While security cameras are in widespread use in Estonia's healthcare and social care system, the use thereof lacks legal basis, as someone being caught on camera in a hospital hallway constitutes the individual's medical information, the Data Protection Inspectorate (AKI) said in a formal notice sent to the Ministry of Social Affairs.
In her notice to the ministry, AKI Director General Pille Lehis highlighted the fact that under the General Data Protection Regulation (GDPR), data concerning health is defined as personal data related to a person's physical or mental health, including the provision of healthcare services.
In other words, if someone goes to the doctor and is caught on camera in a hospital hallway, this is generally an indication of their health, and thus constitutes the processing of a special category of their personal data.
Some institutions providing social care services likewise primarily serve people with specific mental health needs, and thus the presence of a surveillance camera there likewise constitutes the processing of clients' health data.
The inspectorate stressed that any processing of personal data requires a legal basis, such as a law, an individual's consent, legitimate interest or similar.
In the healthcare or social care fields, monitoring equipment could be used on condition of the explicit consent of those monitored for the processing of their personal data for certain specific purposes. Even with this consent, however, people would retain the right to withdraw this consent at any time, and thus, according to the inspectorate, no legal basis exists for further data processing.
"A situation may also arise when seeking consent for the use of monitoring equipment in which all visitors to a healthcare facility or clients at an institution providing social care may not give consent," Lehis noted. "This means that without the consent of all visitors or clients, neither healthcare facilities nor institutions providing social care may use surveillance cameras on the basis of consent."
According to the AKI, another means for using security cameras would be if it were necessary for preventive or occupational medicine-related reasons, the assessment of an employee's capacity to work, diagnostic purposes, the provision of healthcare services, social care or treatment or for the organization of healthcare services, however the right to process personal data for such purposes should derive from national law.
The director general highlighted that security camera use being regulated at the legislative level isn't anything new, as the Basic Schools and Upper Secondary Schools Act, for example, gives schools the right to employ such cameras on school territory.
For this reason, the inspectorate proposed to the Ministry of Social Affairs that laws involving healthcare and social care institutions should likewise be amended in order to bring the use of security cameras there into compliance with the law.
Editor: Aili Vahtla