May a home-care worker take photos of a client?

Home-care worker with client photo = combination of GDPR + Dutch Medical Treatment Act + Healthcare Quality Act. When IS it allowed? Only under strict conditions: (1) Specific healthcare basis — e.g. wound-care monitoring, pressure-sore progression, for multidisciplinary consult. (2) Explicit client consent (or representative on incapacity). (3) Via professional tooling (healthcare app with NEN 7510 certification) — NOT via private WhatsApp/iPhone photo library. (4) Strictly limited access — only treaters. (5) Retention in record (20 years Dutch Medical Treatment Act). What is NOT allowed: photos on worker's private phone, sharing in general team WhatsApp, photo of sleeping client without consent, "for fun" photo of client environment, photo of naked client without care necessity. On overstepping: (1) IGJ complaint (healthcare quality). (2) AP complaint (GDPR Art. 9 serious violation). (3) Disciplinary law on BIG-registered. (4) Civil damages claim Art. 82 — typically €1,000-€5,000 for non-material harm on medical data. For healthcare organisations: required policy + privacy training + technical restriction (BYOD policy prohibits client photos on private phone). Fine precedent 2024: home-care organisation €120k for systematic undocumented client photos in team app.