Date: 13 March 2025
Administrative Appeals Board Dismisses EC Healthcare’s Appeal
The Administrative Appeals Board (AAB) earlier dismissed the appeal lodged by EC Healthcare against the decision of the Privacy Commissioner for Personal Data (Privacy Commissioner) to serve an enforcement notice.
In dismissing all 3 grounds of appeal raised by EC Healthcare, the AAB upheld the Privacy Commissioner’s findings that EC Healthcare had contravened the requirements of Data Protection Principle 3 of the Personal Data (Privacy) Ordinance (PDPO) by sharing the personal data of the clients of two of its brands, namely, Primecare Paediatric Wellness Centre (Primecare) and New York Medical Group (NYMG) with other brands under EC Healthcare.
The AAB agreed with the Privacy Commissioner’s finding that frontline staff of EC Healthcare’s brands were able to use and make cross-brand access to clients’ personal data in EC Healthcare’s integrated system. The AAB stressed that personal data collected by Primecare or NYMG was intended for the provision of services by those brands only but not by other brands within the same field of services or within the same group company. The Personal Information Collection Statement of EC Healthcare, which permitted access of personal data across different brands, would only apply to new customers who consented to the Statement, but not personal data collected by the companies concerned before they were acquired by EC Healthcare.
The AAB also rejected EC Healthcare’s allegations of procedural irregularities. It was observed that by providing EC Healthcare with the relevant parts of the draft investigation report in advance, the Privacy Commissioner had already done more than what was required under the PDPO.
- End -