The hospital was held not to have taken practicable steps to bring to the notice of its private patients matters under DPP1(3) as the notice was not prominently displayed.
Complainant being a private patient referred to a public hospital for examination - alleged improper use and retention by the hospital of the CT scan taken of him - a personal information collection statement posted up in waiting room - inconspicuous setting to visiting private patients - hospital not taken practicable steps to inform such category of data subjects - enforcement notice to be issued - DPP1(3), DPP2(2) and DPP3 and section 50 of the PD(P)O
The Complaint
The complainant was referred by his private doctor to a public hospital for the taking of a CT scan. Subsequently, he asked the hospital to return the original CT scan film to him. However, the hospital would do so only upon the payment of a standard fee by the complainant, which fee had been announced in the government Gazette. The complainant considered that the hospital was not justified in keeping his CT Scan film. He therefore complained to the PCPD to demand the return of the film to him.
Findings of the Privacy Commissioner
Throughout the case, the complainant insisted that the only data user in the case was the doctor who received him. However, the Privacy Commissioner considered that according to the complainant's allegations, the data user in the case was really the hospital that offered him the medical care and treatment. An investigation was therefore commenced against the hospital and not its individual doctor.
During the investigation, the hospital explained to the Privacy Commissioner that the purpose for taking the CT scan film of the complainant was that of providing continuous healthcare to him. In particular, the film was retained by the hospital to enable the comparison of that film with films taken at other times. Such purpose of providing continuous health care to citizens was, indeed, consistent with the statutory duties of the hospital. On this point, however, the complainant denied ever being made aware of the purpose as stated by the hospital.
The Privacy Commissioner found that the relevant Gazette notice actually provides that a CT film taken in this kind of situation is the property of the hospital. Although the film in question contained the personal data of the complainant, the retention by the hospital of such data was related to the hospital's function of providing healthcare. Accordingly, there was no contravention of DPP2(2) by the hospital. Furthermore, the use of the film for comparison was the same or a directly related purpose for which the film was taken hence consistent with DPP3.
The Privacy Commissioner also found that the hospital had already displayed in the hospital notices to patients, which clearly stated the purpose for which patient's data collected were to be used. No contravention of DPP1(3) was found. The complainant appealed.
The appeal
At the appeal, the AAB decided that, despite the complainant's insistence that the data user in the case was his own doctor and the fact that the grounds of his appeal were not defined clearly, the AAB was to adopt a liberal approach in handling the appeal. On that basis, the AAB found that the data user in the present case was in fact the hospital. The question of who owned the CT scan film was outside the jurisdiction of the Board. However, on the point of notice to patients, the AAB found that the HA had not taken all reasonably practicable steps to bring to the notice of its private patients the matters under DPP1(3), in that for those patients, the notice displayed in the waiting room was not prominent enough. Furthermore, unlike public patients, private patients normally would not have the opportunity to see the larger notices at the cashier counters.
AAB's decision
AAB decided that the hospital was in breach of DPP1(3), and allowed the appeal. The Privacy Commissioner was directed to issue against the hospital an enforcement notice under section 50 of the PD(P)O upon such terms as the Privacy Commissioner considered appropriate and consistent with the decision of the AAB.