gdpr personal-information
Does failure to provide photo of face count as breach of GDPR in UK?
<p>I have requested that an aesthetic clinic send me the 'before' images taken of my face before a procedure two times via email. They have ignored my requests while responding to other questions in the email. Does failure to provide me with this photo of my face count as a breach of GDPR law?</p>

<p>Since the photo presumably makes up part of your patient records with this clinic then under DPA2018 (the UK implementation of GDPR) you do have rights to access it, as per the British Medical Association's <a href="https://www.bma.org.uk/media/1868/bma-access-to-health-records-nov-19.pdf" rel="nofollow noreferrer">guidance</a></p>
<blockquote>
<p>A request by a patient, or a request by a third party who has been authorised by the patient, for access
under the GDPR (and DPA 2018) is called a subject access request (SAR). Rights of access are not confined
to health records held by NHS bodies. They apply equally to the private health sector and to health
professionals’ private practice records. Subject to the conditions explained in this guidance, individuals
have a right to apply for access to health records irrespective of when they were compiled</p>
</blockquote>
<p>Depending on how much time has elapsed since you requested the data they might not be in breach <em>yet</em> - there's 28 days for them comply with any subject access request (SAR)</p>
