On multiple occasions this month has the AP been told by the Dutch Courts that it failed to take enforcement actions where it should have done so.
In a case concerning the processing of medical data, the Dutch Court found that the AP had casually and wrongfully concluded that enforcement action was not required. This case concerns the Dutch Healthcare Authority (de Nederlandse Zorgautoriteit NZa), which falls under the Dutch Ministry of Health, and holds a register of medical data known as DIS. The NZa transferred medical data obtained from DIS to third parties, including to the Dutch Minister of Health, Welfare and Sports. The claimant requested the AP to take action against the NZa as it believed that the NZa had no legal ground for transferring its medical data. During its investigation, the AP found that the NZa was initially not aware of the fact that it did not have a legal ground for transferring medical data. Upon discovering this, the NZa stopped the transfer of the medical data to the third parties. The AP therefore concluded that the NZa was no longer in breach of the relevant legislation, and that no enforcement action was required. The Court however ruled that the AP should have investigated why the transfer of medical data to third parties took place in the first place. The AP should also have motivated its decision to not take further action with regard to the third parties who are now data controllers of the medical data at subject. The Court therefore ruled that the AP has eight weeks (starting from July 7, 2017) to rectify these shortcomings.
On March 10, 2017, two appeal cases were filed against the AP on the grounds that the AP has failed to take action against the systematic processing of medical data by the NZa and the health insurance companies. A request for enforcement action was filed more than two years ago, but the AP has not taken any action to date. In its intermediate judgment, the Court ruled that prior to giving its final ruling, it is granting the AP eight weeks’ time (starting July 11, 2017) to rectify its shortcomings.
In another case this month concerning mental health care data that gets transferred to a national database, it was found that the data was insufficiently anonymized prior to being transferred. Whilst the AP announced that it would start an investigation into this matter, the action group filing the complaint (Stop benchmark met ROM) decided not to wait for the AP as it lacked confidence in the response time of the AP. Two days prior to the summary proceedings taking place, the opposing parties agreed to adjust their methods of data processing in accordance with the interests of the patients, as well as the guidelines to be given by the Court.
As per usual, we will keep you updated on the developments concerning these relevant rulings.