Mere storage of patient data doesn't constitute a ’processing’

Mere storage of patient data doesn't constitute a ’processing’ of personal data by the property owner. The property owner who was a sister company of a bankrupt hospital operator, cannot be considered a controller or even a processor just by owning the facility and handling site security. Processing does not describe a state, but an action - a change in a state that requires human activity - ’set of operations’. The fact that important fundamental rights are at stake cannot justify expanding the definition in GDPR of ’processing’, the court ruled.

The Superior Administrative Court Hamburg dismissed the DPA appeal. https://lnkd.in/dr_T-5w