The Clinic's Waiting-Room Screens
A dental practice with three branches installs a digital check-in terminal in each waiting room. Patients type their name, date of birth, and reason for visit into a tablet; the screen then displays a queue list showing the last three characters of each patient's surname plus their appointment time, so people can see their position. The practice manager argues this is not personal data because surnames are partially masked and no contact details are shown. Separately, the practice's CCTV in the waiting room records continuously and is retained for 30 days. A patient complains that the queue screen let another patient identify her, because her surname is unusual and the time matched a message she had sent a friend. The practice has 4,500 patients and no data protection officer.
1. Is the queue-screen information personal data, and does the practice's masking argument hold? Justify your conclusion using the concept of identifiability.
Read the worked answer
The masking argument fails. Personal data is any information relating to an identified or identifiable person, and identifiability is assessed in the hands of the recipient, considering means reasonably likely to be used.
- Three characters of a surname plus an appointment time is a small combination. In a waiting room of perhaps 8-10 people, the time alone narrows the field dramatically.
- The complainant's unusual surname made the three characters effectively unique within that population.
- The recipient also has corroborating context (a friend knew roughly when she was attending), so re-identification is not hypothetical.
Conclusion: the displayed record is personal data for anyone who can link the fragment to a person, and the practice is the controller. Masking reduces but does not eliminate risk; a defensible design would show a queue number or first name only, or a token the patient keeps.
2. The practice says it has no DPO so the GDPR does not really apply to the terminal. Evaluate this reasoning and state what the practice should actually do before keeping the terminal.
Read the worked answer
Lack of a DPO has no bearing on whether the processing is lawful; a DPO is an accountability role triggered by specific conditions (large-scale systematic monitoring or large-scale special-category processing), not a precondition for the law applying.
What the practice should do:
- Assess necessity and proportionality - is displaying any identifier necessary to manage the queue? A ticket number achieves the same purpose with less data.
- Identify the lawful basis - likely legitimate interests or consent for the service, but the display to other patients is a separate disclosure purpose needing its own justification.
- Minimise - show a queue token, not surname fragments; do not display reason for visit at all.
- Inform - a clear notice at the terminal explaining what is collected, why, retention, and rights.
- Set retention - purge check-in records once the appointment is complete.
- Document the decision (a short DPIA-style record is proportionate here).
The terminal can stay only after redesign; the current display is likely unlawful disclosure to other patients.
3. A patient asks for a copy of the CCTV footage of the waiting room covering the hour of her appointment. Other patients appear in the footage. How should the practice respond?
Read the worked answer
She has a right of access to footage in which she appears, but the rights of the other patients must be balanced.
- Provide the footage, but redact or blur other identifiable individuals unless they consent or it is unreasonable to do so.
- If redaction is impractical, offer a still image or a viewing session rather than an unredacted copy.
- Respond within one month, extendable by two months for complexity.
- Do not refuse on the basis that CCTV is 'security footage' - that is not an exemption.
- Verify her identity before releasing anything.
A proportionate answer: supply a clip with third parties obscured, and explain the redaction in the response.