This article is not legal advice. It sets out what the citable rules say, which here are the EU GDPR and Spain's implementing law, and flags where, in the absence of a specific ruling, judgement is needed. Pharmacies in Spain fall under the Spanish data protection authority (AEPD).
Why a pharmacy is not an ordinary shop
In a clothes shop, a customer identified on a screen is personal data. In a pharmacy it can be more than that. The GDPR defines data concerning health as personal data that reveals information about a person's physical or mental health, including the provision of healthcare services (art. 4(15)), and places it among the special categories in article 9, whose processing is prohibited unless one of the exceptions listed in that article applies.
The practical consequence is simple. Being in the pharmacy is not health data. Having your name appear next to "medication ready" or "prescription pending" starts to be, because anyone looking can infer that you take medication.
The AEPD has already fined a pharmacy for handling health data without the proper safeguards. The case, published in May 2025, involved a pharmacist in Castilla y León fined EUR 16,000 for noting in her own Excel file the details of customers who asked her to renew their medication without going through the health centre, without informing them and without adequate security measures. It is not about screens, but it shows how health data is viewed in a pharmacy, however small the system.
Queue screens: number, code or name
If the pharmacy uses a queue system, the useful question is not "may we?" but "do we need to?". The data minimisation principle (GDPR art. 5(1)(c)) asks for data that is adequate, relevant and limited to what is necessary. A number is enough to order a queue.
We found no AEPD ruling that specifically addresses calling people by name in a waiting room or on a queue screen, so it is best not to invent a rule. What does exist is practice in healthcare: the Río Hortega University Hospital in Valladolid replaced name announcements over the loudspeaker with an alphanumeric code on screen to call relatives waiting in its surgical waiting rooms, with the stated aim of complying with data protection rules.
Three situations, from least to most sensitive:
| What appears on screen or is spoken | What it reveals | Comment |
|---|---|---|
| Queue number | Nothing about the person | Does the job without exposing anyone |
| First name or initials | Partial identity | Depends on context; in a small village everyone knows each other |
| Name plus "order ready", "prescription", "compounded formula" | Identity and a hint of treatment | Close to health data; the prudent choice is not to do it |
There is also a point of craft. Anyone who has worked in a village pharmacy knows the screen is the least of it when the pharmacist greets people by name and asks "how is the knee?". That rapport is part of the profession. The caution about screens is something else: a screen is a medium everyone can see, that stays there, and that someone can photograph.
Advertising and content screens
A screen that plays prices, promotions or seasonal tips does not process personal data. That covers most of the digital signage installed in pharmacies, and what may be shown is covered in the digital signage guide. Regulated content, such as the advertising of medicines, is also outside this article and is explained in the regulation guide.
Things change if the screen adds elements that look back:
- A camera that estimates the age, sex or attention of passers-by.
- A sensor that counts or detects phones via Wi-Fi or Bluetooth.
- A reader that serves personalised content to the individual.
Each of these is processing with potential identification or profiling, and where the visitor may be buying medicine, the risk is assessed more strictly. GDPR article 35 requires an impact assessment, among other cases, for large-scale processing of special categories of data or large-scale systematic monitoring of a publicly accessible area. A single pharmacy rarely reaches that scale; a network of sensor-equipped screens spread across hundreds of pharmacies may well do. If a supplier offers a screen with sensors, the first contract question is what data leaves it and where it goes. For the point-of-sale advertising business model, the retail media guide covers the commercial angle; the data side follows the same rules as here.
Cameras in the pharmacy
Security cameras are the most common item and, unlike a queue screen, they come with written rules. The LOPDGDD allows processing images to preserve the safety of people, property and premises (art. 22) and sets four rules that can be applied without much interpretation:
- Retention. Images are deleted at most one month after capture, unless they must be kept to prove acts against people, property or premises.
- Information. It is met with a notice in a sufficiently visible place, identifying at least the existence of the processing, the identity of the controller and the possibility of exercising rights. The European Data Protection Board's Guidelines 3/2019, the European reference on video, describe this sign as the first layer of layered information.
- Disclosure. If images are kept because of a criminal act, they are handed to the competent authority within 72 hours of becoming aware of them.
- Employees. When cameras monitor staff, article 22(8) refers to article 89 of the same law, which governs video surveillance in the workplace. There a sign is not enough: staff must be told beforehand, expressly, clearly and concisely. The sign alone only covers the case where an employee is caught in a flagrant unlawful act.
What is particular to a pharmacy is placement. A camera pointing at the dispensing counter records conversations about medication, and framing matters: it is decided at installation, not afterwards. Three points are worth checking: that it does not capture the consultation area or services such as blood pressure checks, that whoever accesses the footage is identified, and that sound recording, if any, has been assessed separately. In the workplace, LOPDGDD article 89(3) only allows it where the security risks are significant, and subject to proportionality and minimal intervention.
What to decide before installing anything
A short checklist, for before signing with a supplier:
- What data comes out. For each screen, camera or sensor, write one line: what data, whose, for what purpose.
- Who is responsible. The pharmacy is normally the controller; the supplier, the processor. If the supplier processes data for its own purposes, you need to know and it must be in the contract.
- Where it is stored. On the device, in the cloud, in which country. With health data, the security appropriate to the risk required by article 32 is not optional.
- What customers are told. The sign and the basic information, with both processing activities listed in the record of processing activities.
- What happens when someone asks. A customer can request access to their image. You need to know who answers and how quickly.
- Minimum by default. If the name is not needed, do not show it. If sound is not needed, do not record it.
What this text does not settle
Some questions no general guide can answer: whether your particular queue system shows data that, in your town, amounts to identifying someone; whether a camera in your premises is framed correctly; whether your supplier contract fits. That is what your pharmacy's data protection officer or a specialist adviser is for. Pricing and labelling, though also monitored, follow other rules: see the article on till price errors and the electronic shelf label guide for pharmacies, where shelf labels do not process personal data because they only show price and product.
Sources and limits
The rules cited are the GDPR and the LOPDGDD in their consolidated text, and the EDPB guidelines on video. For the practical detail on cameras, the Spanish reference is the AEPD guide on video cameras, updated in February 2025. The LOPDGDD and the AEPD material are in Spanish; the quotations here are our own translation. We found no AEPD ruling on queue screens with names in pharmacies; if one appears, this article will be updated. The content was reviewed on 9 November 2026.
Sources
- Regulation (EU) 2016/679 (GDPR), arts. 4(15), 5, 9, 13, 32 and 35 (EUR-Lex)
- Ley Orgánica 3/2018 on Personal Data Protection and the guarantee of digital rights (LOPDGDD), arts. 22 and 89 (BOE, consolidated text, in Spanish)
- EDPB, Guidelines 3/2019 on processing of personal data through video devices (final version, 30 January 2020)
- Economist & Jurist: EUR 16,000 fine on a pharmacist who kept patients' health data in an Excel file (8 May 2025, in Spanish)
- Hospital Universitario Río Hortega: anonymous call system for patients and relatives (in Spanish)
- AEPD, Guide on the use of video cameras for security and other purposes (February 2025, in Spanish)
