• Surgery
• Dispensary

Use of CCTV

GDPR Recital 47 Legitimate Interests Assessment

Feltwell Surgery has CCTV in place in the Dispensary and outside of the Practice , and has determined that the processing of personal data in this way is lawful by virtue of Article 6 (f) GDPR; “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child”

Satisfaction of this lawful basis requires “careful assessment” to ensure that the legitimate interests of Feltwell Surgery are not overridden by the rights and freedoms of the data subjects concerned.

GDPR requires consideration of several factors and each are considered under the headings below.

What are the legitimate interests of the Controller?
Feltwell Surgery has installed CCTV in the Dispensary and surrounding the Practice premises, in order to protect patients, staff and visitors from abuse or incidents of crime. This is a common measure employed by organisations as a deterrent for anti-social behaviour and allows us to assist Police where an event does occur. The ability to employ measures to protect individuals on the premises and ensure that staff and patients feel safe on site is crucial to allow us to deliver services to data subjects.

What are the Reasonable Expectations of the Data Subject?
This kind of surveillance has been in place for some time and there have been posters drawing attention to the existence of cameras from the outset. It is believed by Feltwell Surgery that, given the prevalence of CCTV as a measure to protect staff, patients and visitors in many public spaces and organisations across the country, patients do expect this type of activity. Feltwell Surgery recognises, however, the inherent duty of confidentiality that healthcare providers have. To ensure that patients are aware of the limitations of our use of CCTV, we have included CCTV within our privacy policy and made it clear how the information is used, shared and retained.

Feltwell Surgery have also ensured that the CCTV is only in place in the more public areas of the premises and that surveillance does not extend to clinical areas where the individual would have a reasonable expectation of privacy.

What Impact Does the Activity Have on the Rights of the Individual?
The individual is informed of the presence of CCTV, made aware of the right to object, right to access / restriction and portability by virtue of the Feltwell Surgery privacy policy and posters. Individuals have a right to privacy and this is maintained as much as practicable through careful placement of the cameras in the more public areas and through only retained the images for a month before being automatically recorded over. This provides time for an incident to be investigated but ensures that they are not retained unnecessarily.

Conclusion
It is therefore concluded that the rights and freedoms are not disproportionately interfered with and that, where possible Feltwell Surgery have employed measures to maintain those rights and freedoms.

It is determined that, given the measures above, Feltwell Surgery has satisfied the criteria for establishing the lawful basis of Article 6 (f) GDPR.