Skip to content
Enforcement Β· Data Protection Authority of Berlin EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal β€” legal information, not advice.

Medical clinic: Insufficient legal basis for data processing

Medical clinic
GERMANY
Art. 5 GDPR Art. 6 GDPR

How it connects

Full text

The DPA from Berlin has imposed a fine on a medical clinic. The clinic had installed 21 cameras in its premises for the purpose of protection against crime and property damage. This made it possible to monitor employees and patients around the clock. The clinic relied on consent given by employees and information signs as the legal basis for the video surveillance. However, the DPA concluded that the clinic could not base the video surveillance on consent, as voluntary consent in the employee-employer relationship is questionable. Also, clearly visible notices of the video surveillance do not allow the conclusion that the patients, by entering the monitored premises, legally express their consent to the observation. The DPA could not find any other evidence that would justify such extensive video surveillance of the clinic.

Industry: Health Care

Similar Content