Court case PVN-2023-06 – Court Ruling (Norway, 2023)

In June 2019, A had sent a request to Hospital X containing 18 points in which she wanted her son's medical records to be amended or supplemented. In a letter to A dated July 8, 2019, the hospital complied with two of these points. The other requests for correction/supplementation were rejected. The County Governor also approved the hospitals decision. In November 2019, A complained to the Data Protection Authority. The complaint was extensive and concerned several different data controllers. This case concerns a claim for rectification of medical records at Hospital X. On April 26, 2021, the Data Protection Authority asked Hospital X to provide an account of the case processing at the hospital and the assessments that had been made in relation to the complainant's deletion and rectification claims. Hospital X provided an account in a letter dated May 21, 2021. On July 15, 2022, the Data Protection Authority concluded that Hospital X had fulfilled its obligation to rectify/supplement and closed the case. On August 21, 2022, A filed another complaint against the DPA's decision. The DPA considered the complaint, but found no grounds to change its decision. The DPA referred the case to the Data Protection Board on April 19, 2023. The Board upheld the DPA's decision. The conclusion is that the right to rectification was fulfilled by the hospital pursuant to Article 16 GDPR. Firstly, it follows from the Health Personnel Act that health-related assessments, including assessments of the accuracy of medical records, must be made by the health enterprise and possibly by the state administrator. It is the health personnel who perform the health care who are obliged to keep patient records and who must assess what is relevant and necessary information about the patient and the medical assistance, cf. sections 39 and 40 of the Health Personnel Act. In this case, the County Governor (now the State Administrator) has already upheld the hospital's assessment, cf. section 42 of the Health Personnel Act. Secondly, the data protection legislation does not give either the Data Protection Authority or the Data Protection Board the authority to review information in patient records for the purpose of ordering changes to the content of a record at the request of a patient or his/her relatives. Which information belongs in a medical record and what should be archived elsewhere is not regulated by data protection legislation and cannot be determined by the DPA or the Data Protection Board. Lastly, the Board agrees with the Data Protection Authority's assessment that the hospital has processed the submitted requests for correction and supplementation in a manner that meets the requirements of the data protection regulations pursuant to Article 16 GDPR.