Generation 2004 member wins a case on access to their medical file!

*update 19.10.2021: the Central Staff Committee survey on harassment/bullying had 3000 responses on 13.10.21021, you have until 25.10.2021, please participate!*

Generation 2004 has been fighting hard for the effective implementation of the right of staff to have full and timely access to their medical file.

Access to your own medical file and the right to update the information contained there are very important, particularly in circumstances where that information is used to make a decision about you e.g. whether you are fit enough to continue to work or even just to be recruited.  A lack of transparency leads to questions about fairness and motives [1]. Of course, occasionally there may be legitimate reasons for insisting that a doctor access parts of the file on your behalf. However, we all still have the right to consult (via a healthcare professional, if necessary) the information in our medical history and to correct it or add a note where necessary.

Update on our communications

In her reply (18.08.2021) to our note (16.07.2021) on access to medical files by Commission staff, the Secretary-General of the European Commission reassured us that access is provided in line with the applicable legislation and that the delay in one particular case was caused by a ‘technical issue’. The response further stated that ‘DG HR confirmed that they are not aware of any pending complaints regarding access to medical files in Directorate HR.D.’

Contrary to what DG HR advised the Secretary-General, there was at least one complaint on access to medical file still pending in August 2021, lodged by a member of Generation 2004. We are very proud to inform you that, with his decision of 06.10.21, the European Data Protection Supervisor (EDPS) ruled in favour of our member and ordered the Paymaster Office (PMO) of the European Commission to provide our member with full access to their personal data.

What is this case about?

In the context of seeking reimbursement for certain medical treatments, our member contacted the PMO and requested access to their own medical file, in particular access to the direct billing for surgery and the opinions and reports of the medical experts involved in the case.

After receiving no reply to the first request, our member sent two more requests for access to the medical file.

Since all three requests for access remained unanswered, our member lodged a formal complaint under Article 63(1) of Regulation (EU) 2018/1725 with the EDPS against the PMO.

What are the legal issues?

The right of access by the data subject is laid down in Article 17 of that Regulation. This article specifies that the data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where this is the case, access to the personal data and certain listed information. Therefore, under Article 17, data subjects have the right to obtain access to their personal data, including a copy of the personal data.

This provision includes access to information concerning their health, for example documents in their medical records containing information such as diagnoses, examination results, assessments by treating physicians and any treatment or interventions provided.

There are no limitations as to how a data subject can ask for access, as long as it is clear that they are asking for their own data. Therefore, a valid request may be submitted by email, as our member did in the present case.

In the legal analysis, the EDPS noted that, while the identification of medical consultants of the PMO and their specialisation are not the personal data of the complainant, the direct billing for surgery of the complainant is an administrative document that includes personal data relating to health status and, therefore, constitutes health data of the complainant.

In addition, the EDPS noted that the complainant should be provided with information which allows that person to understand how personal data were processed, and on the basis of which criteria the case was assessed. Therefore, the complainant should be given access to the aggregated opinions and reports of the medical officers. Furthermore, data subjects should be granted access to the data in an intelligible form, using clear and plain language. This means that the PMO should communicate the personal data to the complainant, that is, that it should send these opinions and reports in a comprehensible and intelligible form.

In accordance with Article 14(3) of the Regulation, the controller should provide information to the data subject without undue delay and in any event within one month of receipt of the request. This deadline can be extended for another two months where certain conditions are met.

In the present case, the PMO did not register the complainant’s request and did not respond. This means that the PMO did not fulfill its obligations under Article 14(3) of the Regulation.

What is the decision of the EDPS?

The EDPS concludes that the PMO did not reply to the complainant’s access request within the deadline laid down in Article 14(3) of the Regulation, and has thus infringed Article 17 of the Regulation.

In accordance with Article 58(2)(d) of the Regulation, the EDPS orders the PMO to comply with the data subject’s access request by providing access to the direct billing and the opinions of the medical officers in accordance with Article 17 and 14(1) of the Regulation. In addition, the PMO shall inform the EDPS when the complainant’s access request is satisfied.

Furthermore, the PMO should inform the EDPS of measures taken to ensure that access requests are handled in respect of the provisions of the Regulation.

The PMO should provide the above information within three months of the present decision.

We will continue to closely monitor this case to make sure that the PMO complies with the EDPS decision and that our member is given full and timely access to their medical file.

As always, we would love to hear from you. Please do not hesitate to get in touch with us or leave a comment below.

If you appreciate our work, please consider becoming a member of Generation 2004.

To stay informed, please follow us on social media:

Generation 2004 (@2004generation) / Twitter

Generation 2004 – Startpagina | Facebook


[1] The Central Staff Committee sent a link to a survey on harassment/bullying 05.10.2021 and you have until Monday 25 October to participate.

Leave a Reply