At the end of December, the Data Protection Inspectorate (AKI) issued a position regarding the use of video cameras in healthcare facilities. According to the AKI, the use of surveillance cameras in such facilities is unlawful, as the recordings contain individuals' health data, and no legal basis exists for this. The AKI believes that a healthcare facility should seek people's consent for video recording, or that legislators should regulate the use of security cameras in the healthcare sector in order to make such data processing lawful.

Considering the circumstances, the AKI's position seems overly conservative, and must be considered a rather radical interpretation of the General Data Protection Regulation (GDPR).

It is true that data concerning health falls under special categories of personal data for the processing of which specific conditions must be met insofar as the processing of this data could create significant risks to an individual's fundamental rights and freedoms. Also considered special categories of personal data are data revealing an individual's racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data as well as sexual orientation.

Looking at the preceding list, you'll see that special categories of personal data is a very broad concept and that essentially all video recordings contain special categories of personal data to some extent. However, this does not mean that a data processor is processing all of the data identifiable from video footage, legally speaking.

For example, it's common for people to wear religious symbols (a hijab, cross, etc.) daily based on which it's possible to infer an individual's religious beliefs. Societally, wearing a wide brim felt hat is regarded as indicative of a conservative political worldview. Racial characteristics can likewise be identified from camera footage. In the processing of personal data, of vital importance is the purpose for which personal data is being processed and what data is required to fulfill this purpose.

In its 3/2019 guidelines, the European Data Protection Board (EDPB) has explained that video footage showing an individual wearing glasses or using a wheelchair doesn't necessarily constitute the processing of special categories of personal data. Processing would, however, count as the processing of special categories of personal data if the goal regarding the information obtainable from the video footage is to process special categories of data visible in it. For example, if a hospital were to install video cameras with the purpose of monitoring the state of a patient's health.

With surveillance cameras, regular and special categories of personal data are processed mixed together, and it isn't technically possible to separate them from one another in order to fulfill this objective. Consequently, the use of surveillance cameras constitutes a special case of personal data processing in which it's crucial to keep in mind the purpose of data processing in particular, as well as whether the goal is to process special categories of personal data.

If you don't want to process special categories of personal data, then when it comes to video surveillance, special categories of personal data will not be processed. The same position has been confirmed by German case law as well as in the legal literature.

If a healthcare facility has installed video cameras for the purposes of protecting their property, rights and persons staying at the facility and the cameras only record common areas (such as hallways, foyers and entrances), in such a case the institution should be able to invoke its legitimate interest, and data recorded in the camera's field of view would not be subject to the protection of special types of personal data.

Based on the AKI's interpretation, all security cameras in use, including the AKI's own, should be considered illegal, insofar as their recordings may show special categories of personal data to a greater or lesser extent.

The goal of data protection is not to impose unreasonable restrictions or burdens on addressing vital and crucial issues. The presence of video surveillance in healthcare facilities is a crucial security tool that helps prevent the occurrence of damage, to the extent that it guides people toward lawful conduct (the fear of getting caught and being punished, so to speak).

I do have to agree with the AKI, however, that video surveillance used in healthcare facilities may pose a greater threat to people's fundamental rights, which is why healthcare facilities must definitely implement stricter technical and organizational measures to protect against unauthorized access to and publication of video recordings. Among other things, the shortest possible retention periods must be applied, and viewing of recordings must be strictly regulated by internal procedures.

Instead of banning video surveillance, the AKI should make it their goal to provide substantive guidance regarding what protective measures to implement.

--

Follow ERR News on Facebook and Twitter and never miss an update!