AEPD (Spain) - pd-00055-2026
Spain's AEPD upholds complaint against Ministry of Defence for denying patient access to health data.
Spain's AEPD has ruled that the Ministry of Defence infringed upon Article 15 of the GDPR by refusing to disclose the identities of professionals who accessed a patient's health data. The AEPD ordered the controller to either grant access or provide a properly reasoned refusal, emphasizing that a blanket denial violates transparency principles, especially in the sensitive healthcare context.
AI summary of the linked source. Not reviewed by an editor. How this works
Run AEPD?
Get an email when a new story names AEPD, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Spanish Ministry of Defence violated Article 15 of the GDPR by issuing a blanket refusal to disclose which professionals had accessed a patient's health records, without providing any reasoned justification. This case highlights that data subjects have a fundamental right to know who has accessed their sensitive personal data, particularly in healthcare contexts where unauthorized access can cause significant harm. Controllers cannot simply deny access requests — any refusal must be specific, documented, and legally grounded. The ruling underscores that transparency is not optional under GDPR, and that audit logs of data access must be maintained and made available to support these rights. Organizations handling sensitive health data face heightened obligations to demonstrate accountability and traceability of all data processing activities.