Replies to LegCo questions
LCQ12: Personal data of medical practitioners published on egazette
Following is a question by the Dr Hon Kwok Ka-ki and a written reply by the Secretary for Health, Welfare and Food, Dr York Chow, in the Legislative Council today (November 1):
Question:
I have received several complaints about the personal data of medical
practitioners published on egazette not being reasonably protected because many
of them use their residential addresses as their medical practitioner's
registered address, but anyone with an ordinary Internet search engine can find
out the personal data of those medical practitioners, such as their registered
addresses, by inputting the name of a doctor and "egazette" (the English name of
the Gazette on the Internet). In this connection, will the Government inform
this Council:
(a) whether it will request the Registrar of Medical Practitioners to issue a
statement each year reminding medical practitioners that they may use their
business addresses or post office box numbers instead of their residential
addresses as their registered addresses;
(b) whether it will request Internet search engine companies to stop using and
delete the personal data of medical practitioners obtained from the egazette so
that the privacy of the medical practitioners concerned can be protected; and
(c) whether there are ways to guard against abuse of the personal data of
medical practitioners contained in the egazette, and whether it will consider
amending the Medical Registration Ordinance (Cap. 161) to provide that
registered addresses of medical practitioners may not be published in the
egazette in order to protect the privacy of medical practitioners?
Reply:
Madam President,
Pursuant to the Medical Registration Ordinance (Cap. 161) (the MR Ordinance), a
registered medical practitioner is required to supply the Registrar of Medical
Practitioners (the Registrar) with a registered address at which notices from
the Medical Council may be served on him. The MR Ordinance also provides that as
soon as may be after January 1 of every year, the Registrar shall publish in the
Gazette a list of all persons whose names appear on Part I and Part III of the
General Register on January 1 and the list shall contain the names, addresses,
qualifications and dates of the qualifications of these persons. In addition, as
soon as may be after July 1 of every year, the Registrar shall publish in the
Gazette a list of the above-stated information of all persons whose names were
added to Part I and Part III of the General Register between January 1 and July
1 of such year. From the Gazette, members of the public can ascertain if a
person is a registered medical practitioner and obtain information about his
registration particulars. A registered medical practitioner should apply for
renewal of his practising or retention certificate annually on a prescribed
form. Now my reply to the question is as follows-
(a) On the application form for practising/retention certificate, it is clearly
stated that the registered address of a registered medical practitioner will be
published in the Gazette and that the registered address supplied to the Medical
Council may either be the business address, residential address or post office
box number. All registered medical practitioners are reminded of this
requirement every year as the renewal of the practising/retention certificate is
an annual exercise.
A registered medical practitioner may, at any time, inform the Registrar in
writing of any change in his address. Medical practitioners are reminded of this
arrangement in the half-yearly Newsletter of the Medical Council. The
Administration encourages the Medical Council to continue this practice of
reminding medical practitioners of this arrangement on a regular basis through
its Newsletter.
(b) & (c) The Gazette is a government publication for public perusal. Upon
gazettal, any information therein becomes public information. Pursuant to the
E-government policy and as an environment-friendly initiative, the
Administration has, since December 2000, uploaded the full set of Gazette onto
the Government's website for public viewing on top of the printed copies.
Under the Personal Data (Privacy) Ordinance (Cap. 486) (the PDP Ordinance), any
person who collects, holds, processes or uses (including disclosure or transfer)
personal data is regarded as a data user, who is subject to the requirements of
the PDP Ordinance. The PDP Ordinance is applicable to personal data processed on
the Internet.
It is provided under Data Protection Principle 3 (restriction on the use of
personal data as to the purpose) in the PDP Ordinance that without the
prescribed consent of the data subject, a data user may not use any personal
data for any purpose other than the purpose for which the data were to be used
at the time of the collection of the data or a purpose directly related to that
purpose. Thus any person who without the prescribed consent of a registered
medical practitioner listed on the Register uses the data for a purpose other
than the purpose for which the data were published in the Gazette, contravenes
the relevant data protection principle. The data subject can lodge a complaint
with the Privacy Commissioner (the Commissioner). If, after investigation, the
Commissioner is of the opinion that the data user has contravened a data
protection principle of the PDP Ordinance, he may, according to section 50 of
the PDP Ordinance, issue an enforcement notice to that data user, directing him
to take measures to remedy the contravention. A data user who contravenes an
enforcement notice commits a criminal offence and is liable on conviction to a
maximum fine of $50,000 and imprisonment for 2 years and, in the case of a
continuing offence, to a daily penalty of $1,000. In addition, the data subject
who suffers damage by reason of the data user's contravention of a requirement
under the PDP Ordinance shall be entitled to compensation from that data user
for that damage through civil proceedings.
Ends/Wednesday, November 1, 2006
Issued at HKT 13:00
NNNN