GDPR ruling video surveillance of medical practice inadmissible

Date: 24.07.2019

Institution: BVerwG

Summary of the judgment

The DSGVO ruling on video surveillance in a medical practice inadmissible. A dental practice sued against the order of the Brandenburg data protection authority. The order stated that the video camera installed in the entrance area of the practice was no longer allowed to record certain areas. The practice could be entered without access control, the reception counter was not manned. The recorded images were transmitted live to monitors in the treatment rooms. The dentist justified this by saying that she wanted to avoid thefts in the practice and be able to react more quickly in case of patient emergencies. According to the court ruling, this procedure is not permissible.

Background and content of the hearing

The assessment period for the admissibility of video surveillance was already in 2012, i.e. before the entry into force of the GDPR and the publication of the new version of the BDSG. Regardless of the change in the law, the order of the Brandenburg data protection authority would find its basis in Article 58(2)(d) in conjunction with Article 6(1)(f) GDPR.

The order to orient the surveillance camera in such a way that it does not cover the publicly accessible area of the dental surgery may be subject to the remedial action under Article 58(2)(d) GDPR. According to this, the supervisory authority can instruct the person responsible to bring processing operations into conformity with the Regulation in a specific way and within a specific period of time.

The images recorded by the surveillance camera used by the plaintiff contain personal data in the sense of Art. 4 No. 1 GDPR. The image recordings are a processing of these data. The conditions for the permissibility of the processing are set out in Article 6(1) GDPR is conclusively regulated.

Where, as in the present case, the data subjects have not given their valid consent to the processing of their personal data, processing operations are lawful only if they are based on at least one of the grounds for authorisation in the Article 6(1) GDPR can be supported.

Judgment

The data processing that took place, in the present case legally speaking, was carried out by a private person. For this reason, the recording by video camera cannot be Art. 6 para. 1 letter e GDPR may be relied upon. This would only be possible if the data processing were in the public interest or carried out in the exercise of official authority. Accordingly, only data processing carried out by public authorities in the performance of their public tasks is covered.

Private individuals can only individual-related data access, if the power has been delegated to them in the public interest or as an exercise of official authority. They must act instead of an authority. This is not the case here.

According to its statement of reasons, the plaintiff here pursues the protection of individual legal interests, in this case the prevention of criminal offences against its assets (valuables kept in the practice) and the assets of its patients (valuables carried by them in the practice) as well as rapid assistance in any emergencies involving patients, and thus it does not pursue public but exclusively private interests.

According to this, video surveillance of the publicly accessible area of the dental surgery would also be subject to the Article 6(1)(f) GDPR inadmissible because it is not necessary to protect the legitimate interests.

Applicable articles of the GDPR:

• • Article 4
  • Article 6
  • Article 58

Country: Germany, Brandenburg

Industry: Health & Pharma

Back to the overview of the judgements