- Personal data. If the content promotes the organisation’s services, the organisation acts as the operator, even when the publication is posted on an employee’s page. Before-and-after photos may contain health information, i.e. special personal data. Their processing is permitted only in strictly defined cases, for example for organising the provision of medical care (para. 6 of clause 2 of Art. 8 of Law No. 99-Z). Publication on social media does not fall within such purposes, so the data subject’s consent is required, and this is supported by practice.
- Medical confidentiality. Information on the fact of seeking medical care, the state of health and other information obtained in the course of providing such care constitutes medical confidentiality (Part 6 of Art. 46 of Law No. 2435-XII).
- Advertising of medical services. If ‘before and after’ photos are aimed at attracting clients’ attention to the medical centre’s services, the material may be recognised as advertising. Special requirements for the advertising of medical services apply (Art. 15 of Law No. 225-Z), and liability, as a rule, lies with the advertiser, i.e. the medical centre.
What this means for companies:
Employment relations may become grounds for attributing an employee’s actions to the employer. The excuse ‘it’s a personal account’ will not protect the company if the content is related to its activities and works for its clients. This applies not only to clinics: any company whose employees publish the data of clients or counterparties may find itself in such a situation.
What you should do:
- Strengthen control over employees’ compliance with personal data legislation and enshrine this in local regulations and employment contracts.
- Set rules for running professional accounts: what may be published, and what only after approval.
- Train employees who run blogs on behalf of the company or mention their place of work.
If you need to check whether your processes and advertising comply with the requirements of Belarusian legislation, write to @reveraonline.
