The Spanish data protection authority (Agencia Española de Protección de Datos, AEPD) published a decision finding a GDPR violation against the company QUIRÓN PREVENCIÓN, S.L.U., without imposing a fine, for using health data collected during occupational medical examinations to offer additional paid services.

Facts and context

The case originated from several complaints filed by workers who underwent an occupational medical examination at QUIRÓN PREVENCIÓN centers. Following these examinations, they received, via a mobile application, alert messages indicating anomalies in their test results and offering to perform additional paid tests, presented as a "private service, independent from their company," within a short timeframe corresponding to the validity period of the already collected blood sample.

Grounds for the decision

The authority found a main breach against the company:

• Purpose limitation obligation (Article 5(1)(b) of the GDPR): The AEPD considered that QUIRÓN PREVENCIÓN processed workers' health data for a purpose different and incompatible with the one for which it was initially collected. The initial purpose, based on Article 9(2)(h) of the GDPR and Spanish occupational risk prevention legislation, was the monitoring of workers' health. However, the company reused this data for a secondary commercial purpose, namely the promotion and sale of private health services. The authority judged that this new purpose was not covered by the initial legal basis and that, considering the criteria of Article 6(4) of the GDPR, it was incompatible with the initial processing, notably due to the sensitive nature of the data and the exploitation of the context of their collection for profit.

Authority's decision

Consequently, the authority found a violation of Article 5(1)(b) of the GDPR by QUIRÓN PREVENCIÓN, S.L.U., but decided not to impose an administrative fine. This absence of financial sanction is justified by the principle of legitimate expectation, as the company could have believed its conduct was lawful following a prior AEPD decision that declared inadmissible a complaint concerning similar facts.

Furthermore, the authority ordered the company, based on Article 58(2)(d) of the GDPR, to cease, within three months from the enforceability of the decision, using personal data collected in the context of occupational medicine for different purposes, unless it has a valid legal basis under Articles 6 and 9 of the GDPR.

Lessons learned

This decision reminds that:

• Health data collected under a legal obligation, such as monitoring workers' health, cannot be reused to offer paid commercial services, as these purposes are deemed incompatible.
• The legal basis of preventive or occupational medicine (Article 9(2)(h) of the GDPR) only legitimizes processing strictly necessary for that purpose and cannot be extended to cover the promotion of private health services.
• The principle of legitimate expectation may lead an authority not to impose a fine, even in case of proven violation, if a prior decision may have led the controller to believe its practice was compliant, although this does not prevent the issuance of a corrective order.