Costa del Sol dental clinic slapped with big fine for excessive monitoring of staff and patients

A dental clinic in Vélez-Málaga has been fined 5,000 euros for installing eleven video surveillance cameras in consultation rooms, offices and corridors, which the Spanish data protection agency (AEPD) ruled to be excessive monitoring of staff as well as affecting the privacy of employees and patients.

Axarquía Vélez Dental S. L. argued that by installing the cameras the company was ensuring the safety of patients and employees. However, there were very few signs explaining that there were cameras in action and a complaint to the AEPD was made.

The complaint states how the cameras were distributed, all of them without the mandatory video surveillance zone information signs: two in the reception area, one camera in each of the five operating theatres, one in the storeroom, one in the laboratory, one in the corridor and one in the management office.

After receiving the AEPD's request, the company explained that it did indeed have two video surveillance systems to guarantee security in the clinic, one that it managed itself, consisting of 10 fixed cameras placed in various areas, with the aim of ensuring the security of both patients and employees, as well as its property and facilities. An additional alarm system was being managed by a security company.

The clinic argued that no use was made of the images recorded in the consultation rooms during treatment, that the recordings did not contain sound and the videos were only stored for seven calendar days. They stated that the only person who had access to these recordings and storage was the director of the clinic. "The only purposes of the images collected are to preserve the security of persons and property, as well as the security of their facilities, with valuable material and business control in the working environment. In no case are the images used for any other purpose that could affect the privacy of the clinic's patients", states the resolution consulted by SUR.

In its defence the clinic indicated that the images captured by the cameras respected at all times the fundamental rights of employees and guaranteed their dignity in the working environment, because the recording areas had been "carefully marked out", avoiding capturing private areas or areas not directly related to the work activity. It also stated that there was no constant recording on a stationary or fixed workstation (such as an office desk). "All the staff have to cover different tasks in their daily dynamics that make them move around the clinic."

The company regretted that the data protection authority had not assessed that it had obtained the necessary authorisation from employees to capture their images. Moreover, they claimed that given that the health sector is exposed to frequent incidents of verbal and physical abuse by patients, "it is the workers themselves who request the recording both in the consultations and in the workspaces to improve their sense of safety and security in the working environment".

But none of this convinced the body, which in the resolution refers to the "supposed authorisation" that the company had to carry out the recordings: "Firstly, consent cannot be confused, as the company does, with the signature of the workers in the form of a "receipt" in the informative communication in which they are informed of the existence of a video surveillance system, as well as its purposes".

But from these answers provided by the company, the AEPD has concluded that several articles of the data protection law have been infringed, which led to the 5,000-euro fine. However, after acknowledging its responsibility, the company has been able to take advantage of a reduction of the fine and will pay just 3,000 euros.