GDPR practice question 13 of 15

Scenario 1: MED is a healthcare provider located in Norway. It provides high-quality and affordable healthcare services, including disease…

Full set: 80 questions
Scenario 1: MED is a healthcare provider located in Norway. It provides high-quality and affordable healthcare services, including disease prevention, diagnosis, and treatment. Founded in 1995, MED is one of the largest health organizations in the private sector. The company has constantly evolved in response to patients' needs. Patients that schedule an appointment in MED's medical centers initially need to provide their personal information, including name, surname, address, phone number, and date of birth. Further checkups or admission require additional information, including previous medical history and genetic dat a. When providing their personal data, patients are informed that the data is used for personalizing treatments and improving communication with MED's doctors. Medical data of patients, including children, are stored in the database of MED's health information system. MED allows patients who are at least 16 years old to use the system and provide their personal information independently. For children below the age of 16, MED requires consent from the holder of parental responsibility before processing their data. MED uses a cloud-based application that allows patients and doctors to upload and access information. Patients can save all personal medical data, including test results, doctor visits, diagnosis history, and medicine prescriptions, as well as review and track them at any time. Doctors, on the other hand, can access their patients' data through the application and can add information as needed. Patients who decide to continue their treatment at another health institution can request MED to transfer their data. However, even if patients decide to continue their treatment elsewhere, their personal data is still used by MED. Patients’ requests to stop data processing are rejected. This decision was made by MED’s top management to retain the information of everyone registered in their databases. The company also shares medical data with InsHealth, a health insurance company. MED's data helps InsHealth create health insurance plans that meet the needs of individuals and families. MED believes that it is its responsibility to ensure the security and accuracy of patients’ personal data. Based on the identified risks associated with data processing activities, MED has implemented appropriate security measures to ensure that data is securely stored and processed. Since personal data of patients is stored and transmitted over the internet, MED uses encryption to avoid unauthorized processing, accidental loss, or destruction of data. The company has established a security policy to define the levels of protection required for each type of information and processing activity. MED has communicated the policy and other procedures to personnel and provided customized training to ensure proper handling of data processing. Questio n: If a patient requests MED to permanently erase their data, MED should:
Answer options
A: Reject the request since the medical history of patients cannot be permanently erased.
B: Erase the personal data if it is no longer needed for its original purpose. Correct answer
C: Erase the personal data only if required to comply with a legal obligation.
D: Refuse the request because medical data must be retained indefinitely for future reference.
Correct Answer:
B. Erase the personal data if it is no longer needed for its original purpose.
Explanation

According to the GDPR's Article 17(1)(a), the 'right to erasure' (or 'right to be forgotten') applies when personal data are no longer necessary for the purposes for which they were collected or processed. In this scenario, if a patient has ceased their treatment with MED and moved to another institution, the original purpose for processing their data—providing ongoing healthcare—may no longer be valid. While there may be legal obligations under national law to retain medical records for a certain period (an exception under Article 17(3)(b)), the default obligation is to erase the data once its purpose is fulfilled and no other overriding legal basis for retention exists. MED's current policy of rejecting all erasure requests violates this fundamental right.

Why Incorrect

A. This is incorrect because the right to erasure is not absolute, but neither is the requirement for retention. Medical records are typically subject to statutory retention periods, after which they must be erased.
C. This is too restrictive. A legal obligation is one reason for erasure under Article 17(1)(e), but it is not the only one. The data no longer being necessary is a primary and distinct ground.
D. This directly contradicts the GDPR's 'storage limitation' principle (Article 5(1)(e)), which mandates that data be kept for no longer than is necessary for the purposes for which it was processed.

References

1. Official Journal of the European Union, REGULATION (EU) 2016/679 (General Data Protection Regulation), L 119/1, 4 May 2016.

Article 17(1)(a): "The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where... the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed."

Article 17(3)(b): This article provides exceptions to the right of erasure, including when processing is necessary "for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject..."

Article 5(1)(e): This article outlines the 'storage limitation' principle, stating data shall be "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed..."

2. European Data Protection Board (EDPB), Guidelines 05/2021 on the Interplay between the ePrivacy Directive and the GDPR, version 2.0, 14 March 2023.

Paragraph 29: While discussing a different interplay, this document reaffirms the core principles, stating, "The GDPR applies to any processing of personal data... This includes, for example, the obligation to have a legal basis for processing (Article 6 GDPR), to adhere to the principles of purpose limitation and data minimisation (Article 5(1)(b) and (c) GDPR)..." This reinforces that all GDPR principles, including purpose and storage limitation, are foundational.

3. Voss, W. G. (2020). European Union Data Privacy Law (GDPR): A Practical Guide. KU Leuven Centre for IT & IP Law, CiTiP.

In discussions on Article 17, university courseware and academic guides consistently emphasize that the right to erasure is a default right, triggered when the purpose of processing ceases, unless a specific, legally defined exception (like a statutory retention period for medical files) applies. The burden is on the controller (MED) to prove such an exception exists.

Keep practicing

Take the free GDPR practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test

More questions

Other GDPR practice questions

Scroll to Top