AEPD (Spain) - pd-00055-2026

The Ministry of Defence violated GDPR Article 15 by issuing a blanket refusal to provide a patient with an audit log of who accessed his medical records, citing third-party privacy without adequate justification. This case highlights that organisations cannot use the privacy of staff members as a shield to deny data subjects their fundamental right of access — particularly in sensitive healthcare contexts. A properly reasoned, case-by-case balancing test is required rather than a categorical policy denial. The ruling reinforces that healthcare data controllers must maintain granular access logs and be prepared to disclose them to data subjects upon request. Failure to do so exposes organisations to regulatory enforcement and erodes trust in how sensitive health information is managed.