Q: We are a solicitor firm and act for the personal representative of a deceased person. The said personal representative is considering a claim for medical negligence against the hospital that has negligently treated the deceased. In order to properly instruct a medical expert, we need to obtain all the medical records held by the hospital with respect to the deceased. The question is whether a personal representative could step into the shoes of a deceased person to make a data access request for the medical records.
A: A deceased person's data are not "personal data" within the meaning of the Personal Data (Privacy) Ordinance ("the Ordinance"). Paragraph (a) of the definition of "personal data" as defined in section 2(1) of the Ordinance requires that the relevant data relate directly or indirectly to a living individual. Therefore, the hospital concerned has no obligation under the Ordinance to comply with the data access request in relation to the deceased person's data notwithstanding that your client is the deceased's personal representative.