We are often asked to advise on the legality of using photographs and videos in the context of data protection law. Some guidance can be obtained from a recent fine of £120,000 levied by the Information Commissioner’s Office – although this was in particular circumstances.
A television company set up CCTV-style cameras and microphones in examination rooms at a walk-in clinic at Addenbrooke’s Hospital in Cambridge which is for patients who have concerns about their pregnancy.
The ICO found that the hospital trust had given its permission but that the television company did not provide patients with adequate information and did not obtain adequate permission from them in advance of the filming. They had posted some notices advising of the filming and had left letters on waiting room tables – but these were found not to provide adequate explanations.
Patients attending the clinic would not have reasonably expected there to be cameras in the examination rooms and would expect to have been made aware of any filming. There was a breach of the law that requires the processing of personal data to be fair and transparent.
Some of the personal data in this case would have been “sensitive personal data”. The lack of information and the failure to provide patients with the opportunity to indicate their consent (or otherwise) to the filming made the filming unfair and unlawful.
The filming took place in 2017 and this case was handled under the Data Protection Act 1998, which was in force at that time. But the outcome would have been the same under the GDPR.