Key takeaways
The Compendium is addressed to platform owners and aims to identify what their primary obligations are as Controllers and in compliance with the principles of accountability and data protection, so that these activities are conducted in accordance with the data protection regulations.
As such, the Compendium divides health data into two categories: data regarding a health service or health professional's decision, and data arising from a patient's interaction with a health professional. For the first type, the data subject's explicit consent is the legal basis of data processing, and the platform that provides the user with the booking service qualifies as the Controller; conversely, the second type refers to data for which no consent is required, as it falls under the scope of Article 9 para. 2 (h) and para. 3 of EU Regulation 2016/679 ("GDPR"), which provides justification for the processing of health data for treatment purposes if performed by health professionals who are subject to professional confidentiality.
In terms of security, however, the Guarantor recalls Controllers' need to comply with the principle of so-called "privacy by design," i.e., data protection starting from the design of a service, product or process, and to implement a series of measures that are appropriate to ensure effective and efficient protection, such as: encryption, verification of professional title by a healthcare professional, verification of users' contact information, and multi-factor authentication.
