BAILII is celebrating 24 years of free online access to the law! Would you consider making a contribution?
No donation is too small. If every visitor before 31 December gives just £1, it will have a significant impact on BAILII's ability to continue providing free access to the law.
Thank you very much for your support!

 

In November 2011 the Office received a complaint from an individual regarding what she considered excessive personal data being sought by a fertility clinic. The complainant informed us that she had been attending at the clinic, that she had been told at one of her appointments that the clinic required a photograph of her and her partner and that, without it, she could not proceed with the fertility treatment. The complainant allowed the clinic to take the photograph but she felt that it was excessive.

 

The complainant alleged that she had not been informed at the initial consultation of the compulsory condition to provide a photograph. Following further communication with the clinic, the complainant was informed that the photograph was necessary to prevent and diminish any potential mistakes with identification of tissue tests and embryos.

 

We wrote to the clinic and we asked it to outline the basis for the collection of photographs, and the need for them to be retained on the clinic's database. We also asked if the same level of security could otherwise be achieved by having sight of the patient's photographic identification, without retaining a copy of it.

 

In its response, the clinic indicated that the basis for the collection of the photographs was to verify the identity of each patient when they presented for an appointment. It informed us that it believed this to be an appropriate security measure to minimise the risk of unauthorised access to or disclosure of medical records to anyone other than the presenting patient. It also informed us that it was not possible to maintain and provide the same level of security by having sight of photographic identity without retaining a copy.

 

As a result of this complaint, the clinic undertook to introduce some new procedures. This involves requesting all patients to sign a consent form for the taking of their photograph. If a patient refuses to sign the form, the data protection officer at the clinic will meet with the patient to explain the purpose of the photograph and to offer an alternative option of producing photographic identification at each appointment. In this case, the clinic undertook to facilitate the complainant and her partner's request to have their photographs removed from the database.

 

This Office was satisfied with the new procedures as they took into account the patient's preference while at the same time maintaining the same level of security which the clinic required.