S: Failure to comply with an access request and appeal of an enforcement notice [2006] IEDPC 10 (31 December 2006)
I received a complaint from the parents of a child that S had failed to comply with an access request under Section 4 of the Acts for access to the child's personal data.
My Office received the complaint in January 2006 and commenced an investigation. We established that the child had attended S in May 2004 and that the access request was made by the solicitor for the child's family in August 2005. Prior to the complaint being submitted to my Office, S's solicitors informed the legal representative for the child's family that the access request raised matters of serious importance to their clients and that they wished to be absolutely sure of their position prior to making a formal reply.
During the course of my Office's investigation, we exchanged correspondence on several occasions with S's solicitors. We posed a number of key questions on the matter, none of which were answered to the satisfaction of my Office. At one point we were advised that the access request had thrown up a serious difficulty with which S was trying to come to terms. S's solicitors acknowledged that their client owed statutory obligations on foot of the Data Protection Acts but stated that their client also owed a number of other conflicting obligations which needed to be reconciled properly with all the persons concerned before they were in a position to comply with the access request. In later correspondence, my Office was told that the request had raised a fundamental problem for S concerning the information gathered by them both physically and electronically and that the opinion of Senior Counsel was required. This was accepted in good faith on the basis that such advice would be forthcoming promptly. In a further letter, S's solicitors informed my Office that genuine difficulties had arisen as a result of the circumstances thrown up by the access request and that S was anxious not to have any adverse precedents set in relation to the confidentiality issue as between doctor and patient. Throughout the investigation, my Office continued to remind S of its obligations to comply with the access request and we advised them that failure to proceed to release the information was a contravention of Section 4(1) of the Acts. At the end of June 2006, having exchanged a large volume of correspondence and with no prospect of the legal advice emerging, my Office gave S's solicitors a final opportunity to respond to the key questions which we had raised with them. They failed to respond and I subsequently served an Enforcement Notice on S in July 2006 pursuant to Section 10 of the Acts.
There were a number of reasons for my decision to serve an Enforcement Notice on S. From the information available to me, I believed that information collected by S on the date in question likely constituted sensitive personal data within the meaning of the Acts. I believed that S had not complied with an access request and was, therefore, in contravention of Section 4(1) of the Acts. Furthermore, I believed that, given the passage of time and the continued failure of the data controller or their legal representatives to engage substantively with my Office, an Enforcement Notice was required to ensure compliance.
The Enforcement Notice required S, within a period of twenty one days, to provide the solicitor of the child's family with the personal data relating to the attendance of the child at S's facility in May 2004. In line with their legal entitlements, pursuant to Section 26 of the Acts, S appealed to the Circuit Court against the requirement specified in the Enforcement Notice. The appeal was listed for hearing in December 2006. At the Court hearing, S withdrew the appeal and agreed to supply the personal data sought.
I was very satisfied with the outcome of this case. Firstly, it ensured that the patient in question received access to their full medical records. Secondly, the case was significant for my Office as I used my full legislative powers to compel the provision of the records in question when S had repeatedly delayed in doing so. Thirdly, the case was all the more acute as it related to sensitive medical information which a patient has a right to access except in certain very limited circumstances. Finally, the patient in question was a minor and the access request was made on his behalf by his mother.
This case is a perfect example of the effectiveness of Data Protection legislation as it allows for members of the public, regardless of their status or access to legal advice, to request personal information for a maximum of €6.35 and to receive it. If they do not receive the information they have sought, they can complain to my Office at no cost and we will pursue the matter on their behalf.