Background to the complaint to the Commission

1. The complainant is a French citizen. Following the death of her mother in 1992 in a French hospital, in 2014 she requested access to her deceased mother’s medical file in order to know the causes of her death. Since the hospital refused the requested access on the grounds that the file had been destroyed 10 years after the death, the complainant approached the national and judicial authorities in order to obtain access to her late mother's medical file.

2. Following the dismissal of her actions before the Administrative Tribunal and the Conseil d’État on the ground that she had not adduced evidence that her mother had been transfused and that her medical file had been destroyed, the complainant lodged a complaint with the Commission concerning the French State’s refusal to grant her access to her late mother’s medical file (CHAP(2016)02329 of 11 July 2016).

Reply from the Commission to the complainant

3. On 13 November 2017, the Commission replied to the complainant and confirmed that European data protection law [1] guarantees rights to the person whose data are processed ("the data subject"). The Commission also explained that “European data protection law does not directly govern the question of the exercise of those rights by third parties in the case of successors in title acting on behalf of deceased persons”. The Commission has thus clarified that ‘it is for the Member States of the European Union to specify, if they so wish, the detailed arrangements for the exercise of those rights by the rightholders’. 

4. The Commission also informed the complainant that it is national law [2] that regulates the retention period of medical records by hospitals. The Commission also clarified that "without prejudice to the powers of the European Commission as guardian of the Treaties, the monitoring and implementation of the right to data protection falls within the competence of national authorities, in particular data protection authorities, and courts". Consequently, the Commission invited the complainant to contact the Commission Nationale de l’Informatique et des Libertés (CNIL) if it considered that the retention and refusal of access to her mother’s medical file constituted infringements of European and French law relating to the protection of personal data. 

5. On 14/27 in November 2017, the complainant informed the Commission that she had already contacted CNIL, the Commission d’accès aux documents administratif (CADA) and the French judicial authorities, but was unable to assert her rights.

6. On 22 December 2017, the Commission informed the complainant that the French Public Health Code distinguishes between keeping the medical file of persons still alive (twenty years from the date of the holder’s last stay in the establishment or the last external consultation within it) and keeping the medical file of deceased persons (ten years from the date of death). Consequently, the Commission invited the complainant to contact CNIL, ‘not to obtain access to the file concerned [..], but to verify the correct application by the hospital of the right to data protection, in particular as regards the retention of medical records’.  The Commission finally informed the complainant that, in the absence of new facts and points of law which would have enabled it to reconsider its position, it would close the complaint.

7. The complainant was not satisfied with the Commission’s reply and argued that medical records concerning dialysis should be treated as transfusion records and therefore kept for a minimum period of 30 years.  She therefore turned to the European Ombudsman, arguing that her complaint had suffered from improper investigation by the Commission.

The evaluation of the European Ombudsman

8. It is for the Commission, in its capacity as guardian of the Treaties, to ensure that Member States comply with Union law [3]. This means that the Commission can open infringement proceedings against a Member State that does not comply with an obligation under the Treaties. However, it follows from the case-law of the Court of Justice of the European Union [4] that an administrative practice contrary to EU law must be, to a certain extent, consistent and general in order to enable the Commission to act. The aim of the infringement procedure is not to resolve specific cases of infringement of EU law in respect of a single or a small number of citizens. That said, while it is true that the Commission has a broad discretion to decide whether those practices are sufficiently consistent and general to justify the opening of infringement proceedings, the fact remains that it must explain why it used its discretion in a particular way.

9. Complaint CHAP(2016)02329 concerns France’s alleged failure to comply with EU law regarding the refusal of a hospital, and subsequently that of the other French authorities (including the judicial authorities) to give the complainant access to her deceased mother’s medical file.

10. In the present case, the Ombudsman considers that the Commission was right to explain to the complainant that it was for the French authorities to comply with EU law on the protection of personal data and to ensure that France complied with that law, just as it was right to advise the complainant, when it had decided to close the file on her complaint, to pursue her case at national level, in particular by contacting the CNIL. The national authorities responsible for the protection of personal data are primarily responsible for ensuring compliance with the relevant EU law.

11. As regards the decisions of the French courts to dismiss the action brought by the complainant, it should be pointed out that the Commission is required to initiate infringement proceedings against a Member State only where it is a general and consistent national practice. In the present case, however, there is nothing to indicate that such a situation exists in France as a result of the relevant decisions taken by the competent courts. In that regard, it should be noted that the complainant has already lodged a complaint with the European Court of Human Rights against France in order to assert her rights.

12. Although the Commission was able to explain more clearly to the complainant that there was no evidence of consistent or systemic malpractice on the part of the French authorities, the fact remains that its decision not to initiate infringement proceedings against France does not constitute a misapplication of its broad discretion in that regard.

Conclusion(s) of the European Ombudsman

13. The European Ombudsman closes the present case with the following conclusions:

The Commission did not commit maladministration in taking its decision not to open infringement proceedings against France.

14. The complainant and the Commission will be informed of this decision^._[6]

Lambros Papadias

Head of Unit 3 - Investigations

Done at Strasbourg, 26/09/2018

[1] Article 8 of the Charter of Fundamental Rights of the European Union and Regulation 679/2016 repealing Directive 95/46/EC, which entered into application on 25 May 2018.

[2] Law 2002-303 of 4 March 2002 on the rights of patients and the quality of the health system, Decree 2002-637 of 29 April 2002 on access to information held by health professionals and institutions and the Public Health Code; 

[3] Article 17(1) of the Treaty on European Union and Article 258 of the Treaty on the Functioning of the European Union.  

[4] 12See, for example, judgment of the Court of Justice in Case C-287/03, Commission v Belgium, ECLI:EU:C:2005:282, paragraph 29.

[5] In any event, even if the Commission refers the matter to the Court of Justice, the Court rules on whether an infringement of EU law has been committed, but it cannot annul a national provision incompatible with EU law or force a national administration to respond to an individual’s request. In order to do so, complainants must bring their case before a national court within the time limit set by national law.  

[6] This complaint has been dealt with in the context of the delegation of tasks relating to the handling of complaints, in accordance with Article 11 of the Decision of the European Ombudsman adopting the . Implementing Provisions.