October 20, 2021

Michalopoulou & Associates: CCTV Operation in an elderly care units

The purpose of the article is to define the circumstances under which the operation of CCTV system is legal. 

The Hellenic Personal Data Protection Authority has issued the relevant 1/2021 Guidelines and it has made various recommendations regarding the above commonplace phenomenon. Most places, which are attended by many people on a daily basis, use CCTV to ensure the safety of persons and property. With the recommendations no. 2/2020 the Authority point out that editors using CCTV must provide full information on the operation of cameras before anyone enters the monitored area. The installation of a CCTV recommends, in any case, a processing of personal data.  

This phenomenon raises various legal questions, especially in cases where the use of the system is intended to protect the health of attendees. Regarding the more specific issue of the use of the system in elderly care units, the Authority issued the decision no. 41/2021. It ruled that the CCTV system should not be used as a criterion for evaluating employee΄s efficiency. The processing is only legal when the data subject has provided consent to the processing of his personal data for one or more specific purposes. Given the power imbalance between the employer and its staff, employees can provide freely their consent only in exceptional circumstances, when the provision or not of consent will have no negative consequences.  

The only legal use of the system could be the protection of person΄s safety. The processing of personal data must be carried out only for the purpose mentioned above. The system must be limited only to places where it is necessary to protect the life and health of patients. Moreover, the necessity of using cameras for this purpose must be substantiated and the recording time used for investigation of health incidents must be limited to forty-eight (48) hours. Cameras placed in places that are not inextricably linked to the purpose of protecting the health or safety of the elderly cannot be tolerated under personal data protection legislation.