GGD shares personal data with RIVM without permission.

Questioner

This morning I received an email from the GGD stating: "You have had one or two HPV shots at a GGD. You indicated that you did not want to share your data with the RIVM. Recently, during a check, we discovered that this had happened by accident." This concerns personal data: date of birth, citizen service number (BSN), date of injection, location of injection and information about the vaccine. In the email they indicate that the data has now been deleted. My question in short is: did the GGD act lawfully, or could there still be legal consequences?

Lawyer

Under the General Data Protection Regulation (GDPR), everyone has the right to protection of their personal data. In theory, organizations that share data without permission could be held liable for any damage that results. The GDPR describes specific grounds on which sharing personal data can be legitimate. One of these is the explicit consent of the person concerned. In your case, the GGD did not have your explicit consent between the organizations, which would be a violation of the GDPR. However, in order to initiate any legal action, there must be damage. Have you been harmed in any way by this incident? If so, it may be useful to seek legal advice on this. It is also important to note that in such cases, organizations are required to report a data breach to the Dutch Data Protection Authority. You can ask this agency whether the GGD has actually done so and possibly file a complaint. For comprehensive advice and legal steps, we recommend that you contact a lawyer or legal expert specialized in privacy law. --------------- Stichting Rechtswinkel.nl is a national organization with students and volunteers. The above advice is based on limited information and may be incomplete or even incorrect for your situation. Always consult a lawyer or attorney for your further steps. Read disclaimer: https://rechtswinkel.nl/disclaimer I would like to invite you to rate the above answer so that we can learn from your response.