A property management company should not refer a resident to a mental health service organisation by disclosing the resident’s personal data without consent- DPP3
The Complaint
The Complainant had received a home visit from a mental health service organisation, during which he agreed to join the organisation as a member and use its services. The organisation later wrote a report on the Complainant's mental condition. As the report mentioned the details of disputes between the Complainant and his neighbour, the Complainant believed that the data was supplied to the organisation by the management company of his housing estate. Hence, the Complainant lodged a complaint with the PCPD against the management company for disclosing his personal data to the organisation without his consent.
According to the management company, as the Complainant had several disputes with his neighbour, it believed that the organisation might provide appropriate service to the Complainant. Hence, it referred the Complainant to the organisation, which then paid the Complainant a visit at his home. The management company admitted that it had, without the Complainant’s prescribed consent, supplied the Complainant’s background information to the organisation when making the referral.
Outcome
In view of the disputes between the Complainant and his neighbour, the management company wishfully assumed that the organisation could intervene to provide the Complainant with appropriate follow-up and hence improve the situation. However, the management company had not considered the Complainant’s will before referring him and disclosing his personal data to the organisation. The Commissioner was of the view that the referral did not relate to the original purpose of collection of the Complainant’s personal data by the management company (i.e. for handling disputes among residents of the housing estate), and the management company had not obtained the Complainant’s prescribed consent before disclosure, thus the act of the management company violated DPP3.
After the PCPD’s intervention, the management company gave written guidelines and verbal instructions to its staff, requiring them to obtain written consent from residents before transferring or releasing residents’ personal data to any third party.
(Uploaded in September 2016)