PCPD - Response to the loss of medical data by Department of Health

Date: 25 April 2008

Response to the loss of medical data by Department of Health

1.    In response to the loss of a USB flash drive carrying patients' personal data by the Department of Health, the PCPD issued the following statement.

2.    In accordance with Data Protection Principle 4 of the Personal Data (Privacy) Ordinance ("the Ordinance"), all practicable steps shall be taken to ensure that personal data held by a data user are protected against unauthorized or accidental access, processing, erasure or other use having particular regard to the kind of data and the harm that could result if any of those things should occur.

3.    The PCPD has been informed of the case and has contacted the Department of Health to see if its data handling procedure and security measures are in compliance with the provisions of the Ordinance; and to make recommendation to mitigate the harm to the affected individuals, e.g. to inform them as soon as possible so that they can stay alert.

4.    The Privacy Commissioner for Personal Data Mr. Roderick B Woo takes the opportunity to remind both the public and private sectors to exercise particular caution when handling personal data. Stringent handling procedure and sufficient security safeguards should be implemented. In particular, when sensitive personal data are stored or transmitted by electronic means, the data shall be encrypted.

5.    Contravention of a data protection principle is not a criminal offence under the Ordinance. However, where the Commissioner embarks on an investigation and at the conclusion of the investigation he finds that the data user is contravening a requirement under the Ordinance or has contravened such requirement in the circumstances that make it likely that the contravention will continue or be repeated, the Commissioner may serve an enforcement notice on the data user to direct it to take necessary step to remedy the contravention. If a data user fails to comply with the terms of the enforcement notice, he then commits a criminal offence. Contravention of an enforcement notice is an offence that could result in a fine at Level 5 (at present $50,000) and imprisonment for 2 years.

END