GDPR e Medicina: la prima copia, standardizzare la ricerca scientifica, acquisto macchine

PRESS RELEASE
of the Conference of Independent Federal and State Data
Protection Supervisory Authorities of 12 September 2024
DSK conference: resolutions on asset deal, patient records
and research data

At its interim conference on 11 September 2024, the Conference of Independent
Federal and State Data Protection Supervisory Authorities (DSK) discussed a wide
range of different topics. The results of the all-day video conference were summarised
as follows by the DSK Chairman, the Hessian Commissioner for Data Protection and
Freedom of Information, Prof. Dr Alexander Roßnagel:

"In accordance with their self-image, the members of the DSK have taken up current,
practical data protection issues in order to coordinate their legal opinions and
harmonise their supervisory practice. They also discussed difficult data protection
issues relating to the production and use of artificial intelligence (AI) systems. Overall,
the DSK's discussions and findings contribute to greater legal certainty in data
protection law."

The DSK intends to provide targeted and constructive support for developments in
the field of AI. The central aim is to develop requirements and recommendations for
action in order to realise AI in compliance with data protection regulations. To this
end, it is necessary to show how the objectives of the GDPR can be maximised in a
world of artificial intelligence, taking into account the AI Regulation.
Three results of the conference are of particular importance for the practice of data
processors and data subjects:

The DSK is replacing its resolution of 24 May 2019 on the "asset deal" with a new,
more differentiated resolution in order to make the application of the GDPR more
harmonised and to provide the companies concerned with a clear framework for
action. The term "asset deal" refers to a company acquisition in which assets such as
land, buildings, machinery and equipment are acquired.

About the Data Protection Conference:
The Data Protection Conference consists of the independent data protection
authorities of the federal and state governments. It has the task of safeguarding and
protecting fundamental data protection rights, achieving uniform application of
European and national data protection law and jointly advocating its further
development. This is done in particular through resolutions, decisions, guidelines,
standardisations, statements, press releases and specifications.
rights are transferred to purchasers. The assets may also include data on customers,
suppliers or employees. In the case of sole traders or craft businesses, this may be the
only asset if another person takes over the company and continues the business. In its
decision, the DSK determined in detail the conditions under which such data may be
transferred to a successor.

With a resolution on the free first copy of the patient file, the DSK is addressing the
federal legislator and the medical professional chambers. In a judgement from
26 October 2023 (Case C-307/22), the European Court of Justice (ECJ) ruled that all
patients are entitled to a free first copy of their own patient file in accordance with
Art. 15 para. 3 GDPR. § However, Section 630g (2) sentence 2 of the German Civil
Code (BGB) and the regulations in the professional codes of conduct of the medical
associations stipulate that patients must pay the costs of such a copy. The DSK
therefore calls on the legislator and the medical professional associations to
immediately amend their regulations, which are no longer compatible with EU law.
Another important resolution of the DSK is aimed at a standardised understanding of the
term "scientific research purposes". Data processing for these purposes is favoured in
the GDPR: For scientific research purposes, the purpose of data processing can be
changed, particularly sensitive data can be processed, information obligations can be
restricted or data deletion can be omitted. This preference is also associated with
restrictions on the rights of data subjects. Such interference is only justified if the
research is methodical and systematic, is aimed at gaining knowledge and is verifiable,
if it is independent and autonomous and pursues a public interest.
3
Contact:
Chair of the 2024 Data Protection Conference
The Hessian Commissioner for Data Protection and Freedom of Information
Phone: +49 611 1408-124, e-mail: presse.dsk2024@datenschutz.hessen.de
https://www.datenschutzkonferenz-online.de