A television production company which set up “CCTV-style” cameras in a maternity clinic for a Channel 4 documentary on stillbirths – without explicitly warning all visitors they were being filmed has been hit with a £120,000 fine by the Information Commissioner’s Office (ICO).

True Visions Productions (TVP) of London set up CCTV-style cameras and microphones in examination rooms at the clinic at Addenbrooke’s Hospital Cambridge for the documentary.  While it had the hospital trust’s permission to be on site, TVP did not provide patients with adequate information about the filming, which took place from July to November 2017, the ICO found.

The walk-in clinic is for patients who have concerns about their pregnancy.

Steve Eckersley, ICO Director of Investigations, said: “Patients would not have expected to have been filmed in this situation, and many will have been very distressed when they learned such a private and potentially traumatic moment had been recorded. The recorded footage would have included the sensitive personal data of patients who could already be suffering anxiety and stress.”

Legal experts stressed that the NHS Trust itself was desperately lucky not to have been seriously reprimanded or fined, and would likely to have been so under GDPR, as a “joint controller” of the material filmed.

The ICO’s Steve Eckersley added: “We recognise the public interest in programmes that aim to educate and inform, but those responsible for making them must operate within the law, particularly when the subject involves the processing of highly sensitive medical information… there was no valid reason for the television company to have failed to adequately inform patients in advance that they would be filmed.”

An ICO ruling said: “TVP had posted limited notices advising of the filming near to the cameras and in the waiting room area and had left letters on waiting room tables. However, the detailed investigation found that these letters did not provide adequate explanations to patients, with one notice incorrectly stating that mums and visitors would not be filmed without permission.”

“The law says that personal data must be processed fairly and transparently. A patient attending the clinic would not have reasonably expected there to be cameras in examination rooms and would expect to be made aware of any filming.

Recording stopped following negative media coverage of the filming in November 2017. It then resumed until spring 2018 using different filming techniques and the documentary was broadcast the following October. The unlawfully obtained footage was not broadcast and was deleted.

TVP is a Bafta, Emmy and Amnesty-winning production company with a “particular reputation for human rights related film-making”,

The civil monetary penalty was issued under the GDPR’s predecessor, the Data Protection Act 1998, owing to the timing of the case. The maximum financial penalty in civil cases under former laws is £500,000.

Read this: Morrisons Loses Data Breach Appeal: A “Serious Warning” for Business Leaders