Q: A government doctor wished to clarify whether he could disclose the personal data of an underaged girl (12-16 years old), who had received medical treatment from a public clinic, to another government department without the consent of her "legal guardian"
A: DPP3 of the Ordinance stipulates that personal data shall not, without the prescribed consent (meaning express consent given voluntarily) of the data subject, be used (including transfer and disclosure of the data) for any purpose other than the purpose for which the data were to be used when collected or a directly related purpose.
Hence, when the use of personal data collected does not fall within the original purpose of collection or its directly related purpose, it is prudent that the prescribed consent of the data subject be obtained in complying with DPP3, unless any exemption under Part VIII of the Ordinance applies.
For consent to be voluntarily and expressly given, the Privacy Commissioner finds it relevant that the data subject must possess the requisite mental capacity to understand the impact of giving or withholding his/her consent on his/her personal data privacy. The Ordinance does not provide for consent to be given by others on behalf of the data subject, e.g. consent purportedly given by one who has parental responsibility of the data subject who is a minor.
Where consent cannot be validly obtained, due consideration may be given by the data user to any applicable exemption provision under Part VIII of the Ordinance. Section 59 may be relevant for consideration where application of DPP3 would be likely to cause serious harm to the physical or mental health of the data subject or any other individual. It is however to be noted that section 59 has only a narrow application to physical and mental health data and it does not extend to exempt disclosure of other data (e.g. the data subject's address).