DPA case 3R- 1876 (2.13-1.E) – Violation Found (Lithuania, 2025)

The controller is a public hospital operating a video surveillance system with 26 cameras installed across its premises, including entrances, corridors, patient admission areas, outpatient examination rooms, and three operating rooms. Most indoor cameras also recorded audio. The stated purposes of the surveillance were to ensure the safety of staff, patients and property and, in operating rooms, to ensure the smooth organisation of work. Following a notification by a data subject, the State Data Protection Inspectorate (DPA) initiated an ex-officio investigation and carried out an on-site inspection. The inspection revealed that certain cameras partially covered patient examination areas and permanent employee workplaces. In operating rooms, cameras recorded areas close to operating tables and transmitted live video and audio to a workstation, although the controller could not clearly identify who had access to the live feed or whether recordings were stored. The controller relied on legitimate interest under Article 6(1)(f) GDPR as the legal basis and had conducted a data protection impact assessment and a balancing test. It argued that data subjects were informed by signing hospital admission documents and that access to video and audio data was restricted. During the inspection, it was also found that video recordings were stored longer than the defined retention periods. The DPA found that video surveillance in general areas of the hospital, such as entrances, corridors, and foyers, could in principle be based on the controller’s legitimate interest in ensuring safety, provided that camera views were appropriately limited. However, video surveillance in examination rooms, admission and emergency examination rooms, and geriatric care units was unlawful insofar as camera views covered patient examination areas or permanent employee workplaces, as this failed the balancing of interests required under Article 6(1)(f) GDPR. The authority further held that video sur