Patients have the right to have an entry from the record or even the entire record at a healthcare provider deleted. The health care provider must honor this request unless retention is for substantial benefit to someone other than the patient or if the law precludes destruction. But what about a notation in the record of the fact that the patient has made a request for destruction? Recently, the Administrative Law Division of the Raad van State weighed the patient's right to data erasure against the healthcare provider's record and retention obligations.[1]
Appellant had been referred by her family physician to GGNet, an organization that provides specialized care for people with mental illnesses. After an intake interview at GGNet, appellant decided she did not want treatment and requested that GGNet delete her file. GGNet subsequently deleted her file, but made a note of the deletion request. Appellant disagreed and submitted an enforcement request to the Autoriteit Persoonsgegevens ).
The Raad van State follows the court in holding that the AP correctly concluded that appellant's removal request may be retained.
To this end, the Raad van State considers the following. The record of a deletion request qualifies as special personal data as referred to in Article 9 of the General Data Protection Regulation (AVG). In principle, special personal data may not be processed unless there is an exception. In this case, an exception exists because it is necessary for GGNet to record the annotation in the context of the management of healthcare services.
The Appellant took the position that the obligation to keep a file did not apply because, according to the Appellant, the intake interview with a GGNet nurse did not constitute an act of medical treatment as referred to in Section 7:446 of the Dutch Civil Code. The Raad van State does not follow this position and rules that, given the nature of the intake interview with the social psychiatric nurse, the obligation to keep a file does apply, as referred to in Section 7:454 of the Dutch Civil Code. GGNet is therefore obliged to keep a file and must be able to answer to the supervisor. GGNet has thus sufficiently substantiated the need for GGNet to record the note of the removal request.
The Raad van State concludes that the court was correct in ruling that GGNet was allowed to keep the record of the deletion request because there was no unlawful processing.
The ruling shows that, just as the law also states, the right to destruction is not absolute. Healthcare facilities may, under certain circumstances, be required to retain portions of a record or a record of a request to delete the record. A valid reason for this may be that a healthcare facility needs to be able to justify itself to the regulator. In this case, the duty to keep records outweighs the patient's right to have his entire record deleted.
[1] ABRvS Aug. 6, 2025, ECLI:NL:RVS:2025:3682.https://uitspraken.rechtspraak.nl/details?id=ECLI:NL:RVS:2025:3682
