Quality and safety

NOTICE CONCERNING THE PROCESSING OF PERSONAL DATA BY A VIDEO SURVEILLANCE SYSTEM

  1. Data Controller

The societe anonyme under the name “IMITHEA MONOPROSOPI ANONYMI ETAIREIA EKMETALLEFSIS NOSILEFTIKON MONADON KAI IATRIKON DIAGNOSTIKON KENTRON KAI PAROCHIS SYNAFON YPIRESION” (translated in English as “IMITHEA NURSING UNITS AND MEDICAL DIAGNOSTIC CENTERS OPERATION AND KINDRED SERVICES PROVIDING SINGLE PERSON S.A.”) and the distinctive title “IMITHEA S.A.”, headquartered in Athens, 107, Mesogeion Avenue, which operates the Private Clinic “HENRY DUNANT HOSPITAL CENTER” at the aforementioned address.

  1. Purpose and legal basis of the processing

The Henry Dunant Hospital Center (HDHC) provides high quality medical and nursing services to its patients, both on an inpatient and outpatient basis, and to that end the hospital processes personal data, both general and health data (Article 6(1)(C) of the General Data Protection Regulation - GDPR).

The HDHC has a legal obligation to protect the equipment necessary for its operation, its information systems and networks, the health and property of its staff as well as of its patients, partners and visitors. Thus, it maintains and operates on a 24-hour basis and throughout the year, a closed circuit television system (CCTV), for the operation of which conditions are met in accordance with the principles of legality, necessity, proportionality and data minimization, as provided for in the GDPR, but also in Directive 1/2011 of the Personal Data Protection Authority (the Authority) and in all relevant opinions and directives of the Authority.

  1. Security and protection of processing
  • Video-surveillance is limited, as far as possible, to the areas strictly necessary for its purposes.
  • Cameras focus on those of the assets and infrastructure that are critical to the operation of the HDHC.
  • No further processing is carried out on the data collected.
  • The closed circuit is not used for the surveillance or monitoring of employees in their workplaces, nor for evaluating the behaviour and performance of the staff.
  • The closed circuit does not take images of external public space, pavements or entrances to neighbouring buildings.
  • The circuit does not capture images of areas where there is an increased expectation of privacy (areas and lobbies of toilets, changing rooms, etc.).
  • The cameras have a fixed viewing angle and do not have a rotation mechanism.
  • They record only images and not sound.
  • The circuit is self-contained and is not connected to the internet or to the HDHC central network (secure communication circuit) and the surveillance monitors are located in a dedicated secure area.
  • Access to the video surveillance data is strictly limited to a small number of authorised and specially trained operators, and access to the site is by means of access control and a special security lock. There is a fire extinguishing system in the Control Unit.
  • The authorised personnel ensures:
  • the security of the video material;
  • the control of access to the Control, Storage and Processing Unit,
  • the operation of the display screens and software,
  • the continuous training of staff on personal data protection issues and the compliance with the procedures for the protection of personal data,
  • that natural persons/subjects are informed before they enter the scope of the video surveillance system by posting prominent information signs indicating the name of the Data Controller, the purpose and how to contact the interested parties in order to exercise their rights.

  1. Data transfer to third parties

The data of the video material shall not be shared with or transmitted to third parties. By exception the data shall be transmitted/shared in the following cases:

(a) to the competent judicial, prosecution and police authorities when it contains information necessary to investigate a criminal offence involving persons or property of the Data Controller; (b) to the competent judicial, prosecution and police authorities when they lawfully request data during the exercise of their duties; and (c) to the victim or perpetrator of a criminal offence when it comes to data which may constitute evidence of the commission of the offence.

  1. Period of data retention

Each recorder has its own internal storage space and automatically deletes the stored data every 15 days, according to the Authority’s instructions, except as explicitly provided for by the Directive, i.e. in case of an incident against HDHC’s property or persons, the records are kept separately for 30 days and in case of an incident against a third party’s property or persons, the period of retention of the video surveillance material is extended up to 3 months.

  1. Rights of the data subject

Natural persons/data subjects may exercise the rights provided for in the GDPR by sending an email to dpo@dunant.gr. Requests to exercise the rights are checked and answered within the time limit set by the GDPR.

6.1. Right of information

People entering the range of the video surveillance system shall be notified by means of clearly visible signs placed in highly visible places. The signs shall state that the area is monitored by a closed circuit, the Data Controller, the purpose of the processing and how interested parties can obtain further information and exercise their rights. Natural persons/data subjects receive additional information through this document, which is posted on the HDHC website and in visible areas on the HDHC premises.

6.2. Right of access

Any person entering the HDHC premises, as a data subject, shall have the right to access the video surveillance system data concerning him/her by submitting a request, which must indicate the date and exact time when he/she was in the range of the system’s cameras, the specific place and a recent good quality photograph.

6.3. Right of objection or erasure

The data subject shall have the right to object to the processing of his/her image by the video surveillance system and to request the erasure of his/her data. However, the exercise of this right (of objection or erasure) does not imply the immediate erasure of data or the modification of the processing, but shall be investigated as to its lawfulness.

6.4. Right of restriction

The natural person/data subject shall have the right to request restriction of processing, such as for example not to have HDHC delete any data concerning him/her which he/she considers necessary for the establishment, exercise or support of legal claims.

  1. Right to lodge a complaint

If data subjects consider that the processing of data concerning them infringes Regulation 2016/679, they shall have the right to appeal to the competent supervisory authority and lodge a complaint.

The competent supervisory authority for Greece is the Hellenic Data Protection Authority and the contact details are:

1-3, Kifisias Avenue 11523 – Athens, https://www.dpa.gr/, tel. 210-64.75.600