The DPC received a complaint from an individual in relation to a subject access request made to a medical centre for a copy of their personal data. According to the individual, the medical centre had requested a fee to process the access request. Before contacting the DPC, the individual had already advised the medical centre that access to a copy of personal data is free under the GDPR and queried if the letter seeking a fee may have issued in error.

Following receipt of this complaint, the DPC corresponded with the medical centre to ascertain why it had sought a fee to process the subject access request and to seek confirmation that the subject access request had since been complied with.

The medical centre promptly reverted to the DPC accepting that the request for a fee should not have been made. It further outlined additional data protection training for staff regarding its obligations to patients making subject access requests would be provided. The medical centre also confirmed that a copy of the personal data was furnished to the individual with its apologies. The individual confirmed to the DPC that it had received a copy of their personal data.