The President of the Personal Data Protection Office: an inspection will be carried out at the Southern Hospital in Warsaw
Audio recording, potential data protection breaches and data processing procedures at the Southern Hospital in Warsaw are the areas that the President of the Personal Data Protection Office will examine during the inspection.
The President of the Personal Data Protection Office learnt of possible irregularities relating to the rules on the processing of personal data at this hospital from a media report, which revealed that CCTV at Southern Hospital in Warsaw records not only video but also audio. However, in order to implement such a system, the data controller would need to have a legal basis for doing so.
In the past, the President of the Personal Data Protection Office has already investigated a situation in which a data controller carried out unlawful surveillance. In one case, the supervisory authority imposed two fines on the Ujastek Medical Centre totalling 1,145,891, 25 for installing video recording equipment in two rooms of the neonatology ward in breach of the applicable regulations, and for failing to implement technical and organisational measures commensurate with the risk to the data stored on the memory cards contained within the monitoring devices.
The decision to impose these fines was upheld by the Provincial Administrative Court in Warsaw, which dismissed the Ujastek Medical Centre’s appeal in this case.
The issue of the use of CCTV by hospitals is also the subject of this year’s sectoral inspections by the President of the Personal Data Protection Office.
During the inspection, the Personal Data Protection Office will also examine other areas. The list of allegations relating to data processing by Southern Hospital is, in fact, considerably longer. It has also been reported in the media that the hospital is alleged to have breached the principle of data accuracy and integrity, as set out in Article 5 of the GDPR. It is also alleged that health data was disclosed there.