The Medical Records Request
Claire, 42, has been treated at a private clinic in Sliema for a chronic condition. She asks for a complete copy of her medical file, including the clinic's notes, a consultant's letter, and an email from her GP that the clinic holds. The clinic says it will charge a €75 'administrative fee' and will take 60 days. It refuses to release the consultant's letter because it is 'the consultant's copyright' and the GP email because it 'belongs to the GP'. Claire has a second-opinion appointment in Malta in ten days and wants the records before then. She is a Maltese resident and the clinic is a private company.
1. Evaluate each part of the clinic's response under data protection law.
Read the worked answer
Claire has a right of access to her personal data, including health data. The clinic's response fails on three points. First, the time limit: the controller must normally respond within one month, extendable by up to two further months only if the request is complex; 60 days is not the default and the clinic must explain any extension. Second, the fee: the first copy should be free of charge; a fee may be charged only for further copies or where the request is manifestly unfounded or excessive. A flat €75 administrative fee is not justified. Third, the copyright argument: copyright in a letter does not override the data subject's right of access to her own personal data. The consultant's letter contains Claire's health data and must be provided, with any third-party data redacted. The GP email, if held by the clinic, is also her personal data. The clinic may redact information about other people, but it cannot refuse the records outright.
2. What should Claire do in the ten days before her appointment, and what can she do if the clinic still refuses?
Read the worked answer
She should send a short written request, by email, quoting her right of access and asking for the records within the ten days because of the scheduled second opinion. She should identify the records precisely and ask the clinic to confirm whether it is extending the one-month period and why. If the clinic refuses, she can complain to the Information and Data Protection Commissioner, which can investigate and order compliance, and she can seek a judicial remedy. She should keep copies of all correspondence and the clinic's fee demand. In parallel, she can ask her GP for the GP's own records and ask the consultant's office for the consultant's letter, because those holders may respond faster. The clinic's refusal does not suspend her right, and a complaint to the regulator can run alongside a request for urgent provision.
3. Are there any lawful limits on Claire's access, and how should they be applied here?
Read the worked answer
Access is not absolute. A controller may redact third-party personal data, and in rare cases access may be restricted if disclosure would cause serious harm to the data subject's health, but that exception must be justified and documented, not invoked routinely. Legal privilege may protect certain advice, but it does not turn factual medical records into privileged material. The clinic cannot rely on copyright or on the claim that the GP 'owns' the email to deny Claire her own data. The correct approach is to provide the records with redactions for other individuals, explain any redaction, and give reasons for any delay. On these facts, there is no apparent basis for withholding the consultant's letter or the GP email, and the clinic's blanket refusal is disproportionate.