Use of CCTV
GDPR Recital 47 Legitimate Interests Assessment
Feltwell Surgery has CCTV in place in the Dispensary and outside of the Practice , and has determined that the processing of personal data in this way is lawful by virtue of Article 6 (f) GDPR; “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child”
Satisfaction of this lawful basis requires “careful assessment” to ensure that the legitimate interests of Feltwell Surgery are not overridden by the rights and freedoms of the data subjects concerned.
GDPR requires consideration of several factors and each are considered under the headings below.
What are the legitimate interests of the Controller?
Feltwell Surgery has installed CCTV in the Dispensary and surrounding the Practice premises, in order to protect patients, staff and visitors from abuse or incidents of crime. This is a common measure employed by organisations as a deterrent for anti-social behaviour and allows us to assist Police where an event does occur. The ability to employ measures to protect individuals on the premises and ensure that staff and patients feel safe on site is crucial to allow us to deliver services to data subjects.
What are the Reasonable Expectations of the Data Subject?
Feltwell Surgery have also ensured that the CCTV is only in place in the more public areas of the premises and that surveillance does not extend to clinical areas where the individual would have a reasonable expectation of privacy.
What Impact Does the Activity Have on the Rights of the Individual?
It is therefore concluded that the rights and freedoms are not disproportionately interfered with and that, where possible Feltwell Surgery have employed measures to maintain those rights and freedoms.
It is determined that, given the measures above, Feltwell Surgery has satisfied the criteria for establishing the lawful basis of Article 6 (f) GDPR.