Case Notes

(AAB Appeal No. 6 of 2020)

Data correction request —a data user may refuse to comply with the request if it is not satisfied that the correction is correct—data correction request should be made by a data subject — primary subject matter of the complaint did not relate to protection of personal data privacy — discretion not to further investigate the complaint duly exercised

Coram:
Mr Douglas LAM Tak-yip, SC (Presiding Chairman)
Mr Eugene CHAN Yat-him (Member)
Ir LAU Wing-yan (Member)

Date of Decision: 29 September 2021

The Complaint

The Appellant was a couple who received family counselling service from a social worker of a non-profit organisation (“Organisation”). The Organisation subsequently referred the wife’s case to a hospital (“Hospital”) for follow-up. Upon receipt of the referral from the Organisation, the Hospital sent the psychiatric doctor and nurse from its community outreach team (“Outreach Team”) to visit the Appellant’s home. The Outreach Team met with the wife and collected further information from her.

The Appellant was dissatisfied that (1) the Hospital did not confirm, whether orally or in writing, having received the wife’s consent to the collection of her personal data; (2) the Outreach Team did not introduce themselves or explain the reason for the home visit unequivocally, which led the wife to misapprehend that they were the outreach social workers from the Hospital and so she provided her personal data to them; (3) the Hospital incorrectly recorded how their son was admitted to the Accidental & Emergency Department of the Hospital in the wife’s medical record. The Appellant contended that their son took a taxi to the Hospital and was companied by the husband and was not taken by an ambulance as recorded in the report, and the Hospital refused to correct the relevant record.

The Appellant believed that the Hospital had contravened the PDPO and lodged a complaint to the Privacy Commissioner.

The Privacy Commissioner’s Decision

Having considered all the available information, the Privacy Commissioner did not find any evidence of any contravention of the requirements of the PDPO and the primary subject matter of the complaint was not related to personal data privacy, and hence exercised discretion under sections 39(2)(ca) and (d) of the PDPO not to further investigate the Appellant’s complaint. Being dissatisfied with the Privacy Commissioner’s decision, the Appellant lodged an appeal to the AAB.

The Appeal

The AAB confirmed the Privacy Commissioner’s decision and dismissed the appeal on the following grounds:-

1. The Hospital obtained the wife’s personal data from the Organisation (but not the data subject). The PDPO did not require a data user (i.e. the Hospital) to obtain prior consent from a data subject for collecting his/her personal data. As regards the Appellant’s misunderstanding that the Outreach Team comprised social workers but not medical staff, there was miscommunication between the Outreach Team and the Appellant, and the matter was not relevant to personal data privacy.
2. As a public hospital, the Hospital’s function is to provide medical services to the members of the public. The Hospital collected the wife’s personal data for the purpose of following up with her medical health conditions, and such collection was directly related to its function. Furthermore, the collected data was used by the Hospital for medical purpose, i.e. to assess her medical health conditions, which was the same as the original purpose or directly related purpose for which the data was collected, and such personal data was not used for a “new purpose” as defined under Data Protection Principle 3. In addition, the Appellant agreed that they were willing to be visited by social workers of the Hospital which also meant that they gave consent to the Hospital (as the same data user) for collecting more information from the wife through the home visit.
3. As regards the way in which the son was taken to the Hospital, the record was made based on what was said by the husband about his wife’s situation during the telephone conversation between him and the nurse before the home visit. There was nothing wrong with the Hospital to record the information provided by him, regardless of its correctness, during such conversation. Section 24(3) of the PDPO stipulates that if a data user is not satisfied that the correction is accurate, he/she may refuse to comply with such data correction request. Strictly speaking, the information relating to how the Appellant’s son was taken to hospital was personal data of the son, but not of the Appellant. The data correction request should be made by the data subject. Even though the Hospital refused such request, there was no contravention of the requirements of data correction request under the PDPO.
4. The primary subject matter of the complaint did not relate to protection of personal data privacy. The complaint was related to the medical service provided to the wife by the Hospital and the alleged falsified document or misdiagnosis which was beyond the purview of the PDPO or the functions of the Privacy Commissioner.

The AAB’s Decision

The appeal was dismissed.

(Uploaded in March 2024)