Q: We are an insurance company. We are handling some employees' compensation claims wherein the injured employees alleged that they sustained personal injuries by accidents arising out of and in the course of employment. However, there is evidence showing that the alleged accidents had not occurred at all. Therefore it becomes necessary for us to consider the credibility or honesty of the employees as a whole. In this connection, we may have to make inquires with other insurers through a particular industry arrangement to ascertain whether there were other suspicious claims records of the employees concerned. In the process of enquiries, certain personal data of the claimants would have to be disclosed to other insurers. The question is whether we could rely on the exemption of section 58(2) of the Personal Data (Privacy) Ordinance ("the Ordinance") to excuse the disclosure of personal data without the prior express consent of the claimants.
A: Section 58(2) of the Ordinance provides exemption to the application of Data Protection Principle 3 of the Ordinance in certain defined circumstances. The making of a fraudulent insurance claim by an employee would presumably amount to "unlawful or seriously improper conduct, or dishonesty" within the meaning of paragraph (d) of section 58(1) of the Ordinance, the prevention of which is one of those defined circumstances. Whether the available evidence is sufficient to give rise to a reasonable suspicion of dishonesty on the part of the employee is a matter for you to decide. This will depend on the facts of the particular case. Where the exemption of section 58 is shown to apply, you may transfer the personal data of the employee concerned to other insurers through the established industry arrangement for the purpose of making the intended enquiry. In responding to your enquiry, however, other insurers will also be subject to the restriction of Data Protection Principle 3 unless they have the employee’s prescribed consent or unless the exemption under section 58 is also available to them.
It cannot be too much emphasized that section 58 cannot be used as an excuse for data exchange in every case. Generally speaking, before you could claim exemption under section 58, there should be sufficient reason for you to suspect that there has been dishonesty etc. on the part of the employee concerned. Moreover, the onus will be on you to prove that the circumstances are indeed such that all the requirements under section 58(2) are satisfied. The same applies to any other insurer who may choose to transfer data to you pursuant to your request.