Further processing personal data without consent [08/04/2010]
My Office received a complaint in December 2008 from a data subject regarding the alleged use of video clips of her and her family for training purposes, without her consent, by a health service provider. The video clips were recorded with the data subject's consent as part of her family's participation in a particular programme known as Marte Meo. The data subject's family had agreed to participate in the programme for the purpose of being a foster family. The data subject informed my Office that she first became aware that video clips concerning her family's participation in the programme had been shown at a conference held in Germany when her Fostering Social Worker telephoned her after the event to give her feedback from the conference.
According to the health service provider, the Marte Meo model is used by their Social Work Teams as a supportive intervention in fostering cases. It is a film-based intervention used to provide feedback to the prospective foster family on their natural supportive communications and how these can support their preparation for a foster placement. In this case the data subject's family were asked by the health service provider to provide care to two young girls in an emergency situation.
The health service provider informed my Office that the data subject's Fostering Social Worker understood that the data subject had given verbal consent for the use of the video clips by her supervisor at the conference. The health service provider confirmed to my Office that two short video clips of the fostering video tape were used at the conference. The health service provider also confirmed that when the proposal to use the video clips was first put to the data subject she was informed that a signed consent would be sought. However, on a subsequent visit to the data subject's home, the Fostering Social Worker forgot to bring the consent form. The health service provider proceeded to use the video clips even though it had not obtained the written consent of the data subject and her family.
My Office informed the health service provider of our view that it had breached the Acts by further processing the video clips without obtaining the consent of the data subject and her family. My Office also informed the health service provider that, based on information provided by them, the breach occurred when the health service provider departed from its own procedures - i.e. it failed to obtain written consent.
My Office's approach to complaints is to try to reach an amicable resolution. The health service provider confirmed its willingness to acknowledge its error and to apologise in writing to the data subject. It also informed us that a system was now in place to ensure that all consent forms are completed according to the Marte Meo standards. The data subject accepted the amicable resolution of her complaint.
This case study demonstrates how an organisation can breach the Acts when its staff, however well-intentioned, fail to follow internal procedures. It also highlights the importance of staff training in data protection.