A person is moving from city A to city B, within an EEA member state. In city A he was a patient of the local hospital A. In city B, he becomes a patient of hospital B. The patient has opted out of the national electronic patients file system. The patient asks hospital A to forward his medical file directly to hospital B. According to the GDPR, what is allowed?

This scenario is a direct application of the right to data portability under Article 20 of the GDPR. This right empowers a data subject to have their personal data transmitted directly from one controller (Hospital A) to another (Hospital B) upon request. The patient's explicit request provides the legal basis for this specific processing action. For sensitive health data, this request also constitutes explicit consent under Article 9(2)(a), making the transfer lawful. The fact that the patient opted out of a national system is irrelevant to their right to request a specific, one-time transfer.

A. This is incorrect. GDPR Article 20(2) explicitly grants the right to have personal data transmitted directly from one controller to another, not just to the data subject themselves.
B. This is incorrect. Sharing sensitive health data without a request from the data subject or another valid legal basis would be a violation of the GDPR principles of lawfulness and purpose limitation.
D. This is incorrect. The data subject's explicit request to transfer the data provides a legitimate ground for processing, specifically under the right to data portability (Article 20) and as explicit consent (Article 9).

1. General Data Protection Regulation (EU) 2016/679, Article 20 (Right to data portability):

Paragraph 1: Establishes the right for a data subject to receive and transmit their data to another controller.

Paragraph 2: "In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible."

2. General Data Protection Regulation (EU) 2016/679, Article 9 (Processing of special categories of personal data):

Paragraph 2(a): Provides an exception to the prohibition on processing health data if "the data subject has given explicit consent to the processing of those personal data for one or more specified purposes". The patient's request constitutes such consent.

3. Article 29 Working Party, Guidelines on the right to data portability (WP242 rev.01), adopted on 13 December 2016, last revised and adopted on 5 April 2017:

Page 14, Section IV.C: "Article 20(2) provides for the possibility for the data subject to request the direct transmission of personal data from one data controller to another 'where technically feasible'. This is an important provision that facilitates the data subject's exercise of their right, and makes it easier for them to move data from one service provider to another."