Text
26 November 2018
Re: PHOTOGRAPHS AND CCTV FOOTAGES IN HOSPITALS
Dear [Redacted],
We write in response to your query on the applicability of the Data Privacy Act of 2012 (DPA)1 to the following:
Discussion
a. taking of photographs of hospital staff and hospital premises by patient’s family members; b. clinical photographs; and c. closed circuit television (CCTV) footages.
Photographs of Hospital Staff, Doctors, and Hospital Premises
Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.2 Accordingly, the image of an identifiable individual captured in a photograph or video is personal information about the individual, and thus, covered by the DPA.
Given that processing of personal information, including photographs, must be in accordance with law, pictures of hospital staff and doctors can only be lawfully taken and processed when at least one of the following conditions set forth in Section 12 of the DPA exists:
(a) The data subject has given his or her consent;
(b) The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract;
(c) The processing is necessary for compliance with a legal obligation to which the personal information controller is subject;
(d) The processing is necessary to protect vitally important interests of the data subject, including life and health;
(e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate; or
(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.
An individual who collects, holds, processes or uses personal information in connection with the individual’s personal, family or household affairs is not considered a personal information controller as defined under the law.3 Where an individual is taking photographs for personal affairs, he or she must still be mindful of respecting rights to privacy of others.
As to photographs of hospital premises, the DPA will not apply, as long as the photo does not capture other individuals or data subjects within the premises where they are identifiable. This does not mean that other laws, regulations and generally accepted hospital standards will not apply.
CCTV Images and Footage; Clinical Photographs
Same as photographs of hospital staff and doctors, CCTV images and footage are considered personal information inasmuch as it contains an image of an identifiable individual. Hence, the criteria for lawful processing under Section 12 of the DPA would also apply.
Clinical photographs, on the other hand, are sensitive personal information since they necessarily contain the health information of patients.4 Thus, processing thereof is prohibited except in the following cases:
(a) The data subject has given his or her consent, specific to the purpose prior to the processing, or in the case of privileged information, all parties to the exchange have given their consent prior to processing;
(b) The processing of the same is provided for by existing laws and regulations: Provided, that such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information;
(c) The processing is necessary to protect the life and health of the data subject or another person, and the data subject is not legally or physically able to express his or her consent prior to the processing;
(d) The processing is necessary to achieve the lawful and noncommercial objectives of public organizations and their associations: Provided, That such processing is only confined and related to the bona fide members of these organizations or their associations: Provided, further, That the sensitive personal information are not transferred to third parties: Provided, finally, That consent of the data subject was obtained prior to processing;
(e) The processing is necessary for purposes of medical treatment, is carried out by a medical practitioner or a medical treatment institution, and an adequate level of protection of personal information is ensured; or
(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.
Based on the provision above, if clinical photographs are taken by doctors, nurses, and other healthcare professionals for medical treatment purposes, it is allowed under the DPA, provided that an adequate level of protection of the personal data is ensured.
Policy Regarding Photographs and CCTV
Considering the foregoing, it is recommended that the hospital craft and implement its own policy about the collection and processing of photographs and CCTV, including specific guidelines or instances when taking of photographs is allowed and security measures as to the use and transmission of clinical photographs.
Furthermore, every personal information controller shall recognize the right of data subjects to be informed and notified5 of the processing activities involving their personal data. The hospital must post a privacy notice on conspicuous areas to apprise the data subjects that the hospital premises or particular areas that are under surveillance of CCTVs.
This notification should sufficiently explain the policy on CCTV and the rights of data subjects. Specifically, it must be able to elaborate on the data subject’s right to access CCTV footage and images, and/or request for copies, upon approval of request and with appropriate masking of the personal data of other individuals, where applicable.6
This opinion is rendered based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) IVY D. PATDU Officer-in-Charge and Deputy Privacy Commissioner for Policies and Planning
Footnotes
-
An Act Protecting Individual Personal Information In Information And Communications Systems In The Government And The Private Sector, Creating For This Purpose A National Privacy Commission, And For Other Purposes [DATA PRIVACY ACT OF 2012] Republic Act No. 10173 (2012). ↩
-
Id. § 3 (l) (2). ↩