrative Tribunal of Paris to obtain damages for moral prejudice resulting from an infringement of her privacy. The court rejected her claim and she appealed to the Administrative Court of Appeal (Cour administrative d'appel de Paris). The arguments of the hospitals are not explained in the decision. The Court explained that according to national law, hospitals must draw up a medical file for each hospitalised patient. This file must include among other things the information received from the patient and the reasons for hospitalisation. According to the Court, the information received in this case by the two hospitals allowed the psychological state of the data subject to be assessed and medical decisions to be taken. This data could therefore be entered in the data subject's medical file and processed in accordance with Articles 6(1)(e) and 9(2)(h) GDPR. The processing therefore had a legal basis and did not have to be based on consent. The Court added that under Article 17(3)(c) GDPR, the hospitals could decide not to erase the data in question. Indeed, the data was useful in order to assess the data subjec