Guidelines clarify use of personal data for social, healthcare sectors

SINGAPORE — More clarity has been provided on how personal information should be handled under the Personal Data Protection Act (PDPA), which came into effect in July.

If a healthcare institution wishes to conduct research using the personal data and medical records of patients, it would not need to seek consent to use the information if it no longer has their contact details.

This was a scenario given under a set of guidelines issued yesterday by the Personal Data Protection Commission (PDPC) for the healthcare, social, education and photography sectors.

However, the healthcare institution would have to ensure the data is used in the public’s interest and not in a way that is detrimental to patients. And it would have to get patients’ consent if it is able to contact them.

“If there is a need for a healthcare institution to use its patients’ personal data for research purposes and the institution is able to get such consent from its patients, it will have to do so,” said a PDPC spokesman.

The PDPC released the advisory guidelines after a three-week public consultation from May to June.

It has said the healthcare, social, education and photography sectors are among those that typically have to handle personal information in high volumes and that guidelines issued are based on sector-specific scenarios that happen on a regular basis.

In other healthcare-related guidelines, in the case of a general practitioner referring his patient to a specialist, consent is deemed to have been given as long as the patient agrees to the referral.

The social service sector, which drew the most feedback during the consultation — seven of 15 responses — was concerned about how fund-raising messages are sent to donors.

The PDPC clarified yesterday that voluntary welfare organisations (VWOs) are not allowed to include fund-raising inserts in individual customers’ monthly mailers in collaboration with other companies.

However, they can send text messages to their donors and volunteers to ask for donations, subject to the rules of the Do Not Call (DNC) registry.

In the education sector, a question commonly raised by those who responded to the consultation was over the responsibility of school transport operators under the PDPA when using students’ data.

Based on the guidelines, the operators are considered to be an intermediary processing data on behalf of the schools, and schools will be held responsible for complying with the Act.

Meanwhile, those who are concerned that photographs taken of them may be used for an organisation’s annual reports or other corporate publications now have their fears allayed. The organisations taking these pictures will have to ask for consent to use the pictures of these individuals, said the PDPC yesterday.

PDPC chairman Leong Keng Thai said: “These guidelines are aimed at providing greater clarity to businesses and helping consumers to gain a better understanding of how to comply with the PDPA and protect personal data under their care. The PDPC will continue to develop resources to help businesses.”

Those found to breach the data-protection provisions under the PDPA may be fined or ordered to destroy the information, among other enforcement measures.