ASOURCE Times

Regarding security camera footage

As mentioned briefly in the previous article, the person being photographed has privacy and portrait rights, so even if you are the facility management authority, you cannot take unlimited photographs of visitors. However, if photography necessary for facility management is not permitted at all, it will be impossible to manage the facility appropriately.

Filming for crime prevention purposes is particularly problematic. The Personal Information Protection Commission's official opinion is that "when a personal information handling business entity acquires images that can identify a specific individual using a camera, it is handling personal information and must specify the purpose of use as much as possible and use the camera images within the scope of said purpose of use." Notification and public announcement of the purpose of use is not required because the installation conditions of the cameras make it clear that the purpose is crime prevention, but it also mentions that it is desirable to "take measures such as posting a notice at the entrance or where the camera is installed that the security camera is in operation." 1 However, this is limited to conventional cameras that do not perform facial recognition, and when installing a camera with facial recognition function, notification and public announcement of the purpose of use and narrowing the scope of authentication according to the purpose are required.

On the other hand, surveillance cameras installed in hospital rooms, etc., are targeted at specific patients and are expected to infringe on privacy to a large extent, so the approach is completely different from that of security cameras. There is no official opinion from the Personal Information Protection Commission, but if there is an emergency or necessity for the management of life and physical safety, it may be acceptable in a limited sense by meeting certain strict requirements, such as limiting the period of filming and storage to the minimum necessary. In any case, careful operation is required.

About surgery videos

Applicability of personal information

As some of you may already know, this was reported in 2022, but following an incident in which videos of ophthalmic surgery were provided to a medical device manufacturer without the patient's consent, the Personal Information Protection Commission issued a warning, stating that this constitutes the provision of personal information to a third party.

Not only in ophthalmology, but in general, surgical videos are not necessarily linked to a specific individual based on the footage alone, and at first glance they may not seem to qualify as personal information. However, by comparing the footage with records such as the date and time of the surgery, it is easy to identify the individual, and so they are considered to be personal information.

According to this line of thinking, filming surgery without the patient's consent and possessing the data would violate Article 20, Paragraph 2 of the Personal Information Protection Act, which states, "Personal information handling businesses must not acquire sensitive personal information without the prior consent of the individual." Therefore, consent must be obtained from the patient in question in advance.

Therefore, it is necessary to establish and implement rules for taking, storing, and using images within medical institutions.

For example, the provision of data to academic societies for the purpose of obtaining specialist qualifications is considered to be for academic research purposes, and each academic society follows its own set of procedures, including whether or not informed consent is required, in accordance with the ethical guidelines for life science and medical research involving human subjects.

On the other hand, it is important to note that even if general consent for academic use is obtained, medical device manufacturers are not considered academic research institutions. Therefore, it falls outside the scope of academic purposes, and individual consent is required for provision to a third party (in this case, the medical device manufacturer).

Responsibility for managing personal data

In many cases, surgical videos are managed systematically using IDs and other methods, and since it is possible to search for individuals, they are also considered to be personal data. In this case, the responsibility for managing personal data lies with the medical institution, and if staff members are in a position to take the videos without permission and provide them to a third party, they may be held liable for safety management measures and employee supervision. As with the management of electronic medical records, it is generally physically impossible or prohibited to write data onto a USB and take it away without permission.

Furthermore, even if a medical institution obtains the patient's consent in advance, this does not mean that the patient has consented to taking photographs using a personal camera for personal purposes, so if the institution allows such a situation to occur, it must be aware that it may be held responsible for its management.

Acquire and manage information appropriately according to the situation

Nowadays, audio and video recording has become a very easy and common method of recording, and it is easy to spread and overflow. Filming in a hospital is not just a two-way relationship between a medical institution and a patient, but also closely involves factors and interests such as third parties and public transmission, and since the purposes and aspects are diverse, I hope you understand that it is not appropriate to uniformly prohibit or ignore it. In particular, medical institutions are overflowing with sensitive information, and information that is subject to special protection as sensitive personal information is acquired and managed by law.

Therefore, it is important to organize the following factors and make judgments on an individual basis: "Why is it a problem?", "Who is recording whom?", "For what purpose is it being recorded?", and "To whom will the information be provided?". Medical institution administrators must formulate and manage rules appropriately while harmonizing the rights of stakeholders.

1 Personal Information Protection Commission FAQ
(https://www.ppc.go.jp/all_faq_index/faq1-q1-13_/)

2. Personal Information Protection Commission: Warning regarding "Handling of personal information in medical institutions"
(https://www.ppc.go.jp/files/pdf/221102_houdou_2_2.pdf)