GGNet – Court Ruling (Netherlands, 2025)

The controller is GGNET, a mental health care institution operating in the Netherlands. The data subject sought medical treatment there after a reference by her general practitioner. The practitioner also forwarded to the controller the data subject’s medical records. After her first session with the social psychiatric nurse of the controller, the data subject decided she didn’t want to continue with the treatment and asked for her medical record to be deleted. The controller informed her that it deleted her medical records but retained a record regarding the erasure request. The data subject filed a complaint before the DPA (Autoriteit Persoonsgegevens-AP) requesting that the controller was ordered to delete the record regarding the erasure request. The DPA rejected her complaint, ruling that the controller could retain this record for the management of its health care services and under the medical treatment contract with the data subject, as referred to in Article 9(h) GDPR. The data subject challenged the decision of the DPA before the court of first instance (Gelderland District Court). The court dismissed the appeal as unfounded, affirming the DPA’s decision. Then, the data subject appealed against this ruling before the Highest Administrative Court (Council of State), claiming that the court of first instance misjudged the case. She claimed that the court did not recognise that the DPA should have taken enforcement action against the controller. According to the data subject, the record of the deletion request was not necessary for the management of the controller's health services nor there was a treatment agreement between the parties since she did not receive any treatment. The court held that the data subject’s right to erasure referred to in Article 17 GDPR could not be satisfied. First, it stated that the retention of the deletion request was necessary for the controller to manage its service, and in particular in order to justify why it no longer has certain medical records to regulators, such as the Health and Youth Care Inspectorate, health insurers and the DPA. Second, it pointed out that under the Dutch Civil Code, all medical procedures are covered by a medical treatment agreement and all care providers have the duty to keep a medical record regarding the treatment of each patient. The session of the data subject with the social psychiatric nurse for the assessment of her psychological condition constituted a medical procedure and therefore was subject to a medical treatment agreement. Therefore, the court held that the processing of the record of the deletion request, which constituted special category of personal data, was lawful under the exception of Article 9(2)(h) GDPR. The retention of the data was necessary for the management of the controller’s services and was also necessary under the medical treatment agreement. According to Article 17(3)(c) GDPR, the right to erasure could not be satisfied because the processing was necessary for reasons of public health in the field of public health in accordance with Article 9(2)(h) and Article 9(3) GDPR. The court concluded that the controller was not obliged to honour the request to erase the record and rejected the appeal as unfounded.