The President of the Personal Data Protection Office (UODO), Mirosław Wróblewski, has appealed to the Minister of Health, Izabela Leszczyńska, for regulations regarding surveillance in healthcare facilities. He believes that current rules do not provide sufficient protection of patients’ personal data and respect for their privacy and dignity.
Current Surveillance Regulations
The use of video surveillance in medical facilities is determined by Article 23a of the Act on medical activity. According to this regulation, a manager of a medical entity can establish how to conduct monitoring in:
– public access premises, if necessary to ensure the safety of patients or employees;
– premises where health services are provided and places where patients stay, if it results from separate regulations;
– hospitals, nursing and medical facilities, nursing homes, medical rehabilitation facilities and hospices – if monitoring is necessary for patient treatment or ensuring their safety.
The changes introduced in recent years have given medical facilities broad possibilities to use video surveillance. However, there are no clear regulations on its boundaries, raising serious doubts in terms of privacy protection of patients.
No Clear Personal Data Processing Rules
The President of UODO points out that surveillance in medical facilities often involves processing special categories of data concerning patients’ health (Art. 9 para. 1 of GDPR). Therefore, its use should be precisely defined and predictable for the people it covers.
The basis for the processing of personal data must arise from the law of the European Union or the member state, and the regulations governing its use should be proportional to the intended goal. The President of UODO believes that current surveillance regulations do not meet these requirements.
Need to Balance Public Interest and Right to Privacy
Surveillance in medical facilities should only be used in justified cases, maintaining an appropriate balance between the public interest (ensuring patient safety) and the right to data protection and privacy. To achieve this, it is necessary to conduct a privacy test and a data protection impact assessment, which would assess the real risks to patients’ rights.
Key Gaps in Regulations
According to the President of UODO, the current regulations do not regulate:
– principles of surveillance use – they should not be left solely to the decision of the head of the medical facility in the internal regulations;
– the relationship between points 2 and 3 of Art. 23a of the Act – both points concern surveillance use in places where health services are provided, but their interpretation is unclear;
– the obligation to inform patients – people staying in medical facilities should be provided with transparent information about the use of surveillance and the possibility of protecting their rights.
Doubts about the Proportionality of Solutions
The President of UODO emphasizes that previous regulations limited the use of monitoring only to certain cases and prohibited the recording in some places. However, monitoring can now be used in almost any room, and the records can be processed by facilities without any additional restrictions.
Moreover, the decision to use surveillance remains with the head of the medical facility, which constitutes a significant interference in patients’ privacy.
The European Data Protection Board stresses that video surveillance should not be applied by default, but only when other means fail to achieve the objective. Otherwise, there may be a dangerous normalization of lack of privacy in healthcare facilities.
Detailed remarks on the regulations concerning video surveillance are included in the official letter from the President of UODO, reference DOL.413.13.2024.
Source: https://managerplus.pl/prezes-uodo-apeluje-o-uregulowanie-monitoringu-w-placowkach-medycznych-40993
