The complaint was made more than 2 years after the event and no good explanation was given for the delay - The collection of a patient's medical records by a medical practitioner for the purpose of treatment is not, without more, an unlawful or unfair means of data collection and does not offend against any data protection principles - It is beyond the scope of the Privacy Commissioner's duty to determine whether the medical opinions contained in the prescribed forms under the Mental Health Ordinance were accurate or not - unnecessary to investigate -- DPP 2(1), sections 39(1)(a) and 39(2)(d)
The complaint
The complainant was admitted to the hospital on 10 August 2002. She complained to the Privacy Commissioner that the doctors of the hospital collected her medical records from other hospitals without her consent. Based on those medical records, the doctors stated in the prescribed Forms 1, 2 and 3 under section 35A(1) of the Mental Health Ordinance that she was suffering from mental illness and made an application to the District Court for her detention. An order was made by the court to detain the complainant in a mental institution. The complainant also complained to the Privacy Commissioner that, in contravention of data protection principle ("DPP") 2(1) of the Personal Data (Privacy) Ordinance ("the Ordinance"), those medical records contained incorrect information about her mental status, as she claimed she had never suffered from any mental illness.
Findings by the Privacy Commissioner
The Privacy Commissioner refused to carry out an investigation on two main grounds. Firstly, the Privacy Commissioner is entitled pursuant to section 39(1)(a) not to carry out an investigation if the complainant has actual knowledge of the act complained of for more than two years immediately preceding the date when the Privacy Commissioner received the complaint. In this case, the event complained of took place some 3 years and 8 months before the complainant made her complaint. There was nothing to suggest that the complainant was unaware of the grounds of her complaint and no reason was given for the delay. Secondly, the Privacy Commissioner took the view that the statements made by the doctors of the hospital in those Forms were matters of medical opinion, and therefore the Privacy Commissioner would not be in a position to comment on the accuracy or otherwise of an opinion made by a medical professional. The Privacy Commissioner therefore considered that any investigation was unnecessary under sections 39(1)(a) and 39(2)(d) of the Ordinance. Dissatisfied with the decision of the Privacy Commissioner, the complainant lodged an appeal to the Administrative Appeals Board ("AAB").
The appeal
The AAB found that the Privacy Commissioner has discretion to decide whether to investigate into a stale complaint and it should be slow to interfere with the discharge of his statutory duty unless there are good grounds to show that his discretion has been exercised erroneously. Even if the Appellant was compulsorily detained in the mental institution as claimed, the AAB found that it did not explain why the complainant did not lodge any complaint to the Privacy Commissioner after her discharge from the mental institution in early 2005 and delayed making the complaint to the Privacy Commissioner until April 2006. The AAB found that the Privacy Commissioner was entitled to take the view that there was no good explanation for the delay in this case.
The AAB found no error in the Privacy Commissioner's view that he would not be in a position to determine whether the opinions concerning the mental condition of the complainant contained in those Forms were accurate or not. That is clearly beyond the scope of the Privacy Commissioner's duty. The AAB also found that there was nothing inherently wrong in the doctors of the hospital obtaining the complainant's medical records. The collection of medical records of a patient by a medical practitioner for the purpose of the patient's treatment is not, without more, an unlawful or unfair means of data collection and does not offend against any data protection principles under the Ordinance.
AAB's decision
The appeal was dismissed.