VšĮ Biržų ligoninė – €6,000 Fine (Lithuania, 2026)

In April 2025, the DPA carried out an ex-officio investigation regarding the video surveillance activities of a hospital (the controller). In its investigations, the DPA found that the controller had placed video surveillance cameras in several areas, including outdoor areas, entrances, common areas and operating rooms. All indoor cameras recorded both video and audio, and the controller placed signs informing data subjects of the surveillance activities. The controller argued that its surveillance activities were lawful under legitimate interest (Article 6(1)(f) GDPR). The DPA first found a violation of Articles 5(1)(a) and 6(1) GDPR, as the hospital did not have a valid legal basis for the video surveillance activities. The DPA noted that the controller had only relied on legitimate interests to process the data. The DPA therefore assessed whether the cumulative requirements under Article 6(1)(f) GDPR were met; whether the controller has a legitimate interest, whether the processing is necessary for the purpose, and whether data subjects’ rights and freedoms override the controller’s legitimate interests. The DPA acknowledged that the controller’s aims of ensuring a safe environment for patients in general and ensuring efficiency in the operating rooms were legitimate aims. In addition, the surveillance activities were necessary to ensure a safe environment, and the data subjects’ rights and freedoms did not override the controller’s legitimate interest. This, however, was not the case for all the cameras; the DPA made a distinction between the surveillance of outdoors or common areas (such as corridors), and operating rooms or staff areas. According to the DPA, the surveillance of operating and staff rooms did not meet the requirements of necessity or overriding interests. For example, the controller could efficiently organise its operating rooms with less restrictive means, and it had not provided evidence that video surveillance was the only necessary means to ensure that operating rooms were organised smoothly. The DPA also considered the reasonable expectations of privacy of data subjects in operating and staff rooms, concluding that the use of video surveillance violated data subjects’ rights. The DPA reached the same conclusions for the use of audio recordings, stating that they were not necessary for the controller’s purposes and violated data subjects’ rights. Finally, the DPA stated that the controller processed sensitive data through its video and audio surveillance in operating rooms, which is prohibited under Article 9(1) GDPR. The DPA also found a violation of Article 5(1)(e) GDPR, as the hospital had not complied with the principle of storage limitation. The DPA found that the controller did not have clear storage limitation periods, and stored the data for excessively long periods of time. Finally, the DPA found a violation of Article 5(1)(f) GDPR, as the hospital had not complied with the principle of security of processing. In its investigations, the DPA found that employees did not have full knowledge of who had access to the video and audio recordings, and were also unable to provide all the information the DPA requested. With this, the DPA concluded that the controller did not have appropriate security measures in place, particularly for sensitive data. The DPA fined the controller €6,000. The DPA took into account the high number of data subjects affected, the sensitive nature of health data and the fact that the controller recorded areas where the expectation of privacy is high (such as operating rooms).