{"id":98104,"date":"2025-04-02T14:37:48","date_gmt":"2025-04-02T13:37:48","guid":{"rendered":"https:\/\/www.ictrechtswijzer.be\/?p=98104"},"modified":"2025-04-02T17:54:06","modified_gmt":"2025-04-02T16:54:06","slug":"when-is-an-employer-responsible-for-unauthorized-access-to-medical-records","status":"publish","type":"post","link":"https:\/\/www.ictrechtswijzer.be\/en\/wanneer-is-een-werkgever-verantwoordelijk-voor-ongeoorloofde-toegang-tot-medische-gegevens\/","title":{"rendered":"When is an employer responsible for unauthorized access to medical records?"},"content":{"rendered":"

The Belgian Data Protection Authority (DPA)<\/a> published a decision on April 1, 2025 (64\/2025) that offers interesting insights into the question of responsibility in cases of unauthorized access to medical records by executives. This case deserves special attention from all professionals involved in data protection<\/a> (AVG\/GDPR) in the healthcare industry.<\/p>\n\n\n\n

The facts<\/h3>\n\n\n\n

The case involves a hospital employee who discovered that her supervisor had accessed her medical records without consent. This consultation took place on March 2, 2020 at 10:50 p.m., outside normal working hours. The following day, the employee was fired.<\/p>\n\n\n\n

According to the supervisor, the file had been consulted to verify that the employee was in an appropriate state of health to learn of the discharge. The supervisor admitted this was an error, and the hospital initiated internal disciplinary proceedings.<\/p>\n\n\n\n

Crucial question: who is the controller?<\/h3>\n\n\n\n

A key question in this case was: is the hospital, as the employer, responsible for this unauthorized processing of personal data?<\/p>\n\n\n\n

The GBA ruled that the executive in this case was considered as sole controller<\/strong> had acted and gone beyond the authority entrusted to it. Thus, the hospital could not be held responsible for the unlawful consultation itself.<\/p>\n\n\n\n

Relevant elements that led to this conclusion:<\/p>\n\n\n\n