This article was published in 2018. Laws, case law and regulatory guidance may have changed since then. Contact us for up to date advice.
Supervision of GDPR compliance
The General Data Protection Regulation (GDPR) has been in force since May 2018. In the Netherlands, the Dutch Data Protection Authority (AP) is responsible for supervising compliance with the privacy rules. Since the introduction of the GDPR, the AP has been receiving questions from the healthcare sector. These questions arise because the privacy rules are not always entirely clear to healthcare providers. That is why the Dutch Data Protection Authority is clarifying the term ’large-scale’ processing for all healthcare providers. This term is relevant when engaging a Data Protection Officer (DPO) in healthcare.
The term ’large-scale’ processing clarified for all healthcare providers
The regulator AP always interprets the processing of personal data by hospitals, out-of-hours GP services and care groups as large-scale. The size of these healthcare providers makes no difference.
All other healthcare providers process personal data on a large scale if they process data of more than 10,000 patients in a single information system. With this explanation, the AP hopes to clarify for all sectors within healthcare (the care sector) when large-scale data processing is involved.
The GDPR contains various obligations for organisations that process special categories of personal data on a large scale as a core activity. That is why the Dutch Data Protection Authority is clarifying the term ’large-scale’ for all healthcare providers.
To begin with, these organisations must have a record of processing activities. This is also referred to as the register of data processing operations. In addition, these organisations must appoint a Data Protection Officer (DPO). In certain cases, these organisations must also carry out a Data Protection Impact Assessment (DPIA) . These organisations must be able to demonstrate at any time that they comply with the privacy rules. If an organisation does not comply with the privacy rules, the regulator can take enforcement action. Imposing an administrative fine is one of the options. So far, the AP has imposed various fines, for example on HagaZiekenhuis for insufficient internal security of patient records.
Definition of ’large-scale’ processing the same for (virtually) the entire care sector
The AP always regards the processing of special categories of personal data by hospitals, out-of-hours GP services and care groups as large-scale. The number of patients makes no difference. For all other healthcare providers, the AP applies the following criteria for ’large-scale’ processing of personal data:
- The practice or institution has more than 10,000 patients registered, or treats an average of more than 10,000 patients per year, and
- the data of these patients are held in a single information system.
Nuance regarding pharmacists
At the same time, the Dutch Data Protection Authority adds a nuance regarding the position of pharmacists. The AP regards the processing of personal data by pharmacists as large-scale, because pharmacies on average serve many patients and exchange special categories of personal data with many other healthcare providers in the context of treatment. The AP therefore recommends that pharmacies have a DPO.
Data Protection Officer
Even if an organisation does not process personal data on a large scale, it can still be useful to appoint a DPO, according to the Dutch Data Protection Authority. The regulator writes: ”A DPO can help an organisation set itself up to be GDPR-compliant. The AP also advises healthcare providers that do not process data on a large scale to appoint a DPO. A DPO can be ’shared’ with other healthcare providers or hired externally (for a limited number of hours), so that the organisational burden can be kept to a minimum. This applies to both the voluntary and the mandatory DPO.”