DPA case 41/2021 – Complaint Upheld (Greece, 2021)

An employee working in a nursing home lodged a complaint with the Greek DPA (HDPA) because the CCTV cameras installed in the nursing home were filming the premises, including the employees and residents, in an intrusive manner. After reviewing the facts of the case, the Greek DPA found the following violations: * violation of Article 9(2)(h) GDPR (processing of special categories of data): according to the applicable data protection law, the processing of data, including sensitive health data, is allowed when necessary for the purpose of preventive or occupational medicine, health or social care systems, or other health-related reason. Before initiating such processing, however, the controller must receive an authorization, in the form of a committee decision consisting of competent medical and nursing staff. In this case, however, the HDPA found that the nursing home had installed the camera without the prior approval of such committee, which is a necessary condition for documenting the need for supervision and the possibility of relying on Article 9(2)(h) GDPR; *violation of Article 13 GDPR (the obligation to inform data subjects): the HDPA also found that the installation and operation of the cameras took place without prior notification of the employees in written or electronic form, and that the limited information which was provided to them did not cover the requirements of Article 13 GDPR. In particular, the information was too general, and the given purpose of the processing did not accurately relate to the given legal basis and the type of data (i.e. special categories of data); *violation of Article 5(1)(b) GDPR (principle of data minimisation): finally, the HDPA found that the cameras were installed in violation of the principle of data minimization as the employees' movements and position were recorded. It was noted by the HDPA that the nursing home had conducted a data protection impact assessment (DPIA), in accordance with Article Article 35 GDPR.