AEPD (Spain) - pd-00055-2026
Spanish DPA orders Ministry of Defence to disclose identities of healthcare data accessors.
The Spanish Data Protection Agency (AEPD) ruled that the Ministry of Defence infringed Article 15 of GDPR by refusing to disclose the identities of professionals who accessed a patient's health data. The AEPD emphasized a stricter transparency standard for health data and ordered the Ministry to either provide the requested access logs or a properly reasoned refusal, rejecting the Ministry's blanket reliance on privacy concerns for third parties.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Ministry of Defence?
Get an email when a new story names Ministry of Defence, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Spanish Ministry of Defence failed to honour a patient's right of access under GDPR Article 15 by refusing to disclose which professionals had viewed their health records, relying on a blanket, unsubstantiated privacy argument about third parties. Health data carries the highest sensitivity classification under GDPR, meaning transparency obligations are stricter, not weaker, when it is involved. The ruling highlights that public bodies cannot simply invoke competing privacy interests without providing a properly reasoned, documented justification. This matters because unchecked access to health records creates risk of both misuse and cover-up, and individuals must be able to verify who has seen their most intimate data.