View source for ANSPDCP (Romania) - Fine to a physician for recording a patient on his personal telephone

{{DPAdecisionBOX

|Jurisdiction=Romania
|DPA-BG-Color=background-color:#ffffff;
|DPAlogo=LogoRO.jpg
|DPA_Abbrevation=ANSPDCP
|DPA_With_Country=ANSPDCP (Romania)

|Case_Number_Name=N/A
|ECLI=N/A

|Original_Source_Name_1=Romanian DPA
|Original_Source_Link_1=https://www.dataprotection.ro/?page=Comunicat_Presa_31_08_2023&lang=ro
|Original_Source_Language_1=Romanian
|Original_Source_Language__Code_1=RO
|Original_Source_Name_2=
|Original_Source_Link_2=
|Original_Source_Language_2=
|Original_Source_Language__Code_2=

|Type=Investigation
|Outcome=Violation Found
|Date_Started=
|Date_Decided=
|Date_Published=31.08.23
|Year=
|Fine=2000
|Currency=EUR

|GDPR_Article_1=Article 5 GDPR
|GDPR_Article_Link_1=Article 5 GDPR
|GDPR_Article_2=Article 6(1) GDPR
|GDPR_Article_Link_2=Article 6 GDPR#1
|GDPR_Article_3=Article 9(2) GDPR
|GDPR_Article_Link_3=Article 9 GDPR#2
|GDPR_Article_4=
|GDPR_Article_Link_4=
|GDPR_Article_5=
|GDPR_Article_Link_5=

|EU_Law_Name_1=
|EU_Law_Link_1=
|EU_Law_Name_2=
|EU_Law_Link_2=

|National_Law_Name_1=Law 46/2023 regarding patients' law 
|National_Law_Link_1=https://legislatie.just.ro/Public/DetaliiDocument/41483
|National_Law_Name_2=
|National_Law_Link_2=
|National_Law_Name_3=
|National_Law_Link_3=

|Party_Name_1=
|Party_Link_1=
|Party_Name_2=
|Party_Link_2=

|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=
|Appeal_To_Link=

|Initial_Contributor=Silvia Axinescu
|
}}

The Romanian DPA found a physician to have breached [[Article 5 GDPR]], [[Article 6 GDPR|Article 6(1) GDPR]] and [[Article 9 GDPR]] for recording a patient on his personal telephone, without her consent, and posting the video on his Facebook page. The DPA issued a fine of 9919.2 RON (equivalent to €2000).

== English Summary ==

=== Facts ===
A physician recorded a patient from the hospital he worked at, on his personal telephone, and subsequently posted the video on his Facebook page. The recording took place without the patient’s consent. The physician deleted the video from his Facebook page on the same day as the one he uploaded it. 

Following the submission of a complaint to the DPA, an investigation was initiated. 

During its investigation, the DPA found that the physician’s recording and subsequent post on his Facebook account revealed the patient’s personal data, including their physical image, voice, name, surname and health status. The post and this information was seen by a large number of people and was also further disclosed on various websites and media channels. 

=== Holding ===
The DPA assessed the GDPR infringements alongside domestic legislation on patient rights. Specifically, it took into consideration Article 20 of Law 46/2023, which establishes that a patient may not be photographed or filmed in a medical unit without his or her consent, except in cases where the images are necessary for the diagnosis of treatment and to avoid suspicion of medical fault.

The DPA found a violation of [[Article 5 GDPR]], [[Article 6 GDPR|Article 6(1) GDPR]] and [[Article 9 GDPR]]. Article 5 GDPR establishes the principles of data processing. 

Firstly, Article 5(1)(a) GDPR notes that personal data must be processed ''"lawfully, fairly and in a transparent manner."'' Article 5 GDPR read in line with Article 6 GDPR, establishes that processing may only be lawful if it is conducted on one of the legal bases outlined in Article 6(1) GDPR. Given that the data processing (the filming and posting) had no legal basis under Article 6 GDPR and was also illegal under domestic law, the Romanian DPA found a violation of  [[Article 5 GDPR]] and [[Article 6 GDPR|Article 6(1) GDPR]]. 

Secondly, [[Article 9 GDPR|Article 9(2)(a) GDPR]] establishes that the prohibition against processing sensitive data as outlined in [[Article 9 GDPR|Article 9(1) GDRP]] is lifted, if the data subject explicitly consents to the processing. Health data is sensitive data under Article 9 GDPR. The physician’s recording revealed the patient’s health status and was filmed without their explicit consent. This amounted to violation of Article 9 GDPR.   

As a result of the violations, the physician was fined 9919.2 RON (equivalent to €2000).  

The DPA also imposed corrective measures by ordering the physician to ensure compliance with GDPR of his processing operations to ensure that the patients’ personal data was processed with the observance of the GDPR and domestic law governing the processing of patient data in a medical context.  
== Comment ==
Unfortunately, the Romanian DPA does not publish its full decisions. This summary is based on a press release. Interestingly, this is another recent case from the Romanian DPA when an individual (i.e. the physician) is qualified as controller in relation to processing activities regarding disclosure of data on the Internet, having thus all correspondent obligations under the GDPR.

== Further Resources ==
''Share blogs or news articles here!''

== English Machine Translation of the Decision ==
The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.

<pre>
31.08.2023

A new fine - natural person operator



The National Supervisory Authority for the Processing of Personal Data completed in June 2023 an investigation at a natural person operator and found a violation of the provisions of art. 5, art. 6 para. (1) lit. a) and art. 9 para. (2) lit. a) from Regulation (EU) 2016/679.

The operator was fined in the amount of 9919.2 lei, the equivalent of 2000 euros.

During the investigation carried out following a complaint, it was found that the sanctioned operator (doctor) filmed, with his personal phone, a patient of the hospital where he works, without her consent and later posted the footage on his Facebook page. The audio-video recording led to the disclosure of the patient's personal data, such as image, voice, name, surname and state of health.

The operator deleted the recording from its Facebook page later that day, but not before it was viewed by a large number of people and picked up and disseminated on various websites and media channels.

We emphasize that art. 20 of Law no. 46/2003 regarding the patient's rights, with subsequent amendments and additions, states that: "The patient cannot be photographed or filmed in a medical facility without his consent, except in cases where the images are necessary for diagnosis or treatment and to avoid suspicion of medical malpractice .”

In addition to the fine, the National Supervisory Authority for the Processing of Personal Data also applied a corrective measure, ordering the operator to ensure compliance with the GDPR of personal data processing operations, so that patients' personal data are processed in strict compliance of the legal provisions regarding the provision of medical services and the protection of personal data, by avoiding the illegal/excessive/unauthorized collection and/or disclosure of their personal data."



Legal and Communication Department

A.N.S.P.D.C.P.
</pre>