I have requested that an aesthetic clinic send me the 'before' images taken of my face before a procedure two times via email. They have ignored my requests while responding to other questions in the email. Does failure to provide me with this photo of my face count as a breach of GDPR law?
-
Possibly. But in situations like these it can be helpful to remind them that your request is a GDPR data subject access request.– amonCommented Jan 19, 2022 at 10:34
-
I will just add that I hope you don't expect the person you're emailing to understand GDPR in-depth. They probably have a GDPR request process, which this person may or may no be a part of. What they probably know is that they don't have the photo on their PC. Telling that person they're breaking the law by not giving you th ebefore photo is a bit of an over-reaction in my opinion. Better is "I really need the before photo, can you get that for me?"– Tiger GuyCommented Jan 19, 2022 at 13:46
-
But I've asked them for it multiple times @TigerGuy and they ignore me, because they know I'm not happy with the results.– user42151Commented Jan 19, 2022 at 22:47
Add a comment
|
1 Answer
Since the photo presumably makes up part of your patient records with this clinic then under DPA2018 (the UK implementation of GDPR) you do have rights to access it, as per the British Medical Association's guidance
A request by a patient, or a request by a third party who has been authorised by the patient, for access under the GDPR (and DPA 2018) is called a subject access request (SAR). Rights of access are not confined to health records held by NHS bodies. They apply equally to the private health sector and to health professionals’ private practice records. Subject to the conditions explained in this guidance, individuals have a right to apply for access to health records irrespective of when they were compiled
Depending on how much time has elapsed since you requested the data they might not be in breach yet - there's 28 days for them comply with any subject access request (SAR)
